Merge master into jben/refactor-state-and-helper-pattern

Resolved conflicts by:
1. Removed TLS lock members logic (now blocked by validation per CLOUDP-349087)
2. Kept helper pattern refactoring from this branch
3. Adapted master's simplified replicaSet building to use helper pattern receivers
4. Removed test for deleted updateOmDeploymentDisableTLSConfiguration function

The helper pattern separates reconciliation state into ReplicaSetReconcilerHelper
that exists only for a single reconcile execution, keeping the shared controller
instance stateless.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

Author: Julien-Ben

.evergreen-functions.yml

@@ -227,6 +227,9 @@ functions:
     type: setup
     params:
       working_dir: src/github.com/mongodb/mongodb-kubernetes
+      include_expansions_in_env:
+        - quay_prod_username
+        - quay_prod_robot_token
       add_to_path:
         - ${workdir}/bin
         - ${PROJECT_DIR}/bin
@@ -507,21 +510,18 @@ functions:
       params:
         working_dir: src/github.com/mongodb/mongodb-kubernetes
         binary: scripts/release/publish_helm_chart.sh
-        
+
   build_multi_cluster_binary:
     - command: subprocess.exec
       params:
         working_dir: src/github.com/mongodb/mongodb-kubernetes
-        binary: scripts/dev/run_python.sh scripts/release/kubectl-mongodb/python/build_kubectl_plugin.py
-  
-  build_and_push_appdb_database:
+        binary: scripts/release/kubectl_mongodb/build_kubectl_plugin.sh
+
+  download_multi_cluster_binary:
     - command: subprocess.exec
       params:
-        working_dir: src/github.com/mongodb/mongodb-kubernetes/docker/mongodb-kubernetes-appdb-database
-        binary: ./build_and_push_appdb_database_images.sh
-        add_to_path:
-          - ${workdir}/bin
-          - ${workdir}
+        working_dir: src/github.com/mongodb/mongodb-kubernetes
+        binary: scripts/release/kubectl_mongodb/download_kubectl_plugin.sh
 
   build_test_image_ibm:
     - command: subprocess.exec
@@ -542,50 +542,9 @@ functions:
         working_dir: src/github.com/mongodb/mongodb-kubernetes
         binary: scripts/release/pipeline.sh
         env:
-          IMAGE_NAME: ${IMAGE_NAME}
-          FLAGS: ${FLAGS}
-
-  pipeline_agent:
-    - command: subprocess.exec
-      retry_on_failure: true
-      type: setup
-      params:
-        shell: bash
-        <<: *e2e_include_expansions_in_env
-        working_dir: src/github.com/mongodb/mongodb-kubernetes
-        binary: scripts/release/pipeline_agent.sh
-        env:
-          FLAGS: ${FLAGS}
-
-  pipeline_ops_manager:
-    - command: subprocess.exec
-      retry_on_failure: true
-      type: setup
-      params:
-        shell: bash
-        <<: *e2e_include_expansions_in_env
-        working_dir: src/github.com/mongodb/mongodb-kubernetes
-        binary: scripts/release/pipeline_ops_manager.sh
-
-  pipeline_readiness_probe:
-    - command: subprocess.exec
-      retry_on_failure: true
-      type: setup
-      params:
-        shell: bash
-        <<: *e2e_include_expansions_in_env
-        working_dir: src/github.com/mongodb/mongodb-kubernetes
-        binary: scripts/release/pipeline_readiness_probe.sh
-
-  pipeline_version_upgrade_hook:
-    - command: subprocess.exec
-      retry_on_failure: true
-      type: setup
-      params:
-        shell: bash
-        <<: *e2e_include_expansions_in_env
-        working_dir: src/github.com/mongodb/mongodb-kubernetes
-        binary: scripts/release/pipeline_version_upgrade_hook.sh
+          IMAGE_NAME: ${image_name}
+          BUILD_SCENARIO_OVERRIDE: ${build_scenario}
+          FLAGS: ${flags}
 
   teardown_cloud_qa_all:
     - command: shell.exec
@@ -839,22 +798,6 @@ functions:
         script: |
           ./scripts/code_snippets/tests/${task_name}
 
-  #
-  # kubectl mongodb plugin release functions
-  #
-  install_goreleaser:
-    - command: shell.exec
-      type: setup
-      include_expansions_in_env:
-        - goreleaser_pro_tar_gz
-      params:
-        script: |
-          set -Eeu pipefail
-          curl -fL "${goreleaser_pro_tar_gz}" --output goreleaser_Linux_x86_64.tar.gz
-          tar -xf goreleaser_Linux_x86_64.tar.gz
-          chmod 755 ./goreleaser
-          sudo cp goreleaser /usr/local/bin/
-
   install_macos_notarization_service:
     - command: shell.exec
       type: setup
@@ -888,8 +831,8 @@ functions:
   release_kubectl_mongodb_plugin:
     - command: github.generate_token
       params:
-        expansion_name: generated_token
-    - command: shell.exec
+        expansion_name: GH_TOKEN
+    - command: subprocess.exec
       type: setup
       params:
         working_dir: src/github.com/mongodb/mongodb-kubernetes
@@ -906,15 +849,7 @@ functions:
           - triggered_by_git_tag
           - OPERATOR_VERSION
         env:
-          XDG_CONFIG_HOME: ${go_base_path}${workdir}
-          GO111MODULE: "on"
-          GOROOT: "/opt/golang/go1.24"
           MACOS_NOTARY_KEY: ${macos_notary_keyid}
           MACOS_NOTARY_SECRET: ${macos_notary_secret}
-        # shell.exec EVG Task doesn't have add_to_path, so we need to explicitly add the path export below.
-        script: |
-          set -Eeu pipefail
-          export GORELEASER_CURRENT_TAG=${OPERATOR_VERSION|*triggered_by_git_tag}
-          export PATH=$GOROOT/bin:$PATH
-          export GITHUB_TOKEN=${generated_token}
-          ${workdir}/goreleaser release --clean
+          GH_TOKEN: ${GH_TOKEN}
+        binary: scripts/dev/run_python.sh scripts/release/kubectl_mongodb/promote_kubectl_plugin.py

.evergreen-release.yml

@@ -9,10 +9,10 @@ tasks:
     commands:
       - func: clone
       - func: setup_building_host
-      - func: build_multi_cluster_binary
+      - func: download_multi_cluster_binary
       - func: pipeline
         vars:
-          IMAGE_NAME: meko-tests
+          image_name: meko-tests
 
   - name: release_operator
     tags: [ "image_release" ]
@@ -23,7 +23,7 @@ tasks:
       - func: quay_login
       - func: pipeline
         vars:
-          IMAGE_NAME: operator
+          image_name: operator
 
   # Releases init images to Quay
   - name: release_init_appdb
@@ -35,7 +35,7 @@ tasks:
       - func: quay_login
       - func: pipeline
         vars:
-          IMAGE_NAME: init-appdb
+          image_name: init-appdb
 
   - name: release_init_database
     tags: [ "image_release" ]
@@ -46,7 +46,7 @@ tasks:
       - func: quay_login
       - func: pipeline
         vars:
-          IMAGE_NAME: init-database
+          image_name: init-database
 
   - name: release_init_ops_manager
     tags: [ "image_release" ]
@@ -57,7 +57,7 @@ tasks:
       - func: quay_login
       - func: pipeline
         vars:
-          IMAGE_NAME: init-ops-manager
+          image_name: init-ops-manager
 
   - name: release_database
     tags: [ "image_release" ]
@@ -68,7 +68,7 @@ tasks:
       - func: quay_login
       - func: pipeline
         vars:
-          IMAGE_NAME: database
+          image_name: database
 
   - name: release_readiness_probe
     tags: [ "image_release" ]
@@ -77,7 +77,9 @@ tasks:
       - func: clone
       - func: setup_building_host
       - func: quay_login
-      - func: pipeline_readiness_probe
+      - func: pipeline
+        vars:
+          image_name: readiness-probe
 
   - name: release_version_upgrade_hook
     tags: [ "image_release" ]
@@ -86,7 +88,9 @@ tasks:
       - func: clone
       - func: setup_building_host
       - func: quay_login
-      - func: pipeline_version_upgrade_hook
+      - func: pipeline
+        vars:
+          image_name: upgrade-hook
 
   - name: prepare_and_upload_openshift_bundles
     tags: [ "openshift_bundles" ]
@@ -119,17 +123,27 @@ tasks:
     tags: [ "binary_release" ]
     commands:
       - func: clone
-      - func: install_goreleaser
+      - func: python_venv
       - func: install_macos_notarization_service
       - func: release_kubectl_mongodb_plugin
-    
+
   - name: create_chart_release_pr
     tags: [ "helm_chart_release_pr" ]
     commands:
       - func: clone
       - func: python_venv
       - func: create_chart_release_pr
 
+  - name: release_chart_to_oci_registry
+    tags: [ "release_chart_to_oci_registry" ]
+    commands:
+      - func: clone
+      - func: python_venv
+      - func: setup_kubectl
+      - func: setup_aws
+      - func: helm_registry_login
+      - func: publish_helm_chart
+
 ### Release build variants
 buildvariants:
 
@@ -209,6 +223,9 @@ buildvariants:
     allowed_requesters: [ "patch", "github_tag" ]
     run_on:
       - release-ubuntu2404-small # This is required for CISA attestation https://jira.mongodb.org/browse/DEVPROD-17780
+    depends_on:
+      - name: release_kubectl_mongodb_plugin
+        variant: release_kubectl_mongodb_plugin
     tasks:
       - name: build_test_image_for_smoke_tests
 
@@ -235,6 +252,8 @@ buildvariants:
     depends_on:
       - name: "*"
         variant: release_images
+      - name: "*"
+        variant: init_smoke_tests
     tasks:
       - name: e2e_smoke_task_group
 
@@ -255,3 +274,12 @@ buildvariants:
     allowed_requesters: [ "patch", "github_tag" ]
     tasks:
       - name: create_chart_release_pr
+
+  - name: release_chart_to_oci_registry
+    display_name: release_chart_to_oci_registry
+    tags: [ "release" ]
+    run_on:
+      - release-ubuntu2404-small # This is required for CISA attestation https://jira.mongodb.org/browse/DEVPROD-17780
+    allowed_requesters: [ "patch", "github_tag" ]
+    tasks:
+      - name: release_chart_to_oci_registry

.evergreen-snippets.yml

@@ -7,7 +7,7 @@ variables:
       - func: setup_mongosh
       - func: download_kube_tools
       - func: switch_context
-      - func: build_multi_cluster_binary
+      - func: download_multi_cluster_binary
     teardown_task:
       - func: upload_e2e_logs
       - func: upload_code_snippets_logs

.evergreen-tasks.yml

@@ -502,7 +502,7 @@ tasks:
     commands:
       - func: "e2e_test"
 
-  - name: e2e_disable_tls_scale_up
+  - name: e2e_disable_tls_and_scale
     tags: [ "patch-run" ]
     commands:
       - func: "e2e_test"
@@ -1116,7 +1116,6 @@ tasks:
 
   - name: e2e_multi_cluster_validation
     tags: [ "patch-run" ]
-    exec_timeout_secs: 1000
     commands:
       - func: e2e_test