feat: add auto-detect for OpenShift platform

knrc · knrc · commit c7ea49b0ec30 · 2025-11-03T16:10:48.000-08:00
Signed-off-by: Kevin Conner &lt;kev.conner@gmail.com&gt;
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -237,8 +237,6 @@ jobs:
         run: make dev-images && cat config/default/images.env
 
       - name: Deploy operator container
-        env:
-          OPENSHIFT: false
         run: make deploy
 
       - name: Wait for operator to be ready
@@ -338,7 +336,6 @@ jobs:
         env:
           TEST_BASE_CATALOG: registry.redhat.io/redhat/redhat-operator-index:${{ vars.OLM_INDEX_VERSION }}
           TEST_TARGET_CATALOG: ${{ env.CATALOG_IMG }}
-          OPENSHIFT: false
         run: go test -p 1 ./test/e2e/... -tags=upgrade -timeout 20m
 
       - name: Archive test artifacts
@@ -403,8 +400,6 @@ jobs:
         run: make dev-images && cat config/default/images.env
 
       - name: Deploy operator container
-        env:
-          OPENSHIFT: false
         run: make deploy
 
       - name: Wait for operator to be ready
@@ -499,7 +494,6 @@ jobs:
       - name: Run tests
         env:
           TEST_MANAGER_IMAGE: ${{ env.IMG }}
-          OPENSHIFT: false
         run: make install && go test ./test/e2e/... -tags=custom_install -p 1 -timeout 20m
 
       - name: Archive test artifacts
@@ -582,8 +576,6 @@ jobs:
         run: make dev-images generate && cat config/default/images.env
 
       - name: Deploy operator container
-        env:
-          OPENSHIFT: false
         run: make deploy
 
       - name: Wait for operator to be ready
diff --git a/Makefile b/Makefile
@@ -83,12 +83,7 @@ CONTAINER_TOOL ?= docker
 SHELL = /usr/bin/env bash -o pipefail
 .SHELLFLAGS = -ec
 
-OPENSHIFT ?= true
-
-CONFIG_DEFAULT=config/env/kubernetes
-ifeq ($(OPENSHIFT), true)
-CONFIG_DEFAULT=config/env/openshift
-endif
+CONFIG_DEFAULT=config/default
 
 .PHONY: all
 all: build
diff --git a/cmd/main.go b/cmd/main.go
@@ -20,7 +20,6 @@ import (
 	"crypto/tls"
 	"flag"
 	"os"
-	"strconv"
 
 	appconfig "github.com/securesign/operator/internal/config"
 	"github.com/securesign/operator/internal/controller"
@@ -102,6 +101,7 @@ func main() {
 		"If set, HTTP/2 will be enabled for the metrics and webhook servers")
 	flag.Int64Var(&appconfig.CreateTreeDeadline, "create-tree-deadline", appconfig.CreateTreeDeadline, "The time allowance (in seconds) for the create tree job to run before failing.")
 	utils.BoolFlagOrEnv(&appconfig.Openshift, "openshift", "OPENSHIFT", false, "Enable to ensures the operator applies OpenShift specific configurations.")
+	utils.StringFlagOrEnv(&appconfig.OpenshiftAPIServerName, "openshift-apiserver-name", "OPENSHIFT_APISERVER_NAME", "openshift-apiserver", "The OpenShift API Server name.")
 	utils.RelatedImageFlag("trillian-log-signer-image", images.TrillianLogSigner, "The image used for trillian log signer.")
 	utils.RelatedImageFlag("trillian-log-server-image", images.TrillianServer, "The image used for trillian log server.")
 	utils.RelatedImageFlag("trillian-db-image", images.TrillianDb, "The image used for trillian's database.")
@@ -126,6 +126,18 @@ func main() {
 
 	ctrl.SetLogger(klog.NewKlogr())
 
+	if !utils.IsFlagProvided("openshift", "OPENSHIFT") {
+		openshift, err := kubernetes.DetectOpenShiftPlatform(setupLog, appconfig.OpenshiftAPIServerName)
+		if err != nil {
+			setupLog.Info("Platform auto-detection failed, falling back to kubernetes", "error", err)
+			openshift = false
+		}
+		appconfig.Openshift = openshift
+		setupLog.Info("Platform auto-detected", "openshift", appconfig.Openshift)
+	} else {
+		setupLog.Info("Platform explicitly configured via flag/env", "openshift", appconfig.Openshift)
+	}
+
 	// if the enable-http2 flag is false (the default), http/2 should be disabled
 	// due to its vulnerabilities. More specifically, disabling http/2 will
 	// prevent from being vulnerable to the HTTP/2 Stream Cancelation and
@@ -222,8 +234,6 @@ func main() {
 		os.Exit(1)
 	}
 
-	setupLog.WithName("IsOpenshift").Info(strconv.FormatBool(appconfig.Openshift))
-
 	setupLog.Info("starting manager")
 	if err := mgr.Start(ctrl.SetupSignalHandler()); err != nil {
 		setupLog.Error(err, "problem running manager")
diff --git a/config/env/kubernetes/kustomization.yaml b/config/env/kubernetes/kustomization.yaml
diff --git a/config/env/openshift/kustomization.yaml b/config/env/openshift/kustomization.yaml
diff --git a/config/env/openshift/manager_openshift_patch.yaml b/config/env/openshift/manager_openshift_patch.yaml
diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
@@ -68,6 +68,14 @@ rules:
   - persistentvolumeclaims/finalizers
   verbs:
   - update
+- apiGroups:
+  - apiregistration.k8s.io
+  resources:
+  - apiservices
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - apps
   resources:
diff --git a/go.mod b/go.mod
@@ -23,6 +23,7 @@ require (
 	k8s.io/apimachinery v0.34.1
 	k8s.io/client-go v0.34.1
 	k8s.io/klog/v2 v2.130.1
+	k8s.io/kube-aggregator v0.34.1
 	k8s.io/utils v0.0.0-20251002143259-bc988d571ff4
 	sigs.k8s.io/controller-runtime v0.22.3
 	sigs.k8s.io/yaml v1.6.0
diff --git a/go.sum b/go.sum
@@ -243,6 +243,8 @@ k8s.io/client-go v0.34.1 h1:ZUPJKgXsnKwVwmKKdPfw4tB58+7/Ik3CrjOEhsiZ7mY=
 k8s.io/client-go v0.34.1/go.mod h1:kA8v0FP+tk6sZA0yKLRG67LWjqufAoSHA2xVGKw9Of8=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
+k8s.io/kube-aggregator v0.34.1 h1:WNLV0dVNoFKmuyvdWLd92iDSyD/TSTjqwaPj0U9XAEU=
+k8s.io/kube-aggregator v0.34.1/go.mod h1:RU8j+5ERfp0h+gIvWtxRPfsa5nK7rboDm8RST8BJfYQ=
 k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 h1:Y3gxNAuB0OBLImH611+UDZcmKS3g6CthxToOb37KgwE=
 k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ=
 k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 h1:SjGebBtkBqHFOli+05xYbK8YF1Dzkbzn+gDM4X9T4Ck=
diff --git a/internal/config/config.go b/internal/config/config.go
@@ -1,6 +1,7 @@
 package config
 
 var (
-	CreateTreeDeadline int64 = 1200
-	Openshift          bool
+	CreateTreeDeadline     int64 = 1200
+	Openshift              bool
+	OpenshiftAPIServerName string
 )
diff --git a/internal/utils/flag_or_env.go b/internal/utils/flag_or_env.go
@@ -33,3 +33,18 @@ func BoolFlagOrEnv(p *bool, name string, envName string, defaultValue bool, usag
 	}
 	flag.BoolVar(p, name, defaultValue, usage)
 }
+
+// IsFlagProvided checks if a flag was explicitly provided on the command line or via environment variable
+func IsFlagProvided(name string, envName string) bool {
+	if envName != "" && os.Getenv(envName) != "" {
+		return true
+	}
+
+	provided := false
+	flag.Visit(func(f *flag.Flag) {
+		if f.Name == name {
+			provided = true
+		}
+	})
+	return provided
+}
diff --git a/internal/utils/kubernetes/platform.go b/internal/utils/kubernetes/platform.go
@@ -0,0 +1,51 @@
+package kubernetes
+
+import (
+	"context"
+
+	"github.com/go-logr/logr"
+	"k8s.io/apimachinery/pkg/runtime"
+	apiregistrationv1 "k8s.io/kube-aggregator/pkg/apis/apiregistration/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/config"
+)
+
+//+kubebuilder:rbac:groups=apiregistration.k8s.io,resources=apiservices,verbs=get;list;watch
+
+// DetectOpenShiftPlatform detects whether the operator is running on OpenShift.
+// It checks for API services with the specified OpenShift API service name.
+func DetectOpenShiftPlatform(log logr.Logger, apiServiceName string) (bool, error) {
+	if apiServiceName == "" {
+		return false, nil
+	}
+	cfg, err := config.GetConfig()
+	if err != nil {
+		return false, err
+	}
+	scheme := runtime.NewScheme()
+	err = apiregistrationv1.SchemeBuilder.AddToScheme(scheme)
+	if err != nil {
+		return false, err
+	}
+	cl, err := client.New(cfg, client.Options{Scheme: scheme})
+	if err != nil {
+		return false, err
+	}
+
+	apiServiceList := &apiregistrationv1.APIServiceList{}
+	if err := cl.List(context.Background(), apiServiceList); err != nil {
+		return false, err
+	}
+
+	for _, apiService := range apiServiceList.Items {
+		if service := apiService.Spec.Service; service != nil {
+			// The service will be default/openshift-apiserver or openshift-apiserver/api
+			if apiServiceName == service.Namespace || apiServiceName == service.Name {
+				log.Info("Discovered APIService matching API service name", "namespace", service.Namespace, "name", service.Name)
+				return true, nil
+			}
+		}
+	}
+
+	return false, nil
+}

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,7 @@`
`1`	`1`	`package config`
`2`	`2`
`3`	`3`	`var (`
`4`		`- CreateTreeDeadline int64 = 1200`
`5`		`- Openshift bool`
	`4`	`+ CreateTreeDeadline int64 = 1200`
	`5`	`+ Openshift bool`
	`6`	`+ OpenshiftAPIServerName string`
`6`	`7`	`)`