platform-mesh-operatorbootstraps and reconciles Platform Mesh installations through thePlatformMeshcustom resource.PlatformMeshis the top-level installation resource. It drives deployment, KCP setup, provider secrets, feature toggles, and related bootstrap state.- This is a Go operator repo built around controller-runtime, multicluster-runtime, and Open Component Model.
- Read the org-wide AGENTS.md for general conventions.
- Keep changes small and local. Prefer the narrowest fix that addresses the real problem.
- Verify behavior before finishing. Start with targeted tests, then broader validation if needed.
- Prefer existing repo workflows and
tasktargets over ad-hoc commands. - Keep this file focused on agent execution; use
README.mdfor installation and domain context.
api/v1alpha1:PlatformMeshAPI types and generated deepcopy code.internal/controller: reconciler entrypoints and controller tests.internal/config: runtime configuration.pkg/subroutines: installation and bootstrap subroutines such as deployment, KCP setup, defaults, waiting, and provider secrets.pkg/kapply,pkg/merge,pkg/ocm: supporting helpers for applying manifests, merging values, and OCM integration.config/: operator deployment manifests, CRDs, RBAC, and local runtime config.manifests/k8s,manifests/kcp,manifests/features: templated or curated installation assets applied by the operator.test/e2e/kind: kind-based end-to-end tests.kind-config.yaml: local kind setup for e2e scenarios.
This operator is the bootstrap and installation orchestrator for Platform Mesh. Most changes affect the full platform bring-up path, not just a single controller.
- The manager is a standard controller-runtime manager, not a multicluster-runtime manager.
cmd/operator.gostarts the operator withplatformmeshcontext.StartContext(...), controller-runtime logging, and a singlePlatformMeshreconciler.- Local development uses
.envthroughtask run; tests and e2e flows rely on kind, mkcert, and local helper binaries frombin/.
- The core reconciler lives under
internal/controllerand delegates most real work into subroutines inpkg/subroutines. - The important behavior is not just CRUD on the
PlatformMeshobject; reconciliation drives installation state across Kubernetes, KCP, OCM, Flux resources, webhook secrets, and feature-specific manifests. - Changes to subroutine ordering or shared helper behavior can affect the whole bootstrap pipeline.
PlatformMeshis the top-level installation contract. Its spec controls exposure, OCM references, KCP connections, provider secrets, extra workspaces, feature toggles, and values passed into deployed components.- Files under
manifests/k8s,manifests/kcp, andmanifests/featuresare not all “generated output”; many are maintained installation assets consumed by the operator at runtime. - Feature toggles and manifest selections are part of the product behavior, not just deployment details.
task testruns the main local test flow and uses kind + mkcert setup.task kindtestruns the dedicated kind e2e suite undertest/e2e/kind.task coverenforces thresholds from.testcoverage.yml.- If tests fail in CI, the Taskfile already contains extra diagnostics for HelmReleases, pods, OpenFGA, and related bootstrap resources.
task fmt— format Go code.task lint— run formatting plus golangci-lint.task test— run the standard local test flow.task kindtest— run the kind-specific e2e test suite.task cover— enforce coverage thresholds from.testcoverage.yml.task validate— run lint and tests together.task manifests— regenerate CRDs.task generate— regenerate CRDs and deepcopy code after API changes.task mockery— regenerate mocks when interfaces change.task build— build the manager binary.task run— run the operator locally using.env.task docker-build— build the container image.task docker:kind— build, load, and restart the deployment in kind.
- Follow existing operator and subroutine patterns before introducing new abstractions.
- Keep reconciliation flow in
internal/controller; put reusable install logic inpkg/subroutines. - Add or update
_test.gofiles when behavior changes. - When editing API types under
api/v1alpha1, regenerate derived files instead of hand-editing generated output. - Treat changes under
manifests/as high-impact because they affect installation and bootstrap behavior. - Keep logs structured and avoid logging secrets, kubeconfigs, or generated credentials.
- Run
task generateafter changing API types or CRD shape. - Run
task mockeryafter interface changes that affect generated mocks. - Review generated changes separately from manual logic changes when possible.
- Do not hand-edit generated output unless the file is clearly maintained as source.
- Edit
api/v1alpha1/zz_generated.deepcopy.goby hand. - Update
.testcoverage.ymlunless the task explicitly requires it. - Treat files under
manifests/as disposable generated output; many are maintained installation assets and should be reviewed carefully. - Skip regeneration after changing
PlatformMeshAPI types.
- Do not invent new local workflows when a
tasktarget already exists. - Ask before changing release flow, CI wiring, published image behavior, or Helm/chart integration outside this repo.
- Be careful with bootstrap and installation changes; small manifest edits can affect the whole platform bring-up path.
- Use
README.mdfor local certificate setup, startup arguments, and service context. - Use
CONTRIBUTING.mdfor contribution process, DCO, and broader developer workflow expectations.