feat(manifests): ship the vendored YAML and resolve it per version

packages/client/__tests__/e2e/e2e.setup.operator.test.ts

@@ -16,9 +16,35 @@ const K8S_API = process.env.K8S_API || "http://127.0.0.1:8001";
 // for them to disagree, and it already had: this fixture pinned cert-manager
 // v1.17.0 and knative v1.15.0 long after the package had moved on, so the e2e
 // suite was installing versions the package no longer shipped.
-function latestVersion(name: string): string {
+// Operators the suite pins rather than taking the newest of.
+//
+// The manifests package may carry several versions of an operator so different
+// consumers can each install the one they run. "Newest" is then the wrong
+// default for a test: adding a version downstream would silently change what
+// this suite installs, and a suite whose subject moves without anyone choosing
+// it is not testing what its name says.
+//
+// knative-serving is pinned to v1.15.0 because v1.22.1 fails this suite in a
+// way that does not reproduce by hand — see constructive-planning#1630. That is
+// an apply-path problem to fix on its own, not a reason to hold the package
+// back from carrying the version downstream needs.
+const PINNED_VERSIONS: Record<string, string> = {
+  'knative-serving': 'v1.15.0',
+};
+
+function versionFor(name: string): string {
   const versions = getOperatorVersions(name);
   if (!versions.length) throw new Error(`Unknown operator '${name}'`);
+
+  const pinned = PINNED_VERSIONS[name];
+  if (pinned) {
+    if (!versions.includes(pinned)) {
+      throw new Error(
+        `${name} is pinned to ${pinned}, which the manifests package no longer carries (has: ${versions.join(', ')})`
+      );
+    }
+    return pinned;
+  }
   return versions[versions.length - 1];
 }
 
@@ -38,7 +64,7 @@ const OPERATOR_DEPENDENCIES: Record<string, string[]> = {
 };
 
 function buildOperator(name: string): OperatorConfig {
-  const version = latestVersion(name);
+  const version = versionFor(name);
   const namespace = DEFAULT_NAMESPACES[name] || name;
   return { name, enabled: true, version, namespace } as OperatorConfig;
 }

packages/manifests/operators/cert-manager.yaml

@@ -25,6 +25,7 @@ metadata:
     app.kubernetes.io/version: "v1.17.0"
     app.kubernetes.io/managed-by: Helm
     helm.sh/chart: cert-manager-v1.17.0
+
 ---
 # Source: cert-manager/templates/serviceaccount.yaml
 apiVersion: v1
@@ -41,6 +42,7 @@ metadata:
     app.kubernetes.io/version: "v1.17.0"
     app.kubernetes.io/managed-by: Helm
     helm.sh/chart: cert-manager-v1.17.0
+
 ---
 # Source: cert-manager/templates/webhook-serviceaccount.yaml
 apiVersion: v1
@@ -57,6 +59,7 @@ metadata:
     app.kubernetes.io/version: "v1.17.0"
     app.kubernetes.io/managed-by: Helm
     helm.sh/chart: cert-manager-v1.17.0
+
 ---
 # Source: cert-manager/templates/crds.yaml
 #
@@ -12113,6 +12116,7 @@ spec:
       storage: true
 
 # END crd
+
 ---
 # Source: cert-manager/templates/cainjector-rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -12720,6 +12724,7 @@ subjects:
   - name: cert-manager
     namespace: cert-manager
     kind: ServiceAccount
+
 ---
 # Source: cert-manager/templates/webhook-rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -12742,6 +12747,7 @@ subjects:
 - kind: ServiceAccount
   name: cert-manager-webhook
   namespace: cert-manager
+
 ---
 # Source: cert-manager/templates/cainjector-rbac.yaml
 # leader election rules
@@ -12864,6 +12870,7 @@ subjects:
   - kind: ServiceAccount
     name: cert-manager-cainjector
     namespace: cert-manager
+
 ---
 # Source: cert-manager/templates/rbac.yaml
 # grant cert-manager permission to manage the leaderelection configmap in the
@@ -12961,6 +12968,7 @@ spec:
     app.kubernetes.io/name: cainjector
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "cainjector"
+
 ---
 # Source: cert-manager/templates/service.yaml
 apiVersion: v1
@@ -12987,6 +12995,7 @@ spec:
     app.kubernetes.io/name: cert-manager
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "controller"
+
 ---
 # Source: cert-manager/templates/webhook-service.yaml
 apiVersion: v1
@@ -13017,6 +13026,7 @@ spec:
     app.kubernetes.io/name: webhook
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "webhook"
+
 ---
 # Source: cert-manager/templates/cainjector-deployment.yaml
 apiVersion: apps/v1
@@ -13084,6 +13094,7 @@ spec:
             readOnlyRootFilesystem: true
       nodeSelector:
         kubernetes.io/os: linux
+
 ---
 # Source: cert-manager/templates/deployment.yaml
 apiVersion: apps/v1
@@ -13269,6 +13280,7 @@ spec:
                 fieldPath: metadata.namespace
       nodeSelector:
         kubernetes.io/os: linux
+
 ---
 # Source: cert-manager/templates/webhook-mutating-webhook.yaml
 apiVersion: admissionregistration.k8s.io/v1
@@ -13378,6 +13390,7 @@ metadata:
     app.kubernetes.io/version: "v1.17.0"
     app.kubernetes.io/managed-by: Helm
     helm.sh/chart: cert-manager-v1.17.0
+
 ---
 # Source: cert-manager/templates/startupapicheck-rbac.yaml
 # create certificate role
@@ -13429,6 +13442,7 @@ subjects:
   - kind: ServiceAccount
     name: cert-manager-startupapicheck
     namespace: cert-manager
+
 ---
 # Source: cert-manager/templates/startupapicheck-job.yaml
 apiVersion: batch/v1

packages/manifests/operators/cert-manager/v1.17.0.yaml

@@ -25,6 +25,7 @@ metadata:
     app.kubernetes.io/version: "v1.17.0"
     app.kubernetes.io/managed-by: Helm
     helm.sh/chart: cert-manager-v1.17.0
+
 ---
 # Source: cert-manager/templates/serviceaccount.yaml
 apiVersion: v1
@@ -41,6 +42,7 @@ metadata:
     app.kubernetes.io/version: "v1.17.0"
     app.kubernetes.io/managed-by: Helm
     helm.sh/chart: cert-manager-v1.17.0
+
 ---
 # Source: cert-manager/templates/webhook-serviceaccount.yaml
 apiVersion: v1
@@ -57,6 +59,7 @@ metadata:
     app.kubernetes.io/version: "v1.17.0"
     app.kubernetes.io/managed-by: Helm
     helm.sh/chart: cert-manager-v1.17.0
+
 ---
 # Source: cert-manager/templates/crds.yaml
 #
@@ -12113,6 +12116,7 @@ spec:
       storage: true
 
 # END crd
+
 ---
 # Source: cert-manager/templates/cainjector-rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -12720,6 +12724,7 @@ subjects:
   - name: cert-manager
     namespace: cert-manager
     kind: ServiceAccount
+
 ---
 # Source: cert-manager/templates/webhook-rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -12742,6 +12747,7 @@ subjects:
 - kind: ServiceAccount
   name: cert-manager-webhook
   namespace: cert-manager
+
 ---
 # Source: cert-manager/templates/cainjector-rbac.yaml
 # leader election rules
@@ -12864,6 +12870,7 @@ subjects:
   - kind: ServiceAccount
     name: cert-manager-cainjector
     namespace: cert-manager
+
 ---
 # Source: cert-manager/templates/rbac.yaml
 # grant cert-manager permission to manage the leaderelection configmap in the
@@ -12961,6 +12968,7 @@ spec:
     app.kubernetes.io/name: cainjector
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "cainjector"
+
 ---
 # Source: cert-manager/templates/service.yaml
 apiVersion: v1
@@ -12987,6 +12995,7 @@ spec:
     app.kubernetes.io/name: cert-manager
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "controller"
+
 ---
 # Source: cert-manager/templates/webhook-service.yaml
 apiVersion: v1
@@ -13017,6 +13026,7 @@ spec:
     app.kubernetes.io/name: webhook
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "webhook"
+
 ---
 # Source: cert-manager/templates/cainjector-deployment.yaml
 apiVersion: apps/v1
@@ -13084,6 +13094,7 @@ spec:
             readOnlyRootFilesystem: true
       nodeSelector:
         kubernetes.io/os: linux
+
 ---
 # Source: cert-manager/templates/deployment.yaml
 apiVersion: apps/v1
@@ -13269,6 +13280,7 @@ spec:
                 fieldPath: metadata.namespace
       nodeSelector:
         kubernetes.io/os: linux
+
 ---
 # Source: cert-manager/templates/webhook-mutating-webhook.yaml
 apiVersion: admissionregistration.k8s.io/v1
@@ -13378,6 +13390,7 @@ metadata:
     app.kubernetes.io/version: "v1.17.0"
     app.kubernetes.io/managed-by: Helm
     helm.sh/chart: cert-manager-v1.17.0
+
 ---
 # Source: cert-manager/templates/startupapicheck-rbac.yaml
 # create certificate role
@@ -13429,6 +13442,7 @@ subjects:
   - kind: ServiceAccount
     name: cert-manager-startupapicheck
     namespace: cert-manager
+
 ---
 # Source: cert-manager/templates/startupapicheck-job.yaml
 apiVersion: batch/v1