feat(controllers): add --controllers feature flag to enable/disable controllers per cluster

Dockerfile

@@ -12,7 +12,7 @@ COPY go.sum go.sum
 RUN go mod download
 
 # Copy the go source
-COPY cmd/main.go cmd/main.go
+COPY cmd/ cmd/
 COPY api/ api/
 COPY internal/ internal/
 
@@ -21,7 +21,7 @@ COPY internal/ internal/
 # was called. For example, if we call make docker-build in a local env which has the Apple Silicon M1 SO
 # the docker BUILDPLATFORM arg will be linux/arm64 when for Apple x86 it will be linux/amd64. Therefore,
 # by leaving it empty we can ensure that the container and binary shipped on it will have the same platform.
-RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o manager cmd/main.go
+RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o manager ./cmd
 
 # Use distroless as minimal base image to package the manager binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details

Makefile

@@ -202,7 +202,7 @@ lint-config: golangci-lint ## Verify golangci-lint linter configuration
 
 .PHONY: build
 build: manifests generate fmt vet ## Build manager binary.
-	go build -o bin/manager cmd/main.go
+	go build -o bin/manager ./cmd
 
 .PHONY: run
 run: manifests generate fmt vet ## Run a controller from your host.

chart/templates/deployment-operator-controller-manager.yaml

@@ -31,6 +31,9 @@ spec:
         - --leader-elect
         - --health-probe-bind-address=:8081
         - --webhook-cert-path=/tmp/k8s-webhook-server/serving-certs
+        {{- if and .Values.controllers.enabled (not (has "*" .Values.controllers.enabled)) }}
+        - --controllers={{ join "," .Values.controllers.enabled }}
+        {{- end }}
         {{- if .Values.redirect.ingressClass }}
         - --redirect-ingress-class={{ .Values.redirect.ingressClass }}
         - --redirect-cluster-issuer={{ .Values.redirect.clusterIssuer.name }}

chart/values.yaml

@@ -97,6 +97,13 @@ podAnnotations: {}
 # Pod labels
 podLabels: {}
 
+# Controllers to enable at startup.
+# Use ["*"] to enable all (default — preserves existing behavior).
+# Valid values: namespace, decofile, deco, decoredirect, operator-api
+controllers:
+  enabled:
+    - "*"
+
 # Cloudflare Workers build support
 cfworkers:
   existingSecret: ""    # Secret with cf-api-token, cf-account-id

cmd/controllers.go

@@ -0,0 +1,42 @@
+package main
+
+import (
+	"fmt"
+	"slices"
+	"strings"
+
+	"github.com/deco-sites/decofile-operator/internal/api"
+	"github.com/deco-sites/decofile-operator/internal/controller"
+)
+
+var knownControllers = []string{
+	controller.TenantControllerName,
+	controller.DecofileControllerName,
+	controller.DecoControllerName,
+	controller.DecoRedirectControllerName,
+	api.ControllerName,
+}
+
+// parseControllers parses a comma-separated list of controller names.
+// "*" enables all known controllers.
+// Returns an error if any name is not in knownControllers.
+func parseControllers(input string) (func(string) bool, error) {
+	if strings.TrimSpace(input) == "*" {
+		return func(string) bool { return true }, nil
+	}
+	parts := strings.Split(input, ",")
+	set := make(map[string]bool, len(parts))
+	for _, name := range parts {
+		name = strings.TrimSpace(name)
+		if name == "" {
+			return nil, fmt.Errorf("controller name must not be empty; valid values: %s",
+				strings.Join(knownControllers, ", "))
+		}
+		if !slices.Contains(knownControllers, name) {
+			return nil, fmt.Errorf("unknown controller %q; valid values: %s",
+				name, strings.Join(knownControllers, ", "))
+		}
+		set[name] = true
+	}
+	return func(name string) bool { return set[name] }, nil
+}

cmd/controllers_test.go

@@ -0,0 +1,66 @@
+package main
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/deco-sites/decofile-operator/internal/api"
+	"github.com/deco-sites/decofile-operator/internal/controller"
+)
+
+func TestParseControllers_Star(t *testing.T) {
+	enabled, err := parseControllers("*")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	for _, name := range knownControllers {
+		if !enabled(name) {
+			t.Errorf("expected %q to be enabled with *, but it wasn't", name)
+		}
+	}
+}
+
+func TestParseControllers_Subset(t *testing.T) {
+	enabled, err := parseControllers("decoredirect,operator-api")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !enabled(controller.DecoRedirectControllerName) {
+		t.Error("expected decoredirect to be enabled")
+	}
+	if !enabled(api.ControllerName) {
+		t.Error("expected operator-api to be enabled")
+	}
+	if enabled(controller.DecofileControllerName) {
+		t.Error("expected decofile to be disabled")
+	}
+	if enabled(controller.TenantControllerName) {
+		t.Error("expected namespace to be disabled")
+	}
+	if enabled(controller.DecoControllerName) {
+		t.Error("expected deco to be disabled")
+	}
+}
+
+func TestParseControllers_UnknownName(t *testing.T) {
+	_, err := parseControllers("decoredirect,xpto")
+	if err == nil {
+		t.Fatal("expected error for unknown controller name, got nil")
+	}
+	if !strings.Contains(err.Error(), "xpto") {
+		t.Errorf("expected error to mention 'xpto', got: %v", err)
+	}
+}
+
+func TestParseControllers_WhitespaceHandled(t *testing.T) {
+	enabled, err := parseControllers("decoredirect, operator-api")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !enabled(controller.DecoRedirectControllerName) {
+		t.Error("expected decoredirect to be enabled")
+	}
+	if !enabled(api.ControllerName) {
+		t.Error("expected operator-api to be enabled")
+	}
+}