implement policy + binding policy k8s operator CRDs

[zreigz]

Test Plan

Test environment: https://console.your-env.onplural.sh/

Checklist

• I have added a meaningful title and summary to convey the impact of this PR to a user.
• If required, I have updated the Plural documentation accordingly.
• I have added tests to cover my changes.
• I have deployed the agent to a test environment and verified that it works as expected (required only when changing agent code).

Plural Flow: console

[linear]

PROD-5155

[soffi-ai]

Soffi AI Summary

This PR introduces two new Kubernetes CRD types — Policy and BindingPolicy — into the Go controller (go/controller/), enabling declarative management of OPA/admission policies and their cluster bindings through the Plural GitOps control plane.

Motivation: Platform teams need a Kubernetes-native way to define and bind policies (e.g., OPA/Kyverno-style admission rules) to clusters without manual API calls. By encoding these as CRDs, operators can manage policy lifecycle declaratively in Git and have the controller reconcile them to the Console server via GraphQL — consistent with how other Console resources (e.g., PRAutomation, Observer) are managed.

What was added:

• CRD type definitions (api/v1alpha1/policy_types.go, bindingpolicy_types.go) and auto-generated deepcopy stubs.
• Reconcilers (internal/controller/policy_controller.go, bindingpolicy_controller.go) that implement the standard create/update/delete lifecycle against the Console GraphQL API, using finalizers for safe cleanup.
• Console API client wrappers (internal/client/policy.go, bindingpolicy.go) and corresponding interface additions to console.go for CreatePolicy, UpdatePolicy, DeletePolicy, CreateBindingPolicy, UpdateBindingPolicy, and DeleteBindingPolicy.
• Generated CRD YAML manifests for both charts/controller/crds/ and go/controller/config/crd/bases/, plus sample CRs.
• Mock implementations for all six new GraphQL client methods in the test mock, along with controller unit tests for both reconcilers covering create, update, delete, and error paths.
• Controller registration wiring both reconcilers into the manager startup (cmd/register.go).
• Bundled chart updates (controller 0.0.207 tarballs in charts/console and charts/console-rapid).

Commits

Commit	Summary
5304493	Defines the Policy and BindingPolicy CRD Go types (api/v1alpha1), generates the CRD YAML manifests and deepcopy stubs, and scaffolds the Console GraphQL client methods needed to sync these resources to the server.
66c4eea	Merge from origin/master to bring in upstream changes before continuing feature work.
06910e5	Adds the reconciler implementations for Policy and BindingPolicy controllers, registers them with the operator manager, and wires in the GraphQL client interface additions.
7a6db80	Merge from origin/master to pull in latest upstream changes.
84f2372	Adds unit tests for both the PolicyController and BindingPolicyController reconcilers, covering create, update, delete, and error scenarios, using the typed mock client.

---

Updated: 2026-08-25 13:25 UTC

Deploy in Soffi

[greptile-apps]

Greptile Summary

Adds cluster-scoped Policy and BindingPolicy Kubernetes API types, generated CRDs, deepcopy support, packaged chart artifacts, and Console client operations.

• Defines Policy and BindingPolicy desired-state and status schemas.
• Adds Console lookup, existence, create, update, and delete methods.
• Packages the generated CRDs into the controller and Console charts.

Confidence Score: 4/5

The PR should not merge until Policy and BindingPolicy reconcilers are implemented and registered, because the shipped CRDs currently accept resources that are never processed.

Both kinds are installed and registered in the API scheme, but controller startup relies on explicit reconciler factories and watches that this change does not provide, leaving every created resource permanently unsynchronized.

Files Needing Attention: go/controller/api/v1alpha1/bindingpolicy_types.go, go/controller/api/v1alpha1/policy_types.go, and go/controller/cmd/register.go

Important Files Changed

Filename	Overview
go/controller/api/v1alpha1/bindingpolicy_types.go	Defines and registers BindingPolicy, but the resource has no reconciler or manager watch to enact its desired state.
go/controller/api/v1alpha1/policy_types.go	Defines and registers Policy, but the resource has no reconciler or manager watch to synchronize it with Console.
go/controller/internal/client/bindingpolicy.go	Adds the expected BindingPolicy Console client operations, although no controller currently calls them.
go/controller/internal/client/policy.go	Adds Policy lookup and mutation wrappers, including Kubernetes-style not-found conversion.
charts/controller/crds/deployments.plural.sh_bindingpolicies.yaml	Ships a served BindingPolicy CRD that Kubernetes accepts despite the absence of a controller for it.
charts/controller/crds/deployments.plural.sh_policies.yaml	Ships a served Policy CRD that Kubernetes accepts despite the absence of a controller for it.

_{Reviews (1): Last reviewed commit: "implement policy + binding policy k8s op..." | Re-trigger Greptile}

[michaeljguarino]

are the controllers not implemented?

[michaeljguarino]

I believe this is missing the stack fields on this structure.

[zreigz]

it's missing

[zreigz]

there is only workbench

[zreigz]

I use master branch

[zreigz]

are the controllers not implemented?

almost ready