Remove legacy Recipe and annotation-based Kubernetes controllers

build/configs/controller.yaml

@@ -15,9 +15,6 @@ tracerProvider:
   serviceName: "controller"
   zipkin:
     url: "http://localhost:9411/api/v2/spans"
-server:
-  host: "0.0.0.0"
-  port: 8083
 workerServer:
   port: 7073
 ucp:

build/scripts/start-radius.sh

@@ -328,7 +328,7 @@ fi
 
 # Start Controller with dlv
 echo "Starting Controller with dlv on port 40002..."
-dlv exec "$DEBUG_ROOT/bin/controller" --listen=127.0.0.1:40002 --headless=true --api-version=2 --accept-multiclient --continue -- --config-file="$SCRIPT_DIR/../configs/controller.yaml" --cert-dir="" > "$DEBUG_ROOT/logs/controller.log" 2>&1 &
+dlv exec "$DEBUG_ROOT/bin/controller" --listen=127.0.0.1:40002 --headless=true --api-version=2 --accept-multiclient --continue -- --config-file="$SCRIPT_DIR/../configs/controller.yaml" > "$DEBUG_ROOT/logs/controller.log" 2>&1 &
 echo $! > "$DEBUG_ROOT/logs/controller.pid"
 
 # Wait for Controller to start (check health endpoint)

cmd/controller/cmd/root.go

@@ -42,7 +42,6 @@ var rootCmd = &cobra.Command{
 	Long:  `Server process for Radius Kubernetes interoperability (controller).`,
 	RunE: func(cmd *cobra.Command, args []string) error {
 		configFilePath := cmd.Flag("config-file").Value.String()
-		tlsCertDir := cmd.Flag("cert-dir").Value.String()
 
 		options, err := hostoptions.NewHostOptionsFromEnvironment(configFilePath)
 		if err != nil {
@@ -63,7 +62,7 @@ var rootCmd = &cobra.Command{
 		logger.Info("Loaded options", "configfile", configFilePath)
 
 		services := []hosting.Service{
-			&controller.Service{Options: options, TLSCertDir: tlsCertDir},
+			&controller.Service{Options: options},
 		}
 
 		if options.Config.TracerProvider.Enabled {
@@ -78,7 +77,6 @@ var rootCmd = &cobra.Command{
 func Execute() {
 	// Let users override the configuration via `--config-file`.
 	rootCmd.Flags().String("config-file", fmt.Sprintf("controller-%s.yaml", hostoptions.Environment()), "The service configuration file.")
-	rootCmd.Flags().String("cert-dir", "/var/tls/cert", "The directory containing the TLS certificates.")
 
 	cobra.CheckErr(rootCmd.ExecuteContext(context.Background()))
 }

cmd/controller/controller-dev.yaml

@@ -15,9 +15,6 @@ tracerProvider:
   serviceName: "controller"
   zipkin:
     url: "http://localhost:9411/api/v2/spans"
-server:
-  host: "0.0.0.0"
-  port: 8083
 
 # workerServer port specifies port set for Health Checks
 workerServer:

deploy/Chart/README.md

@@ -242,9 +242,7 @@ When enabled, three policies are applied:
 - `radius-allow-internal` — re-permits east-west traffic between Radius
   components (intra-namespace), matched by the immutable
   `kubernetes.io/metadata.name` namespace label.
-- `radius-allow-control-plane` — allows the Kubernetes API server to reach UCP
-  (APIService aggregation) and the controller (admission webhook) on port `9443`,
-  from the CIDRs in `networkPolicies.controlPlaneCIDRs`.
+- `radius-allow-control-plane` — allows the Kubernetes API server to reach UCP (APIService aggregation) on port `9443`, from the CIDRs in `networkPolicies.controlPlaneCIDRs`.
 
 Only ingress is restricted; egress is left open so UCP can reach the Kubernetes
 API server and pods can resolve DNS.
@@ -256,14 +254,7 @@ API server and pods can resolve DNS.
 
 #### Setting `controlPlaneCIDRs`
 
-The kube-apiserver reaches UCP (APIService aggregation) and the controller
-(admission webhook) over the host network, so this traffic arrives with the
-**node's** IP rather than a pod IP and cannot be matched by a namespace/pod
-selector. You must supply the source CIDR(s) via
-`networkPolicies.controlPlaneCIDRs` — **this is required when
-`networkPolicies.enabled=true`; Helm rendering fails if it is empty** — otherwise
-the default-deny policy would block API aggregation and webhooks and break the
-control plane.
+The kube-apiserver reaches UCP (APIService aggregation) over the host network, so this traffic arrives with the **node's** IP rather than a pod IP and cannot be matched by a namespace/pod selector. You must supply the source CIDR(s) via `networkPolicies.controlPlaneCIDRs` — **this is required when `networkPolicies.enabled=true`; Helm rendering fails if it is empty** — otherwise the default-deny policy would block API aggregation and break the control plane.
 
 Use your cluster's node/control-plane subnet(s), **not** individual node IPs
 (a `/32` would exclude other control-plane addresses):

deploy/Chart/templates/controller/configmaps.yaml

@@ -8,10 +8,6 @@ metadata:
     app.kubernetes.io/part-of: radius
 data:
   controller-config.yaml: |-
-    server:
-      host: "0.0.0.0"
-      port: 9443
-
     databaseProvider:
       provider: "apiserver"
       apiserver:

deploy/Chart/templates/controller/deployment.yaml

@@ -64,10 +64,6 @@ spec:
         - '--config-file'
         - '/etc/config/controller-config.yaml'
         env:
-        - name: TLS_CERT_DIR
-          value: '/var/tls/cert'
-        - name: PORT
-          value: '9443'
         - name: BICEP
           value: '/usr/local/bin/bicep'
         {{- if .Values.global.rootCA.cert }}
@@ -76,9 +72,6 @@ spec:
           value: {{ .Values.global.rootCA.mountPath }}
         {{- end}}
         ports:
-        - containerPort: 9443
-          name: controller
-          protocol: TCP
         {{- if eq .Values.global.prometheus.enabled true }}
         - containerPort: {{ .Values.global.prometheus.port }}
           name: metrics
@@ -100,9 +93,6 @@ spec:
           subPath: bicepconfig.json
         - name: config-volume
           mountPath: /etc/config
-        - name: cert
-          mountPath: '/var/tls/cert'
-          readOnly: true
         {{- if .Values.global.rootCA.cert }}
         - name: {{ .Values.global.rootCA.volumeName }}
           mountPath: {{ .Values.global.rootCA.mountPath }}
@@ -121,9 +111,6 @@ spec:
         - name: config-volume
           configMap:
             name: controller-config
-        - name: cert
-          secret:
-            secretName: controller-cert
         {{- if .Values.global.rootCA.cert }}
         - name: {{ .Values.global.rootCA.volumeName }}
           secret:

deploy/Chart/templates/controller/rbac.yaml

@@ -10,7 +10,6 @@ rules:
   - ""
   resources:
   - namespaces
-  - secrets
   - events
   verbs:
   - create
@@ -20,24 +19,9 @@ rules:
   - patch
   - update
   - watch
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - statefulsets
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
 - apiGroups:
   - radapp.io
   resources:
-  - recipes
-  - recipes/status
   - deploymenttemplates
   - deploymenttemplates/status
   - deploymentresources