[release-1.1] ESO-566: Allow overriding operand container args outside the ExternalSecretsConfig API

pkg/controller/external_secrets/constants.go

@@ -81,6 +81,26 @@ const (
 	webhookContainerName        = "webhook"
 	certControllerContainerName = "cert-controller"
 	bitwardenContainerName      = "bitwarden-sdk-server"
+
+	// Operand deployment / container names used by e2e and env-based arg overrides.
+	OperandCoreControllerDeployment     = externalsecretsCommonName
+	OperandWebhookDeployment            = externalsecretsCommonName + "-webhook"
+	OperandCertControllerDeployment     = externalsecretsCommonName + "-cert-controller"
+	OperandBitwardenSDKServerDeployment = "bitwarden-sdk-server"
+
+	OperandCoreControllerContainer = controllerContainerName
+	OperandWebhookContainer        = webhookContainerName
+	OperandCertControllerContainer = certControllerContainerName
+	OperandBitwardenContainer      = bitwardenContainerName
+
+	// OperandExternalSecretsArgsEnvVar is the operator env var for core controller container args overrides.
+	OperandExternalSecretsArgsEnvVar = "OPERAND_EXTERNAL_SECRETS_ARGS"
+	// OperandWebhookArgsEnvVar is the operator env var for webhook container args overrides.
+	OperandWebhookArgsEnvVar = "OPERAND_WEBHOOK_ARGS"
+	// OperandCertControllerArgsEnvVar is the operator env var for cert-controller container args overrides.
+	OperandCertControllerArgsEnvVar = "OPERAND_CERT_CONTROLLER_ARGS"
+	// OperandBitwardenSDKServerArgsEnvVar is the operator env var for bitwarden-sdk-server container args overrides.
+	OperandBitwardenSDKServerArgsEnvVar = "OPERAND_BITWARDEN_SDK_SERVER_ARGS"
 )
 
 var (

pkg/controller/external_secrets/deployments.go

@@ -4,6 +4,8 @@ import (
 	"fmt"
 	"maps"
 	"os"
+	"slices"
+	"strings"
 	"unsafe"
 
 	appsv1 "k8s.io/api/apps/v1"
@@ -119,19 +121,31 @@ func (r *Reconciler) getDeploymentObject(assetName string, esc *operatorv1alpha1
 	switch assetName {
 	case controllerDeploymentAssetName:
 		updateContainerSpec(deployment, esc, image, logLevel)
+		if err := applyOperandArgsFromEnv(deployment, OperandCoreControllerContainer, OperandExternalSecretsArgsEnvVar); err != nil {
+			return nil, fmt.Errorf("failed to apply operand args from env: %w", err)
+		}
 	case webhookDeploymentAssetName:
 		checkInterval := "5m"
 		if esc.Spec.ApplicationConfig.WebhookConfig != nil &&
 			esc.Spec.ApplicationConfig.WebhookConfig.CertificateCheckInterval != nil {
 			checkInterval = esc.Spec.ApplicationConfig.WebhookConfig.CertificateCheckInterval.Duration.String()
 		}
 		updateWebhookContainerSpec(deployment, image, logLevel, checkInterval)
+		if err := applyOperandArgsFromEnv(deployment, OperandWebhookContainer, OperandWebhookArgsEnvVar); err != nil {
+			return nil, fmt.Errorf("failed to apply operand args from env: %w", err)
+		}
 		updateWebhookVolumeConfig(deployment, esc)
 	case certControllerDeploymentAssetName:
 		updateCertControllerContainerSpec(deployment, image, logLevel)
+		if err := applyOperandArgsFromEnv(deployment, OperandCertControllerContainer, OperandCertControllerArgsEnvVar); err != nil {
+			return nil, fmt.Errorf("failed to apply operand args from env: %w", err)
+		}
 	case bitwardenDeploymentAssetName:
 		deployment.Labels["app.kubernetes.io/version"] = os.Getenv(bitwardenImageVersionEnvVarName)
 		updateBitwardenServerContainerSpec(deployment, bitwardenImage)
+		if err := applyOperandArgsFromEnv(deployment, OperandBitwardenContainer, OperandBitwardenSDKServerArgsEnvVar); err != nil {
+			return nil, fmt.Errorf("failed to apply operand args from env: %w", err)
+		}
 		updateBitwardenVolumeConfig(deployment, esc)
 	}
 
@@ -749,3 +763,93 @@ func getComponentNameFromAsset(assetName string) (operatorv1alpha1.ComponentName
 		return "", "", fmt.Errorf("unknown deployment asset name: %s", assetName)
 	}
 }
+
+// argFlagKey returns the flag key for a container arg (everything before the first '='),
+// or the whole token when there is no '='. Positional args without a leading "--" return "".
+func argFlagKey(arg string) string {
+	if !strings.HasPrefix(arg, "--") {
+		return ""
+	}
+	if i := strings.IndexByte(arg, '='); i >= 0 {
+		return arg[:i]
+	}
+	return arg
+}
+
+// parseOperandArgsEnv parses a comma-separated list of full CLI flags
+// (e.g. "--concurrent=5,--loglevel=debug"). Empty segments (from trailing or
+// repeated commas) are skipped. Callers should treat a fully empty/whitespace
+// env value as a no-op before calling this helper.
+func parseOperandArgsEnv(raw string) ([]string, error) {
+	parts := strings.Split(raw, ",")
+	args := make([]string, 0, len(parts))
+	for _, part := range parts {
+		part = strings.TrimSpace(part)
+		if part == "" {
+			continue
+		}
+		if !strings.HasPrefix(part, "--") {
+			return nil, common.NewIrrecoverableError(
+				fmt.Errorf("argument %q must start with --", part),
+				"invalid custom arg override",
+			)
+		}
+		args = append(args, part)
+	}
+	return args, nil
+}
+
+// mergeContainerArgs overrides matching --flag keys in base with overrides and appends
+// unknown keys. Positional args (no leading "--") in base are preserved in place;
+// non-flag overrides are skipped (parseOperandArgsEnv already rejects them for the env path).
+func mergeContainerArgs(base []string, overrides []string) []string {
+	if len(overrides) == 0 {
+		return base
+	}
+
+	keyIndex := make(map[string]int, len(base))
+	for i, arg := range base {
+		if key := argFlagKey(arg); key != "" {
+			keyIndex[key] = i
+		}
+	}
+
+	result := slices.Clone(base)
+	for _, override := range overrides {
+		key := argFlagKey(override)
+		if key == "" {
+			continue
+		}
+		if idx, ok := keyIndex[key]; ok {
+			result[idx] = override
+			continue
+		}
+		result = append(result, override)
+		keyIndex[key] = len(result) - 1
+	}
+	return result
+}
+
+// applyOperandArgsFromEnv reads envVarName and merges its comma-separated --key=value
+// flags into the named container's Args. Unset or empty env is a no-op.
+func applyOperandArgsFromEnv(deployment *appsv1.Deployment, containerName, envVarName string) error {
+	raw := strings.TrimSpace(os.Getenv(envVarName))
+	if raw == "" {
+		return nil
+	}
+
+	overrides, err := parseOperandArgsEnv(raw)
+	if err != nil {
+		return fmt.Errorf("%s: %w", envVarName, err)
+	}
+
+	for i := range deployment.Spec.Template.Spec.Containers {
+		if deployment.Spec.Template.Spec.Containers[i].Name != containerName {
+			continue
+		}
+		deployment.Spec.Template.Spec.Containers[i].Args = mergeContainerArgs(
+			deployment.Spec.Template.Spec.Containers[i].Args, overrides)
+		return nil
+	}
+	return fmt.Errorf("container %s not found in deployment %s", containerName, deployment.GetName())
+}