pluralsh
diff --git a/‎.github/PULL_REQUEST_TEMPLATE.md‎
Lines changed: 14 additions & 3 deletions b/‎.github/PULL_REQUEST_TEMPLATE.md‎
Lines changed: 14 additions & 3 deletions
diff --git a/‎.github/workflows/ci.yaml‎
Lines changed: 2 additions & 2 deletions b/‎.github/workflows/ci.yaml‎
Lines changed: 2 additions & 2 deletions
diff --git a/‎.github/workflows/e2e.yaml‎
Lines changed: 0 additions & 22 deletions b/‎.github/workflows/e2e.yaml‎
Lines changed: 0 additions & 22 deletions
diff --git a/‎.github/workflows/publish-fips.yaml‎
Lines changed: 2 additions & 2 deletions b/‎.github/workflows/publish-fips.yaml‎
Lines changed: 2 additions & 2 deletions
diff --git a/‎.github/workflows/publish-harness-fips.yaml‎
Lines changed: 4 additions & 4 deletions b/‎.github/workflows/publish-harness-fips.yaml‎
Lines changed: 4 additions & 4 deletions
diff --git a/‎Dockerfile‎
Lines changed: 2 additions & 2 deletions b/‎Dockerfile‎
Lines changed: 2 additions & 2 deletions
diff --git a/‎cmd/agent/args/args.go‎
Lines changed: 210 additions & 26 deletions b/‎cmd/agent/args/args.go‎
Lines changed: 210 additions & 26 deletions
diff --git a/‎cmd/agent/console.go‎
Lines changed: 34 additions & 4 deletions b/‎cmd/agent/console.go‎
Lines changed: 34 additions & 4 deletions
diff --git a/‎cmd/agent/kubernetes.go‎
Lines changed: 27 additions & 19 deletions b/‎cmd/agent/kubernetes.go‎
Lines changed: 27 additions & 19 deletions
@@ -17,9 +17,20 @@ Test environment: https://console.your-env.onplural.sh/
 
 - [ ] I have added a meaningful title and summary to convey the impact of this PR to a user.
 - [ ] I have deployed the agent to a test environment and verified that it works as expected.
-    - [ ] Agent started successfully.
-    - [ ] Logs are clean and do not contain errors.
-    - [ ] Component trees are working as expected.
+    - [ ] Agent starts successfully.
+    - [ ] Service creation works without any issues when using raw manifests and Helm templates.
+    - [ ] Service creation works when resources contain both CRD and CRD instances.
+    - [ ] Service templating works correctly.
+    - [ ] Service errors are reported properly and visible in the UI.
+    - [ ] Service updates are reflected properly in the cluster.
+    - [ ] Service resync triggers immediately and works as expected.
+    - [ ] Service deletion works and cleanups resources properly.
+    - [ ] Services can be recreated after deletion.
+    - [ ] Service detachment works and keeps resources unaffected.
+    - [ ] Services can be recreated after detachment.
+    - [ ] Service component trees are working as expected.
+    - [ ] Cluster health statuses are being updated.
+    - [ ] Agent logs do not contain any errors.
 - [ ] I have added tests to cover my changes.
 - [ ] If required, I have updated the Plural documentation accordingly.
 
@@ -40,9 +40,9 @@ jobs:
         with:
           go-version-file: go.mod
           check-latest: true
-      - uses: golangci/golangci-lint-action@v7.0.0
+      - uses: golangci/golangci-lint-action@v8.0.0
         with:
-          version: v2.1.2
+          version: v2.4.0
   build-image:
     name: Build image
     needs: [build, test]
 
@@ -60,6 +60,6 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
           build-args: |
-            GO_FIPS_IMAGE_REPO=ghcr.io/pluralsh/go-fips
-            GO_FIPS_IMAGE_TAG=1.23.2
+            GO_FIPS_IMAGE_REPO=ghcr.io/pluralsh/fips/go-fips
+            GO_FIPS_IMAGE_TAG=1.25.1
 
@@ -73,8 +73,8 @@ jobs:
         cache-to: type=gha,mode=max
         build-args: |
           VERSION=${{ steps.meta.outputs.version }}
-          GO_FIPS_IMAGE_REPO=ghcr.io/pluralsh/go-fips
-          GO_FIPS_IMAGE_TAG=1.23.2
+          GO_FIPS_IMAGE_REPO=ghcr.io/pluralsh/fips/go-fips
+          GO_FIPS_IMAGE_TAG=1.25.1
     - name: Export digest
       run: |
         mkdir -p ${{ runner.temp }}/digests
@@ -205,5 +205,5 @@ jobs:
           PYTHON_VERSION=${{ matrix.versions.python }}
           HARNESS_BASE_IMAGE_REPO=ghcr.io/pluralsh/stackrun-harness-base
           HARNESS_BASE_IMAGE_TAG=${{ needs.publish-base-image.outputs.version }}
-          GO_FIPS_IMAGE_REPO=ghcr.io/pluralsh/go-fips
-          GO_FIPS_IMAGE_TAG=1.23.2
+          GO_FIPS_IMAGE_REPO=ghcr.io/pluralsh/fips/go-fips
+          GO_FIPS_IMAGE_TAG=1.25.1
@@ -1,4 +1,4 @@
-FROM golang:1.24-alpine3.21 AS builder
+FROM golang:1.25-alpine3.22 AS builder
 
 ARG HELM_VERSION=v3.17.3
 ARG TARGETARCH
@@ -21,7 +21,7 @@ COPY /api api/
 COPY /internal internal/
 
 # Build
-RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} GO111MODULE=on go build -a -o deployment-agent cmd/agent/*.go
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} GO111MODULE=on GOEXPERIMENT=greenteagc go build -a -o deployment-agent cmd/agent/*.go
 
 # Get helm binary for kustomize helm inflate to work
 RUN curl -L https://get.helm.sh/helm-${HELM_VERSION}-linux-${TARGETARCH}.tar.gz | tar xz && \
 
@@ -4,16 +4,21 @@ import (
 	"os"
 	"time"
 
+	"k8s.io/apimachinery/pkg/api/meta"
 	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/kubernetes"
 
 	"github.com/pluralsh/deployment-operator/cmd/agent/args"
 	"github.com/pluralsh/deployment-operator/internal/utils"
+	discoverycache "github.com/pluralsh/deployment-operator/pkg/cache/discovery"
 	"github.com/pluralsh/deployment-operator/pkg/client"
 	consolectrl "github.com/pluralsh/deployment-operator/pkg/controller"
 	"github.com/pluralsh/deployment-operator/pkg/controller/stacks"
 	v1 "github.com/pluralsh/deployment-operator/pkg/controller/v1"
+	"github.com/pluralsh/deployment-operator/pkg/streamline"
+	"github.com/pluralsh/deployment-operator/pkg/streamline/store"
 
-	"k8s.io/client-go/rest"
 	ctrclient "sigs.k8s.io/controller-runtime/pkg/client"
 
 	"github.com/pluralsh/deployment-operator/pkg/controller/namespaces"
@@ -47,18 +52,43 @@ const (
 
 func registerConsoleReconcilersOrDie(
 	mgr *consolectrl.Manager,
-	config *rest.Config,
+	mapper meta.RESTMapper,
+	clientSet kubernetes.Interface,
 	k8sClient ctrclient.Client,
+	dynamicClient dynamic.Interface,
+	store store.Store,
 	scheme *runtime.Scheme,
 	consoleClient client.Client,
+	supervisor *streamline.Supervisor,
+	discoveryCache discoverycache.Cache,
 ) {
 	mgr.AddReconcilerOrDie(service.Identifier, func() (v1.Reconciler, error) {
-		r, err := service.NewServiceReconciler(consoleClient, k8sClient, config, args.ControllerCacheTTL(), args.ManifestCacheTTL(), args.ManifestCacheJitter(), args.WorkqueueBaseDelay(), args.WorkqueueMaxDelay(), args.PollInterval(), args.RestoreNamespace(), args.ConsoleUrl(), args.WorkqueueQPS(), args.WorkqueueBurst())
+		r, err := service.NewServiceReconciler(consoleClient,
+			k8sClient,
+			mapper,
+			clientSet,
+			dynamicClient,
+			discoveryCache,
+			store,
+			service.WithRefresh(args.ControllerCacheTTL()),
+			service.WithManifestTTL(args.ManifestCacheTTL()),
+			service.WithManifestTTLJitter(args.ManifestCacheJitter()),
+			service.WithWorkqueueBaseDelay(args.WorkqueueBaseDelay()),
+			service.WithWorkqueueMaxDelay(args.WorkqueueMaxDelay()),
+			service.WithWorkqueueQPS(args.WorkqueueQPS()),
+			service.WithWorkqueueBurst(args.WorkqueueBurst()),
+			service.WithRestoreNamespace(args.RestoreNamespace()),
+			service.WithConsoleURL(args.ConsoleUrl()),
+			service.WithPollInterval(args.PollInterval()),
+			service.WithWaveDelay(args.ApplierWaveDelay()),
+			service.WithWaveDeQueueDelay(args.WaveDeQueueDelay()),
+			service.WithWaveMaxConcurrentApplies(args.WaveMaxConcurrentApplies()),
+			service.WithSupervisor(supervisor))
 		return r, err
 	})
 
 	mgr.AddReconcilerOrDie(pipelinegates.Identifier, func() (v1.Reconciler, error) {
-		r, err := pipelinegates.NewGateReconciler(consoleClient, k8sClient, config, args.PipelineGatesInterval())
+		r, err := pipelinegates.NewGateReconciler(consoleClient, k8sClient, args.PipelineGatesInterval())
 		return r, err
 	})
 
 
@@ -7,7 +7,6 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
-	"time"
 
 	trivy "github.com/aquasecurity/trivy-operator/pkg/apis/aquasecurity/v1alpha1"
 	"github.com/argoproj/argo-rollouts/pkg/apis/rollouts"
@@ -16,12 +15,15 @@ import (
 	cmap "github.com/orcaman/concurrent-map/v2"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
 	velerov1 "github.com/vmware-tanzu/velero/pkg/apis/velero/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/meta"
 	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/client-go/discovery"
 	"k8s.io/client-go/dynamic"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/rest"
+	clientgocache "k8s.io/client-go/tools/cache"
 	ctrl "sigs.k8s.io/controller-runtime"
+	crcache "sigs.k8s.io/controller-runtime/pkg/cache"
 	ctrlclient "sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/healthz"
 	"sigs.k8s.io/controller-runtime/pkg/manager"
@@ -30,13 +32,12 @@ import (
 	"github.com/pluralsh/deployment-operator/cmd/agent/args"
 	"github.com/pluralsh/deployment-operator/internal/controller"
 	"github.com/pluralsh/deployment-operator/pkg/cache"
+	discoverycache "github.com/pluralsh/deployment-operator/pkg/cache/discovery"
 	consoleclient "github.com/pluralsh/deployment-operator/pkg/client"
 	consolectrl "github.com/pluralsh/deployment-operator/pkg/controller"
 	"github.com/pluralsh/deployment-operator/pkg/controller/service"
 )
 
-const serviceIDCacheExpiry = 12 * time.Hour
-
 func emptyDiskHealthCheck(_ *http.Request) error {
 	testFile := filepath.Join("/tmp", "healthcheck.tmp")
 	data := []byte("ok")
@@ -48,11 +49,22 @@ func emptyDiskHealthCheck(_ *http.Request) error {
 }
 
 func initKubeManagerOrDie(config *rest.Config) manager.Manager {
+	watchErrHandler := func(ctx context.Context, r *clientgocache.Reflector, err error) {
+		switch {
+		case apierrors.IsNotFound(err), apierrors.IsGone(err), meta.IsNoMatchError(err):
+			setupLog.V(2).Error(err, "ignoring watch error for removed resource")
+			return
+		default:
+			clientgocache.DefaultWatchErrorHandler(ctx, r, err)
+		}
+	}
+
 	mgr, err := ctrl.NewManager(config, ctrl.Options{
 		NewClient:              ctrlclient.New, // client reads directly from the API server
 		Logger:                 setupLog,
 		Scheme:                 scheme,
 		LeaderElection:         args.EnableLeaderElection(),
+		Cache:                  crcache.Options{DefaultWatchErrorHandler: watchErrHandler},
 		LeaderElectionID:       "dep12loy45.plural.sh",
 		HealthProbeBindAddress: args.ProbeAddr(),
 		Metrics: server.Options{
@@ -83,7 +95,10 @@ func initKubeManagerOrDie(config *rest.Config) manager.Manager {
 	return mgr
 }
 
-func initKubeClientsOrDie(config *rest.Config) (rolloutsClient *roclientset.Clientset, dynamicClient *dynamic.DynamicClient, kubeClient *kubernetes.Clientset) {
+func initKubeClientsOrDie(config *rest.Config) (rolloutsClient *roclientset.Clientset,
+	dynamicClient *dynamic.DynamicClient,
+	kubeClient *kubernetes.Clientset,
+) {
 	rolloutsClient, err := roclientset.NewForConfig(config)
 	if err != nil {
 		setupLog.Error(err, "unable to create rollouts client")
@@ -111,7 +126,7 @@ func registerKubeReconcilersOrDie(
 	consoleManager *consolectrl.Manager,
 	config *rest.Config,
 	extConsoleClient consoleclient.Client,
-	discoveryClient discovery.DiscoveryInterface,
+	discoveryCache discoverycache.Cache,
 	enableKubecostProxy bool,
 ) {
 	rolloutsClient, dynamicClient, kubeClient := initKubeClientsOrDie(config)
@@ -184,6 +199,7 @@ func registerKubeReconcilersOrDie(
 		Scheme:           manager.GetScheme(),
 		ReconcilerGroups: reconcileGroups,
 		Mgr:              manager,
+		DiscoveryCache:   discoveryCache,
 	}).SetupWithManager(manager); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "CRDRegisterController")
 	}
@@ -227,15 +243,7 @@ func registerKubeReconcilersOrDie(
 		setupLog.Error(err, "unable to create controller", "controller", "UpgradeInsights")
 	}
 
-	statusController, err := controller.NewStatusReconciler(manager.GetClient())
-	if err != nil {
-		setupLog.Error(err, "unable to create controller", "controller", "StatusController")
-	}
-	if err := statusController.SetupWithManager(manager); err != nil {
-		setupLog.Error(err, "unable to setup controller", "controller", "StatusController")
-	}
-
-	if err = (&controller.PipelineGateReconciler{
+	if err := (&controller.PipelineGateReconciler{
 		Client:        manager.GetClient(),
 		ConsoleClient: consoleclient.New(args.ConsoleUrl(), args.DeployToken()),
 		Scheme:        manager.GetScheme(),
@@ -246,9 +254,9 @@ func registerKubeReconcilersOrDie(
 	}
 
 	if err := (&controller.MetricsAggregateReconciler{
-		Client:          manager.GetClient(),
-		Scheme:          manager.GetScheme(),
-		DiscoveryClient: discoveryClient,
+		Client:         manager.GetClient(),
+		Scheme:         manager.GetScheme(),
+		DiscoveryCache: discoveryCache,
 	}).SetupWithManager(ctx, manager); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "MetricsAggregate")
 	}
@@ -260,7 +268,7 @@ func registerKubeReconcilersOrDie(
 		ExtConsoleClient: extConsoleClient,
 		Tasks:            cmap.New[context.CancelFunc](),
 		Proxy:            enableKubecostProxy,
-		ServiceIDCache:   controller.NewServiceIDCache(serviceIDCacheExpiry),
+		ServiceIDCache:   controller.NewServiceIDCache(args.KubeCostExtractorCacheTTL()),
 	}).SetupWithManager(manager); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "MetricsAggregate")
 	}