fix(crd): omit empty categories and drop the duplicate Tenant CRD

[Rohmilchkaese]

Two CRD-rendering bugs found while deploying the operator with Argo CD. Both make the chart's CRDs misbehave under GitOps tooling; neither affects the operator at runtime.

1. categories: [] makes CRDs permanently drift

kube-rs derives names.categories as Some(vec![]) for types that declare no category attribute, so the generated CRDs ship:

spec:
  names:
    categories: []

The API server prunes empty arrays, so the stored object has no categories key at all. Anything that compares the rendered manifest against the live object then diffs a desired [] against an absent field, forever.

On Argo CD this presents confusingly: the sync succeeds and reports

successfully synced (all tasks run)

and the Application immediately reads OutOfSync again, while kubectl diff against the same cluster is completely clean. A hard refresh and an explicit re-sync do not help, because nothing is actually wrong on the cluster — only the comparison is.

Fixed by normalizing an empty categories list to None before serializing, and regenerating the tracked CRDs. The regeneration diff is exactly two lines, one per CRD.

2. The Tenant CRD is shipped twice

deploy/rustfs-operator/crds/tenant.yaml and deploy/rustfs-operator/crds/tenant-crd.yaml are byte-identical copies of the same CustomResourceDefinition. Helm renders every file in crds/, so installing the chart submits tenants.rustfs.com twice; Argo CD reports two resources sharing a name inside one Application.

tracked_tenant_crds_match_generated_schema asserted the generated schema against both paths, which kept the copies in lockstep rather than surfacing the duplication.

Kept crds/tenant-crd.yaml, matching the policybinding-crd.yaml naming, and pointed the test at the two files it actually tracks. The PolicyBinding half of the rendered output previously had no assertion, so this also closes a coverage gap.

Notes

• The two commits are ordered so each is green on its own: the de-duplication lands first, since fixing categories first would leave tenant.yaml stale and break the tracking test mid-history.
• Three tests added/changed: rendered CRDs carry no categories key; a populated categories list is left untouched (so the normalization cannot over-reach); and the tracking test now covers PolicyBinding.

Verification

cargo build --lib                    ok
cargo test  --lib                    503 passed, 0 failed  (501 before)
cargo fmt --check                    clean
cargo clippy --lib --all-features -- -D warnings   clean

Behaviour confirmed against a live 4-node erasure-coded tenant on Kubernetes 1.33: with the empty categories removed, the Argo CD Application settles on Synced / Healthy instead of flapping back to OutOfSync after every sync.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b83b6295b1

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Update upgrade docs for the renamed Tenant CRD

Removing this file leaves the documented upgrade commands pointing at a path that no longer exists: docs/operator-user-guide.md, docs/operator-user-guide.zh-CN.md, and deploy/rustfs-operator/README.md still run kubectl apply -f deploy/rustfs-operator/crds/tenant.yaml. Users following those upgrade steps will fail before applying the Tenant CRD, so the docs should be updated to tenant-crd.yaml or this compatibility path should remain available.

Useful? React with 👍 / 👎.

[Rohmilchkaese]

Thanks - good catch. Fixed in 39f1120: the upgrade commands in deploy/rustfs-operator/README.md, docs/operator-user-guide.md and docs/operator-user-guide.zh-CN.md now point at crds/tenant-crd.yaml.

I checked the rest of the tree for references to the removed path: the only other tenant.yaml hits are examples/*-tenant.yaml files and a tutorial-local manifest the reader creates themselves in the zh-CN guide, both unaffected.