Remove v1alpha1 API

[gjkim42]

What type of PR is this?

/kind api

What this PR does / why we need it:

• Removes the kelos.dev/v1alpha1 API types, generated clients, compatibility paths, conversion implementations, and version-specific tests.
• Regenerates every Kelos CRD with v1alpha2 as its only served and storage version.
• Keeps a version-agnostic conversion webhook registration point and manifest generator wiring for the next API version.
• Adds kelos migrate-storage and makes kelos install migrate resources and status.storedVersions before removing a live CRD version.
• Renames the manager webhook selector so it describes the shared webhook server rather than a specific conversion version.

Which issue(s) this PR is related to:

N/A

Special notes for your reviewer:

Before upgrading Helm-managed CRDs, run the new CLI's kelos migrate-storage command while the currently installed controller is still running. kelos install performs the same migration automatically when it detects that a live CRD version will be removed.

Validation:

• make update
• make verify
• env -u CODEX_AUTH_JSON -u CODEX_HOME make test
• make test-integration (148 core specs and 12 install/uninstall specs passed)
• make build WHAT=cmd/kelos

Does this PR introduce a user-facing change?

Remove the deprecated kelos.dev/v1alpha1 API. Before upgrading Helm-managed CRDs, run `kelos migrate-storage` while the existing controller is available; `kelos install` performs this migration automatically.

---

Summary by cubic

Removes the deprecated kelos.dev/v1alpha1 API so every Kelos CRD serves only v1alpha2. Existing v1alpha1 resources must be migrated to v1alpha2 before the CRD update, or they become inaccessible.

Migration

• Run kelos migrate-storage while the currently installed controller is still running before upgrading Helm-managed CRDs.
• kelos install performs the migration automatically when it detects a live CRD version will be removed.
• The migration rewrites stored resources and status.storedVersions before the CRD version is removed.

^{Written for commit b4a4cb4. Summary will update on new commits.}

[cubic-dev-ai]

3 issues found across 85 files

Not reviewed (too large): internal/manifests/install-crd.yaml (~28,906 lines), internal/manifests/charts/kelos/charts/kelos-crds/templates/taskspawner-crd.yaml (~8,134 lines), internal/manifests/charts/kelos/charts/kelos-crds/templates/task-crd.yaml (~7,012 lines) - if these are generated or fixture files, add them to ignored paths to exclude them from future reviews.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="internal/cli/storage_migration.go">

<violation number="1" location="internal/cli/storage_migration.go:175">
P1: When the live CRD serves `v1alpha2` but still stores `v1alpha1`, this check passes and the migration falsely clears `storedVersions`. Require the live target version to be `storage: true` before rewriting, or stage that CRD transition first.</violation>

<violation number="2" location="internal/cli/storage_migration.go:223">
P2: When a Kelos installation has enough resources to exceed the API server's list response limits, this unbounded request makes `migrate-storage` fail before migration completes. Page the list with a limit and continuation-token loop.</violation>

<violation number="3" location="internal/cli/storage_migration.go:252">
P3: When a resource is deleted between the initial list and refetch, this line increments the migration count despite the `NotFound` path performing no update. Track whether an update occurred before incrementing `resourcesUpdated`.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: When the live CRD serves v1alpha2 but still stores v1alpha1, this check passes and the migration falsely clears storedVersions. Require the live target version to be storage: true before rewriting, or stage that CRD transition first.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At internal/cli/storage_migration.go, line 175:

<comment>When the live CRD serves `v1alpha2` but still stores `v1alpha1`, this check passes and the migration falsely clears `storedVersions`. Require the live target version to be `storage: true` before rewriting, or stage that CRD transition first.</comment>

<file context>
@@ -0,0 +1,265 @@
+		if !found || storageVersionsCurrent(storedVersions, definition.resource.Version) {
+			continue
+		}
+		if !crdServesVersion(crd, definition.resource.Version) {
+			return result, fmt.Errorf("CRD %s does not serve storage version %s; install an intermediate Kelos release before migrating", definition.name, definition.resource.Version)
+		}
</file context>

[cubic-dev-ai]

P2: When a Kelos installation has enough resources to exceed the API server's list response limits, this unbounded request makes migrate-storage fail before migration completes. Page the list with a limit and continuation-token loop.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At internal/cli/storage_migration.go, line 223:

<comment>When a Kelos installation has enough resources to exceed the API server's list response limits, this unbounded request makes `migrate-storage` fail before migration completes. Page the list with a limit and continuation-token loop.</comment>

<file context>
@@ -0,0 +1,265 @@
+	var list *unstructured.UnstructuredList
+	var err error
+	if definition.namespaced {
+		list, err = resource.Namespace(metav1.NamespaceAll).List(ctx, metav1.ListOptions{})
+	} else {
+		list, err = resource.List(ctx, metav1.ListOptions{})
</file context>

[cubic-dev-ai]

P3: When a resource is deleted between the initial list and refetch, this line increments the migration count despite the NotFound path performing no update. Track whether an update occurred before incrementing resourcesUpdated.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At internal/cli/storage_migration.go, line 252:

<comment>When a resource is deleted between the initial list and refetch, this line increments the migration count despite the `NotFound` path performing no update. Track whether an update occurred before incrementing `resourcesUpdated`.</comment>

<file context>
@@ -0,0 +1,265 @@
+		if err != nil {
+			return updated, fmt.Errorf("rewriting %s %s/%s at %s: %w", definition.resource.Resource, item.GetNamespace(), item.GetName(), definition.resource.GroupVersion(), err)
+		}
+		updated++
+	}
+	return updated, nil
</file context>