(fix): report Unknown for deprecation status when catalog unavailable and prevent error leak

When a catalog is removed or unreachable, deprecation conditions now correctly show Unknown instead of False. BundleDeprecated now reflects the installed bundle and uses the correct reason.

- Defer deprecation status updates until end of reconciliation
- Track hadCatalogDeprecationData to distinguish catalog absence from 'not deprecated'
- Report installed bundle deprecation, not the bundle being installed
- BundleDeprecated uses Deprecated reason when bundle exists, Absent only when none
- Prevent install/validation errors from leaking into deprecation conditions

Scenarios fixed:

- No catalog + no bundle → BundleDeprecated: Unknown/Absent
- No catalog + bundle installed → BundleDeprecated: Unknown/Deprecated (was False/Absent)
- During upgrade v1→v2 → shows v1 status, not v2
- Resolution fails with warnings → deprecation warnings still reach users

Assisted-by: Cursor

Author: camilamacedo86

api/v1/clusterextension_types.go

@@ -483,12 +483,15 @@ type ClusterExtensionStatus struct {
 	// When Progressing is True and the Reason is Retrying, the ClusterExtension has encountered an error that could be resolved on subsequent reconciliation attempts.
 	// When Progressing is False and the Reason is Blocked, the ClusterExtension has encountered an error that requires manual intervention for recovery.
 	//
-	// When the ClusterExtension is sourced from a catalog, if may also communicate a deprecation condition.
+	// When the ClusterExtension is sourced from a catalog, it may surface deprecation conditions based on catalog metadata.
 	// These are indications from a package owner to guide users away from a particular package, channel, or bundle.
-	// BundleDeprecated is set if the requested bundle version is marked deprecated in the catalog.
-	// ChannelDeprecated is set if the requested channel is marked deprecated in the catalog.
-	// PackageDeprecated is set if the requested package is marked deprecated in the catalog.
-	// Deprecated is a rollup condition that is present when any of the deprecated conditions are present.
+	// PackageDeprecated reports the requested package as deprecated when the catalog says so. When no catalog talks
+	// about the package, the condition stays Unknown instead of claiming False.
+	// ChannelDeprecated follows the same rules for each requested channel.
+	// BundleDeprecated describes the installed bundle once one exists. Until a bundle installs, or when no catalog
+	// data is available, it remains Unknown.
+	// Deprecated is still the rollup: it goes True when any individual deprecation condition is True, and Unknown
+	// when we have no catalog information to report.
 	//
 	// +listType=map
 	// +listMapKey=type

docs/api-reference/olmv1-api-reference.md

@@ -359,7 +359,7 @@ _Appears in:_
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `conditions` _[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#condition-v1-meta) array_ | The set of condition types which apply to all spec.source variations are Installed and Progressing.<br />The Installed condition represents whether or not the bundle has been installed for this ClusterExtension.<br />When Installed is True and the Reason is Succeeded, the bundle has been successfully installed.<br />When Installed is False and the Reason is Failed, the bundle has failed to install.<br />The Progressing condition represents whether or not the ClusterExtension is advancing towards a new state.<br />When Progressing is True and the Reason is Succeeded, the ClusterExtension is making progress towards a new state.<br />When Progressing is True and the Reason is Retrying, the ClusterExtension has encountered an error that could be resolved on subsequent reconciliation attempts.<br />When Progressing is False and the Reason is Blocked, the ClusterExtension has encountered an error that requires manual intervention for recovery.<br />When the ClusterExtension is sourced from a catalog, if may also communicate a deprecation condition.<br />These are indications from a package owner to guide users away from a particular package, channel, or bundle.<br />BundleDeprecated is set if the requested bundle version is marked deprecated in the catalog.<br />ChannelDeprecated is set if the requested channel is marked deprecated in the catalog.<br />PackageDeprecated is set if the requested package is marked deprecated in the catalog.<br />Deprecated is a rollup condition that is present when any of the deprecated conditions are present. |  |  |
+| `conditions` _[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#condition-v1-meta) array_ | The set of condition types which apply to all spec.source variations are Installed and Progressing.<br />The Installed condition represents whether or not the bundle has been installed for this ClusterExtension.<br />When Installed is True and the Reason is Succeeded, the bundle has been successfully installed.<br />When Installed is False and the Reason is Failed, the bundle has failed to install.<br />The Progressing condition represents whether or not the ClusterExtension is advancing towards a new state.<br />When Progressing is True and the Reason is Succeeded, the ClusterExtension is making progress towards a new state.<br />When Progressing is True and the Reason is Retrying, the ClusterExtension has encountered an error that could be resolved on subsequent reconciliation attempts.<br />When Progressing is False and the Reason is Blocked, the ClusterExtension has encountered an error that requires manual intervention for recovery.<br />When the ClusterExtension is sourced from a catalog, it may surface deprecation conditions based on catalog metadata.<br />These are indications from a package owner to guide users away from a particular package, channel, or bundle.<br />PackageDeprecated reports the requested package as deprecated when the catalog says so. When no catalog talks<br />about the package, the condition stays Unknown instead of claiming False.<br />ChannelDeprecated follows the same rules for each requested channel.<br />BundleDeprecated describes the installed bundle once one exists. Until a bundle installs, or when no catalog<br />data is available, it remains Unknown.<br />Deprecated is still the rollup: it goes True when any individual deprecation condition is True, and Unknown<br />when we have no catalog information to report. |  |  |
 | `install` _[ClusterExtensionInstallStatus](#clusterextensioninstallstatus)_ | install is a representation of the current installation status for this ClusterExtension. |  |  |
 
 

helm/olmv1/base/operator-controller/crd/experimental/olm.operatorframework.io_clusterextensions.yaml

@@ -518,12 +518,15 @@ spec:
                   When Progressing is True and the Reason is Retrying, the ClusterExtension has encountered an error that could be resolved on subsequent reconciliation attempts.
                   When Progressing is False and the Reason is Blocked, the ClusterExtension has encountered an error that requires manual intervention for recovery.
 
-                  When the ClusterExtension is sourced from a catalog, if may also communicate a deprecation condition.
+                  When the ClusterExtension is sourced from a catalog, it may surface deprecation conditions based on catalog metadata.
                   These are indications from a package owner to guide users away from a particular package, channel, or bundle.
-                  BundleDeprecated is set if the requested bundle version is marked deprecated in the catalog.
-                  ChannelDeprecated is set if the requested channel is marked deprecated in the catalog.
-                  PackageDeprecated is set if the requested package is marked deprecated in the catalog.
-                  Deprecated is a rollup condition that is present when any of the deprecated conditions are present.
+                  PackageDeprecated reports the requested package as deprecated when the catalog says so. When no catalog talks
+                  about the package, the condition stays Unknown instead of claiming False.
+                  ChannelDeprecated follows the same rules for each requested channel.
+                  BundleDeprecated describes the installed bundle once one exists. Until a bundle installs, or when no catalog
+                  data is available, it remains Unknown.
+                  Deprecated is still the rollup: it goes True when any individual deprecation condition is True, and Unknown
+                  when we have no catalog information to report.
                 items:
                   description: Condition contains details for one aspect of the current
                     state of this API Resource.

helm/olmv1/base/operator-controller/crd/standard/olm.operatorframework.io_clusterextensions.yaml

@@ -479,12 +479,15 @@ spec:
                   When Progressing is True and the Reason is Retrying, the ClusterExtension has encountered an error that could be resolved on subsequent reconciliation attempts.
                   When Progressing is False and the Reason is Blocked, the ClusterExtension has encountered an error that requires manual intervention for recovery.
 
-                  When the ClusterExtension is sourced from a catalog, if may also communicate a deprecation condition.
+                  When the ClusterExtension is sourced from a catalog, it may surface deprecation conditions based on catalog metadata.
                   These are indications from a package owner to guide users away from a particular package, channel, or bundle.
-                  BundleDeprecated is set if the requested bundle version is marked deprecated in the catalog.
-                  ChannelDeprecated is set if the requested channel is marked deprecated in the catalog.
-                  PackageDeprecated is set if the requested package is marked deprecated in the catalog.
-                  Deprecated is a rollup condition that is present when any of the deprecated conditions are present.
+                  PackageDeprecated reports the requested package as deprecated when the catalog says so. When no catalog talks
+                  about the package, the condition stays Unknown instead of claiming False.
+                  ChannelDeprecated follows the same rules for each requested channel.
+                  BundleDeprecated describes the installed bundle once one exists. Until a bundle installs, or when no catalog
+                  data is available, it remains Unknown.
+                  Deprecated is still the rollup: it goes True when any individual deprecation condition is True, and Unknown
+                  when we have no catalog information to report.
                 items:
                   description: Condition contains details for one aspect of the current
                     state of this API Resource.

internal/operator-controller/controllers/clusterextension_admission_test.go

@@ -13,20 +13,20 @@ import (
 )
 
 func TestClusterExtensionSourceConfig(t *testing.T) {
-	sourceTypeEmptyError := "Invalid value: null"
+	sourceTypeEmptyErrors := []string{"Invalid value: \"null\"", "Invalid value: null"}
 	sourceTypeMismatchError := "spec.source.sourceType: Unsupported value"
 	sourceConfigInvalidError := "spec.source: Invalid value"
 	// unionField represents the required Catalog or (future) Bundle field required by SourceConfig
 	testCases := []struct {
 		name       string
 		sourceType string
 		unionField string
-		errMsg     string
+		errMsgs    []string
 	}{
-		{"sourceType is null", "", "Catalog", sourceTypeEmptyError},
-		{"sourceType is invalid", "Invalid", "Catalog", sourceTypeMismatchError},
-		{"catalog field does not exist", "Catalog", "", sourceConfigInvalidError},
-		{"sourceConfig has required fields", "Catalog", "Catalog", ""},
+		{"sourceType is null", "", "Catalog", sourceTypeEmptyErrors},
+		{"sourceType is invalid", "Invalid", "Catalog", []string{sourceTypeMismatchError}},
+		{"catalog field does not exist", "Catalog", "", []string{sourceConfigInvalidError}},
+		{"sourceConfig has required fields", "Catalog", "Catalog", nil},
 	}
 
 	t.Parallel()
@@ -62,12 +62,20 @@ func TestClusterExtensionSourceConfig(t *testing.T) {
 				}))
 			}
 
-			if tc.errMsg == "" {
+			if len(tc.errMsgs) == 0 {
 				require.NoError(t, err, "unexpected error for sourceType %q: %w", tc.sourceType, err)
-			} else {
-				require.Error(t, err)
-				require.Contains(t, err.Error(), tc.errMsg)
+				return
+			}
+
+			require.Error(t, err)
+			matched := false
+			for _, msg := range tc.errMsgs {
+				if strings.Contains(err.Error(), msg) {
+					matched = true
+					break
+				}
 			}
+			require.True(t, matched, "expected one of %v in error %q", tc.errMsgs, err)
 		})
 	}
 }