charts/redpanda, multicluster: share init container rendering

.changes/unreleased/charts-redpanda-Changed-20260902-125313.yaml

@@ -0,0 +1,7 @@
+project: charts/redpanda
+kind: Changed
+body: |-
+    The configurator and fs-validator script volumes on the Redpanda StatefulSet are now named `configurator` and `fs-validator` rather than `<fullname>-configurator` and `<fullname>-fs-validator`. Volume names are pod-local, so only the volume and volumeMount entries change; the Secrets they project are still named after the release and are untouched. This also fixes the configurator volume name exceeding Kubernetes' 63 character limit for releases whose fullname is 51 characters or longer.
+
+      Upgrading an existing release changes the pod template and therefore rolls the brokers. If you override either of these volumes or volumeMounts through `podTemplate`, note that those lists are merged by name: an override keyed on the old `<fullname>-` prefixed name will silently stop matching and must be re-keyed to the new name.
+time: 2026-09-02T12:53:13.522260-04:00

.changes/unreleased/operator-Changed-20260902-125313.yaml

@@ -0,0 +1,9 @@
+project: operator
+kind: Changed
+body: |-
+    The configurator and fs-validator script volumes on the `Redpanda` and `StretchCluster` Pods are now named `configurator` and `fs-validator` rather than `<fullname>-configurator` and `<fullname>-fs-validator`. Volume names are pod-local, so only the volume and volumeMount entries change; the Secrets they project are still named after the release and are untouched. This also fixes the configurator volume name exceeding Kubernetes' 63 character limit for releases whose fullname is 51 characters or longer.
+
+      Upgrading an existing release changes the pod template and therefore rolls the brokers.
+
+      If you override either of these volumes or volumeMounts through `podTemplate`, note that those lists are merged by name: an override keyed on the old `<fullname>-` prefixed name will silently stop matching and must be re-keyed to the new name.
+time: 2026-09-02T12:53:13.522260-04:00

.changes/unreleased/operator-Changed-20260902-125314.yaml

@@ -0,0 +1,7 @@
+project: operator
+kind: Changed
+body: |-
+    StretchCluster brokers now render their init containers through the same code as the Redpanda Helm chart, which changes two things in the generated StatefulSets. The `configurator` init container of StretchClusters now carry `securityContext.runAsNonRoot: true` and `securityContext.allowPrivilegeEscalation: false`, matching the chart and `Redpanda` Pods.
+
+      This change will result in StretchCluster brokers restarting.
+time: 2026-09-02T12:53:14.522260-04:00

charts/redpanda/chart/post_install_upgrade_job.go

@@ -15,10 +15,10 @@ import (
 
 	batchv1 "k8s.io/api/batch/v1"
 	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/utils/ptr"
 
+	"github.com/redpanda-data/redpanda-operator/charts/redpanda/v25"
 	"github.com/redpanda-data/redpanda-operator/gotohelm/helmette"
 )
 
@@ -34,51 +34,6 @@ func BootstrapTemplateEnvVars(state *RenderState) []corev1.EnvVar {
 	return append(env, additionalEnv...)
 }
 
-// bootstrapYamlTemplater returns an initcontainer that will template
-// environment variables into ${base-config}/boostrap.yaml and output it to
-// ${config}/.bootstrap.yaml.
-func bootstrapYamlTemplater(state *RenderState, sts Statefulset) corev1.Container {
-	image := fmt.Sprintf(`%s:%s`,
-		sts.SideCars.Image.Repository,
-		sts.SideCars.Image.Tag,
-	)
-
-	return corev1.Container{
-		Name:  "bootstrap-yaml-envsubst",
-		Image: image,
-		Command: append([]string{
-			"/redpanda-operator",
-			"bootstrap",
-			"--in-dir",
-			"/tmp/base-config",
-			"--out-dir",
-			"/tmp/config",
-		}, state.Values.Statefulset.InitContainers.Configurator.AdditionalCLIArgs...),
-		Env: BootstrapTemplateEnvVars(state),
-		Resources: corev1.ResourceRequirements{
-			Limits: corev1.ResourceList{
-				corev1.ResourceCPU:    resource.MustParse("100m"),
-				corev1.ResourceMemory: resource.MustParse("125Mi"),
-			},
-			Requests: corev1.ResourceList{
-				corev1.ResourceCPU:    resource.MustParse("100m"),
-				corev1.ResourceMemory: resource.MustParse("125Mi"),
-			},
-		},
-		SecurityContext: &corev1.SecurityContext{
-			// NB: RunAsUser and RunAsGroup will be inherited from the
-			// PodSecurityContext of consumers.
-			AllowPrivilegeEscalation: ptr.To(false),
-			ReadOnlyRootFilesystem:   ptr.To(true),
-			RunAsNonRoot:             ptr.To(true),
-		},
-		VolumeMounts: []corev1.VolumeMount{
-			{Name: "config", MountPath: "/tmp/config/"},
-			{Name: "base-config", MountPath: "/tmp/base-config/"},
-		},
-	}
-}
-
 // postInstallJobPodLabels returns the labels for the post-install job's pod
 // template. The app.kubernetes.io/name label is set to "<name>-configuration"
 // so the pod does not match the Redpanda Service selector, preventing stale
@@ -103,6 +58,14 @@ func PostInstallUpgradeJob(state *RenderState) *batchv1.Job {
 		state.Values.Statefulset.SideCars.Image.Tag,
 	)
 
+	initRenderer := redpanda.InitContainerRenderer{
+		SidecarImage: fmt.Sprintf(`%s:%s`, state.Values.Statefulset.SideCars.Image.Repository, state.Values.Statefulset.SideCars.Image.Tag),
+		Bootstrap: &redpanda.BootstrapInitContainer{
+			Env:               BootstrapTemplateEnvVars(state),
+			AdditionalCLIArgs: state.Values.Statefulset.InitContainers.Configurator.AdditionalCLIArgs,
+		},
+	}
+
 	job := &batchv1.Job{
 		TypeMeta: metav1.TypeMeta{
 			APIVersion: "batch/v1",
@@ -143,7 +106,7 @@ func PostInstallUpgradeJob(state *RenderState) *batchv1.Job {
 						},
 						Spec: corev1.PodSpec{
 							RestartPolicy:                corev1.RestartPolicyNever,
-							InitContainers:               []corev1.Container{bootstrapYamlTemplater(state, state.Values.Statefulset)},
+							InitContainers:               initRenderer.Render(),
 							AutomountServiceAccountToken: ptr.To(false),
 							Containers: []corev1.Container{
 								{