feat: bump kube-prometheus-stack CRDs to 86.1.0 and add the opentelemetry-operator CRDs

[venkatamutyala]

Replaces #68 and #92 (both auto-closed by GitHub when their head branches were renamed). This is the original otel branch reconciled with main (#83, 0.1.5, #90); the pre-sync branch is kept as old-otel-20260902.

Why

The new monitoring stack (GlueOps/k8s-monitoring-helm, wired in by the platform chart's glueops-core-monitoring app-of-apps — see the companion feat/otel-20260902 PRs) runs kube-prometheus-stack 86.1.0 and the opentelemetry-operator chart 0.114.1 (appVersion v0.152.0). Both used to install their own CRDs from inside Argo CD Applications; this bundle is now their only installer.

What

• kube-prometheus-stack 59.1.0 → 86.1.0 — same 10 CRDs, still single-version with no conversion webhooks; no served version removed (hack/version-guard.sh passes). This is the pin that the chart in k8s-monitoring-helm uses, so the bundle and the operator match exactly.
• opentelemetry-operator v0.152.0 — instrumentations, opampbridges, opentelemetrycollectors, targetallocators, sourced from the operator repo's config/crd/bases/ (the Helm chart's conf/crds/ copies are Go templates carrying the webhook caBundle, not YAML kustomize can read). The chart-only, feature-gated ClusterObservability CRD is excluded in hack/verify.sh.
• OpenTelemetryCollector serves only v1beta1. Upstream serves v1alpha1 too and relies on the operator's conversion webhook to translate between them. This bundle deliberately cannot carry a conversion webhook (an orphan CRD with one is not inert — hack/verify.sh check 5), so kustomization.yaml patches v1alpha1 to served: false (a JSON-patch test op guards the index). With a single served version no conversion is ever invoked, strategy: None is correct and status.storedVersions stays [v1beta1]. Everything the platform deploys is v1beta1 (GlueOps/otel-resources-helm); Instrumentation is single-version upstream. Documented in the README.
  • Alternative if you'd rather not diverge from upstream: keep the OTel CRDs out of the bundle and let the operator chart ship them ("ship it with its operator", the README's sanctioned exception). That means flipping crds.create back to true in k8s-monitoring-helm and dropping the 4 sources + patch here.
• hack/pins.map, hack/pins.sh, renovate.json learn the new upstream so it is pinned (glueops.dev/pin.opentelemetry-operator) and bumped like every other source. The renovate rule notes it must move together with the chart appVersion in k8s-monitoring-helm.

Verification (local)

• hack/render.sh → 87 base + 2 kubeadm CRDs
• hack/verify.sh → every source complete and pinned, no forbidden groups, no conversion webhooks, package round-trips
• hack/version-guard.sh origin/main → no served versions removed
• Server-side apply on kind v1.34.8: 89 CRDs Established; a v1beta1 OpenTelemetryCollector is accepted, v1alpha1 is refused by the API server

Review follow-ups (second commit)

• Every bundle CRD now carries argocd.argoproj.io/sync-options: Prune=false,Delete=false (stamped by hack/render.sh, asserted by hack/verify.sh check 5d). On a cluster where an Argo CD Application used to install CRDs (the pre-#347 k8s-monitoring-helm umbrella did, for kube-prometheus-stack and OpenTelemetry), those CRDs stay tracked by that Application, and Argo CD would prune them once they leave its desired state or cascade-delete them through its resources-finalizer — garbage-collecting every object of those kinds. Stripping the tracking (which captain_utils → crds does) is a race against self-heal; the annotation is honoured on the live object regardless of who tracks it. Verified on the k3d e2e cluster: a throwaway CRD tracked to glueops-core-otel was pruned within 20 s without the annotation and reported ignored (no prune) with it.
• hack/verify.sh's stale-webhook recipe now nulls the webhook stanza too ({"spec":{"conversion":{"strategy":"None","webhook":null}}}); the API server rejects strategy None while spec.conversion.webhook is still set, and the OpenTelemetryCollector CRD is the first bundle CRD whose previous installer set one.
• README: new section on taking over Application-installed CRDs.
• Re-verified: hack/render.sh, hack/verify.sh, hack/version-guard.sh origin/main, and the re-rendered bundle applied to the e2e cluster (87 changed, all Established).

Merge order

1. This PR (bundle release, e.g. v0.2.0 — the kps bump is a minor per the 0.x policy)
2. GlueOps/k8s-monitoring-helm feat/otel-20260902 (stops installing CRDs)
3. GlueOps/platform-helm-chart-platform feat/otel-20260902 (switches to the new stack)
4. GlueOps/terraform-module-cloud-multy-prerequisites feat/otel-20260902 (pins the released chart + bundle)

Clusters must run captain_utils → crds with the released bundle before the platform chart that carries the new stack.

🤖 Generated with Claude Code

https://claude.ai/code/session_01L9V4AwNYgrznbZVpcA2cw8