Asset CRD dissolution — migration guide¶

Issue #348 removes the physical.dcs.io/v1alpha1 Asset CRD, the procedural.dcs.io/v1alpha1 AssetMethodCall PhaseTemplate body type, and the pkg/asset.InvokeAssetMethod runtime path. See ADR-0001 for the architectural rationale.

This guide covers what existing CRs need to change.

Who is affected¶

Asset shipped only in v1alpha1 and was always documented as draft. There are no production users. The schema was carried in the binary, and no GMP deployment had exercised it. If you have Asset CRs applied to a cluster running an older operator image, follow the steps below before rolling the operators forward.

What's gone¶

Removed	Replacement
`Asset` (kind: physical.dcs.io/v1alpha1)	`ControlModule` (sensors, simple valves) or `Unit` with `spec.serviceBinding` (smart skids, PLCs)
`Asset.spec.bindings[].opcua`	`Unit.spec.serviceBinding` (OPC UA security + endpoint live there directly)
`Asset.spec.properties[].dataType=Method`	`Unit.spec.serviceBinding.services[]` — each service maps to one OPC UA Method NodeId
`AssetMethodCallSpec` (PhaseTemplate body)	`ActionChart` with ST that calls `CALL_SERVICE('<unit>', '<service>', ...)`
`pkg/asset.InvokeAssetMethod` (controller helper)	`internal/controller/procedural/call_service.go` — driven from the ST `CALL_SERVICE` builtin
Companion-spec runtime objects (PA-DIM/Pump/Valve)	Design-time templates only; will land in a future templates registry (no longer carried on runtime CRs)
`/api/v1/sites/{site}/assets/*` REST endpoints	None — Asset CRUD is gone. Unit CRUD lives at `/api/v1/sites/{site}/units` (unchanged).
`/api/v1/asset-discovery/opcua/*` REST endpoints	`/api/v1/discovery/opcua/*` — same shapes, new path
Trust-list inbox + UI	Deferred. `UnitServiceBinding.Security.ServerCertSHA256Pin` is set inline; bulk-pin UI to be rebuilt later.

Migration recipes¶

A. Asset modeling a sensor or simple device (no methods)¶

If the Asset only carried typed properties read over OPC UA (no dataType: Method entries), it was a sensor. Migrate to ControlModule and a sibling IOModule driver entry.

Before:

apiVersion: physical.dcs.io/v1alpha1
kind: Asset
metadata:
  name: reactor-1-coriolis
  namespace: site-newark-plant
spec:
  unitRef: reactor-1
  bindings:
    - name: primary
      transport: opcua
      opcua:
        endpoint: "opc.tcp://10.42.10.18:4840"
        securityPolicy: Basic256Sha256
        securityMode: SignAndEncrypt
        authMode: certificate
        credentialsRef: { name: reactor-1-coriolis-client-cert }
        serverCertSha256Pin: "..."
  properties:
    - name: massFlow
      dataType: Double
      direction: input
      engineeringUnit: kg/h
      bindingRef: primary
      addressInBinding: "browse:/Objects/CFM-101/MassFlow"

After: declare an IOModule for the OPC UA endpoint (one per device), then a ControlModule whose tags address into it. Do not hand-derive the new CRs from the old shape. Re-run the discovery wizard against the device's address space.

B. Asset modeling a smart skid (has methods)¶

If the Asset had dataType: Method properties or paired with an AssetMethodCall PhaseTemplate, migrate to Unit.spec.serviceBinding. See examples/smart-skid/unit-cip-skid.yaml for the target shape.

Recipe ST then calls each service by name:

CALL_SERVICE('cip-skid-1', 'StartCIP',
    recipeId := 'alkaline-rinse',
    durationMinutes := 30);
state := CALL_SERVICE('cip-skid-1', 'GetState');
IF state = 'Fault' THEN
    COMMAND('Hold');
END_IF;

The PhaseTemplate body is ActionChart carrying ST. Do not set AssetMethodCall (the field is gone). Inputs come from recipe parameters via the standard ${paramName} substitution on the ParameterValues passed to the phase.

C. Cluster cleanup¶

After upgrading operators to a build that no longer registers the Asset CRD, run:

kubectl delete crd assets.physical.dcs.io

AssetMethodCall was a Phase body field with no CRD of its own, so it needs no CRD cleanup.

Discovery wizard (#347)¶

The OPC UA discovery wizard (System UI → Device Discovery) is now the on-ramp for smart devices. Point it at the server, browse the address space, and the wizard proposes ControlModule or Unit (serviceBinding) CRs. Output is reviewable YAML. Apply it via the existing kubectl or GitOps pipeline.

Trust-list¶

The standalone Trust List inbox is removed in this change. Pin the server cert fingerprint directly on Unit.spec.serviceBinding.security.serverCertSha256Pin for now. The bulk inbox view will be rebuilt against the Unit-based shape in a follow-up.