feat: Support ignore annotations on StatefulSets

siegfriedweber · siegfriedweber · commit faf1a7319a65 · 2026-04-02T14:42:27.000+02:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -6,8 +6,10 @@ All notable changes to this project will be documented in this file.
 
 ### Added
 
-- Support the `restarter.stackable.tech/ignore` annotation on ConfigMaps and Secrets to exclude
-  them from the restarter controller ([#410]).
+- Support the annotation `restarter.stackable.tech/ignore` on ConfigMaps and Secrets and the
+  annotations `restarter.stackable.tech/ignore-configmap.x` and
+  `restarter.stackable.tech/ignore-secret.x` on StatefulSets to exclude ConfigMaps and Secrets from
+  the restarter controller ([#410]).
 
 [#410]: https://github.com/stackabletech/commons-operator/pull/410
 
diff --git a/rust/operator-binary/src/restart_controller/statefulset.rs b/rust/operator-binary/src/restart_controller/statefulset.rs
@@ -1,4 +1,9 @@
-use std::{collections::BTreeMap, future::Future, sync::Arc, time::Duration};
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    future::Future,
+    sync::Arc,
+    time::Duration,
+};
 
 use futures::{Stream, StreamExt, TryStream, stream};
 use serde_json::json;
@@ -128,13 +133,16 @@ pub async fn start<F>(
                 trigger_all(
                     {
                         let cm_reader = cm_store.as_reader();
-                        reflector(cm_store, metadata_watcher(cms, watcher::Config::default()))
-                            .inspect(move |_| {
-                                if let Some(tx) = cm_store_tx.take() {
-                                    tx.init(cm_reader.clone());
-                                }
-                            })
-                            .touched_objects()
+                        reflector(
+                            cm_store,
+                            metadata_watcher(cms, watcher::Config::default().labels("restarter.stackable.tech/ignore != true"))
+                        )
+                        .inspect(move |_| {
+                            if let Some(tx) = cm_store_tx.take() {
+                                tx.init(cm_reader.clone());
+                            }
+                        })
+                        .touched_objects()
                     },
                     sts_store.as_reader(),
                 ),
@@ -143,7 +151,7 @@ pub async fn start<F>(
                         let secret_reader = secret_store.as_reader();
                         reflector(
                             secret_store,
-                            metadata_watcher(secrets, watcher::Config::default()),
+                            metadata_watcher(secrets, watcher::Config::default().labels("restarter.stackable.tech/ignore != true")),
                         )
                         .inspect(move |_| {
                             if let Some(tx) = secret_store_tx.take() {
@@ -235,6 +243,32 @@ pub async fn get_updated_restarter_annotations(
     let ns = sts.metadata.namespace.as_deref().expect(
         "A StatefulSet observed by a reflector (so send by Kubernetes) always has a namespace set",
     );
+
+    let ignored_config_maps = sts
+        .metadata
+        .annotations
+        .iter()
+        .flatten()
+        .filter(|annotation| {
+            annotation
+                .0
+                .starts_with("restarter.stackable.tech/ignore-configmap.")
+        })
+        .map(|x| x.1)
+        .collect::<BTreeSet<_>>();
+    let ignored_secrets = sts
+        .metadata
+        .annotations
+        .iter()
+        .flatten()
+        .filter(|annotation| {
+            annotation
+                .0
+                .starts_with("restarter.stackable.tech/ignore-secret.")
+        })
+        .map(|x| x.1)
+        .collect::<BTreeSet<_>>();
+
     let mut annotations = BTreeMap::<String, String>::new();
     let pod_specs = sts
         .spec
@@ -269,25 +303,24 @@ pub async fn get_updated_restarter_annotations(
         })
         .map(|cm_ref| cm_ref.within(ns));
     let cms = ctx.cms.get().await.context(ConfigMapsUninitializedSnafu)?;
-    annotations.extend(cm_refs.flat_map(|cm_ref| cms.get(&cm_ref)).flat_map(|cm| {
-        Some((
-            format!(
-                "configmap.restarter.stackable.tech/{}",
-                cm.metadata.name.as_ref()?
-            ),
-            format!(
-                "{}/{}",
-                cm.metadata.uid.as_ref()?,
-                if cm.annotations().get("restarter.stackable.tech/ignore")
-                    == Some(&"true".to_owned())
-                {
-                    "any"
-                } else {
-                    cm.metadata.resource_version.as_ref()?
-                }
-            ),
-        ))
-    }));
+    annotations.extend(
+        cm_refs
+            .map(|cm_ref| (cm_ref.name.clone(), cms.get(&cm_ref)))
+            .map(|(cm_name, cm)| {
+                (
+                    format!("configmap.restarter.stackable.tech/{cm_name}",),
+                    if let Some(cm) = cm
+                        && let Some(uid) = &cm.metadata.uid
+                        && let Some(resource_version) = &cm.metadata.resource_version
+                        && !ignored_config_maps.contains(&cm_name)
+                    {
+                        format!("{uid}/{resource_version}",)
+                    } else {
+                        "changes-ignored".to_owned()
+                    },
+                )
+            }),
+    );
     let secret_refs = pod_specs
         .flat_map(|pod_spec| {
             find_pod_refs(
@@ -313,25 +346,20 @@ pub async fn get_updated_restarter_annotations(
     let secrets = ctx.secrets.get().await.context(SecretsUninitializedSnafu)?;
     annotations.extend(
         secret_refs
-            .flat_map(|secret_ref| secrets.get(&secret_ref))
-            .flat_map(|secret| {
-                Some((
-                    format!(
-                        "secret.restarter.stackable.tech/{}",
-                        secret.metadata.name.as_ref()?
-                    ),
-                    format!(
-                        "{}/{}",
-                        secret.metadata.uid.as_ref()?,
-                        if secret.annotations().get("restarter.stackable.tech/ignore")
-                            == Some(&"true".to_owned())
-                        {
-                            "any"
-                        } else {
-                            secret.metadata.resource_version.as_ref()?
-                        }
-                    ),
-                ))
+            .map(|secret_ref| (secret_ref.name.clone(), secrets.get(&secret_ref)))
+            .map(|(secret_name, secret)| {
+                (
+                    format!("secret.restarter.stackable.tech/{secret_name}",),
+                    if let Some(secret) = secret
+                        && let Some(uid) = &secret.metadata.uid
+                        && let Some(resource_version) = &secret.metadata.resource_version
+                        && !ignored_secrets.contains(&secret_name)
+                    {
+                        format!("{uid}/{resource_version}",)
+                    } else {
+                        "changes-ignored".to_owned()
+                    },
+                )
             }),
     );
     Ok(annotations)
diff --git a/tests/templates/kuttl/restarter/10-create-test-resources.yaml b/tests/templates/kuttl/restarter/10-create-test-resources.yaml
@@ -16,7 +16,7 @@ stringData:
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: configmap-ignored
+  name: configmap-self-ignored
   annotations:
     restarter.stackable.tech/ignore: "true"
 data:
@@ -25,18 +25,34 @@ data:
 apiVersion: v1
 kind: Secret
 metadata:
-  name: secret-ignored
+  name: secret-self-ignored
   annotations:
     restarter.stackable.tech/ignore: "true"
 stringData:
   revision: "1"
 ---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: configmap-ignored-in-statefulset
+data:
+  revision: "1"
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: secret-ignored-in-statefulset
+stringData:
+  revision: "1"
+---
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
   name: test
   labels:
     restarter.stackable.tech/enabled: "true"
+    restarter.stackable.tech/ignore-configmap.0: configmap-ignored-in-statefulset
+    restarter.stackable.tech/ignore-secret.0: secret-ignored-in-statefulset
 spec:
   selector:
     matchLabels:
@@ -56,12 +72,18 @@ spec:
         - name: secret-not-ignored
           secret:
             secretName: secret-not-ignored
-        - name: configmap-ignored
+        - name: configmap-self-ignored
+          configMap:
+            name: configmap-self-ignored
+        - name: secret-self-ignored
+          secret:
+            secretName: secret-self-ignored
+        - name: configmap-ignored-in-statefulset
           configMap:
-            name: configmap-ignored
-        - name: secret-ignored
+            name: configmap-ignored-in-statefulset
+        - name: secret-ignored-in-statefulset
           secret:
-            secretName: secret-ignored
+            secretName: secret-ignored-in-statefulset
       containers:
         - name: test
           image: alpine
@@ -78,16 +100,28 @@ spec:
               name: secret-not-ignored
               # Use a subPath, so that changes are only visible after a restart.
               subPath: revision
-            - mountPath: /config/configmap-ignored
-              name: configmap-ignored
-            - mountPath: /config/secret-ignored
-              name: secret-ignored
-            - mountPath: /config/configmap-ignored-subpath/revision
-              name: configmap-ignored
+            - mountPath: /config/configmap-self-ignored
+              name: configmap-self-ignored
+            - mountPath: /config/secret-self-ignored
+              name: secret-self-ignored
+            - mountPath: /config/configmap-self-ignored-subpath/revision
+              name: configmap-self-ignored
+              # Use a subPath, so that changes are only visible after a restart.
+              subPath: revision
+            - mountPath: /config/secret-self-ignored-subpath/revision
+              name: secret-self-ignored
+              # Use a subPath, so that changes are only visible after a restart.
+              subPath: revision
+            - mountPath: /config/configmap-ignored-in-statefulset
+              name: configmap-ignored-in-statefulset
+            - mountPath: /config/secret-ignored-in-statefulset
+              name: secret-ignored-in-statefulset
+            - mountPath: /config/configmap-ignored-in-statefulset-subpath/revision
+              name: configmap-ignored-in-statefulset
               # Use a subPath, so that changes are only visible after a restart.
               subPath: revision
-            - mountPath: /config/secret-ignored-subpath/revision
-              name: secret-ignored
+            - mountPath: /config/secret-ignored-in-statefulset-subpath/revision
+              name: secret-ignored-in-statefulset
               # Use a subPath, so that changes are only visible after a restart.
               subPath: revision
       terminationGracePeriodSeconds: 5
diff --git a/tests/templates/kuttl/restarter/20-assert.yaml b/tests/templates/kuttl/restarter/20-assert.yaml
@@ -12,7 +12,11 @@ commands:
 
       assert_revision 1 configmap-not-ignored-subpath
       assert_revision 1 secret-not-ignored-subpath
-      assert_revision 1 configmap-ignored-subpath
-      assert_revision 1 secret-ignored-subpath
-      assert_revision 2 configmap-ignored
-      assert_revision 2 secret-ignored
+      assert_revision 1 configmap-self-ignored-subpath
+      assert_revision 1 secret-self-ignored-subpath
+      assert_revision 2 configmap-self-ignored
+      assert_revision 2 secret-self-ignored
+      assert_revision 1 configmap-ignored-in-statefulset-subpath
+      assert_revision 1 secret-ignored-in-statefulset-subpath
+      assert_revision 2 configmap-ignored-in-statefulset
+      assert_revision 2 secret-ignored-in-statefulset
diff --git a/tests/templates/kuttl/restarter/20-hot-reload.yaml b/tests/templates/kuttl/restarter/20-hot-reload.yaml
@@ -2,13 +2,27 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: configmap-ignored
+  name: configmap-self-ignored
 data:
   revision: "2"
 ---
 apiVersion: v1
 kind: Secret
 metadata:
-  name: secret-ignored
+  name: secret-self-ignored
+stringData:
+  revision: "2"
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: configmap-ignored-in-statefulset
+data:
+  revision: "2"
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: secret-ignored-in-statefulset
 stringData:
   revision: "2"
diff --git a/tests/templates/kuttl/restarter/21-assert.yaml b/tests/templates/kuttl/restarter/21-assert.yaml
@@ -10,7 +10,11 @@ commands:
 
       assert_revision 2 configmap-not-ignored-subpath
       assert_revision 2 secret-not-ignored-subpath
-      assert_revision 2 configmap-ignored-subpath
-      assert_revision 2 secret-ignored-subpath
-      assert_revision 2 configmap-ignored
-      assert_revision 2 secret-ignored
+      assert_revision 2 configmap-self-ignored-subpath
+      assert_revision 2 secret-self-ignored-subpath
+      assert_revision 2 configmap-self-ignored
+      assert_revision 2 secret-self-ignored
+      assert_revision 2 configmap-ignored-in-statefulset-subpath
+      assert_revision 2 secret-ignored-in-statefulset-subpath
+      assert_revision 2 configmap-ignored-in-statefulset
+      assert_revision 2 secret-ignored-in-statefulset
