docs: remove product-config CLI param + env var; gut config-spec; changelog

adwk67 · claude · adwk67 · commit b2183e3e97d3 · 2026-06-03T18:54:43.000+02:00
Removes the --product-config section from the commandline reference and the
PRODUCT_CONFIG section from the environment-variables reference (the flag/var is
now a no-op via the shared RunArguments), reduces the product-config
properties.yaml files to an empty shell (retained pending a later Helm config
refactor), and notes the product-config removal in the changelog.

Co-Authored-By: Claude Opus 4.8 &lt;noreply@anthropic.com&gt;
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -18,6 +18,10 @@ All notable changes to this project will be documented in this file.
   Previously, arbitrary file names were silently accepted and ignored ([#960]).
 - Bump `stackable-operator` to 0.111.1 and snafu to 0.9 ([#960], [#961]).
 - Internal operator refactoring: introduce dereference() and validate() steps in the reconciler ([#968]).
+- Removed the product-config based configuration validation. Config and environment overrides are
+  now merged directly from the CRD into the validated cluster, the Java-properties writer is
+  vendored locally, and the `product-config` crate dependency is dropped. The `--product-config`
+  CLI flag is now a no-op ([#XXX]).
 - test: Bump vector-aggregator to 0.55.0, replace /graphql call with gRPC call ([#971]).
 
 [#953]: https://github.com/stackabletech/kafka-operator/pull/953
diff --git a/deploy/config-spec/properties.yaml b/deploy/config-spec/properties.yaml
@@ -1,152 +1,5 @@
 ---
 version: 0.1.0
 spec:
-  units:
-    - unit: &unitPort
-        name: "port"
-        regex: "^([0-9]{1,4}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$"
-
-    - unit: &unitUrl
-        name: "url"
-        regex: "^((https?|ftp|file)://)?[-a-zA-Z0-9+&@#}/%?=~_|!:,.;]*[-a-zA-Z0-9+&@#/%=~_|]"
-        examples:
-          - "https://www.stackable.de/blog/"
-
-    - unit: &unitCapacity
-        name: "capacity"
-        regex: "^[1-9]\\d*$"
-
-    - unit: &unitMilliseconds
-        name: "milliseconds"
-        regex: "^[1-9]\\d*$"
-
-properties:
-  - property:
-      propertyNames:
-        - name: "networkaddress.cache.ttl"
-          kind:
-            type: "file"
-            file: "security.properties"
-      datatype:
-        type: "integer"
-        min: "0"
-      recommendedValues:
-        - fromVersion: "0.0.0"
-          value: "30"
-      roles:
-        - name: "broker"
-          required: true
-        - name: "controller"
-          required: true
-      asOfVersion: "0.0.0"
-      comment: "TTL for successfully resolved domain names."
-      description: "TTL for successfully resolved domain names."
-
-  - property:
-      propertyNames:
-        - name: "networkaddress.cache.negative.ttl"
-          kind:
-            type: "file"
-            file: "security.properties"
-      datatype:
-        type: "integer"
-        min: "0"
-      recommendedValues:
-        - fromVersion: "0.0.0"
-          value: "0"
-      roles:
-        - name: "broker"
-          required: true
-        - name: "controller"
-          required: true
-      asOfVersion: "0.0.0"
-      comment: "TTL for domain names that cannot be resolved."
-      description: "TTL for domain names that cannot be resolved."
-
-  - property: &opaAuthorizerClassName
-      propertyNames:
-        - name: "authorizer.class.name"
-          kind:
-            type: "file"
-            file: "broker.properties"
-      datatype:
-        type: "string"
-      defaultValues:
-        - fromVersion: "0.0.0"
-          value: "com.bisnode.kafka.authorization.OpaAuthorizer"
-        - fromVersion: "3.0.0"
-          value: "org.openpolicyagent.kafka.OpaAuthorizer"
-      roles:
-        - name: "broker"
-          required: false
-      asOfVersion: "0.0.0"
-      description: "OPA Authorizer class name"
-
-  - property: &opaAuthorizerUrl
-      propertyNames:
-        - name: "opa.authorizer.url"
-          kind:
-            type: "file"
-            file: "broker.properties"
-      datatype:
-        type: "string"
-        unit: *unitUrl
-      roles:
-        - name: "broker"
-          required: false
-      asOfVersion: "0.0.0"
-      description: "OPA Authorizer URL"
-
-  - property: &opaAuthorizerInitialCacheCapacity
-      propertyNames:
-        - name: "opa.authorizer.cache.initial.capacity"
-          kind:
-            type: "file"
-            file: "broker.properties"
-      datatype:
-        type: "integer"
-        unit: *unitCapacity
-      defaultValues:
-        - fromVersion: "0.0.0"
-          value: "0"
-      roles:
-        - name: "broker"
-          required: false
-      asOfVersion: "0.0.0"
-      description: "OPA Authorizer initial cache capacity"
-
-  - property: &opaAuthorizerMaxCacheSize
-      propertyNames:
-        - name: "opa.authorizer.cache.maximum.size"
-          kind:
-            type: "file"
-            file: "broker.properties"
-      datatype:
-        type: "integer"
-        unit: *unitCapacity
-      defaultValues:
-        - fromVersion: "0.0.0"
-          value: "0"
-      roles:
-        - name: "broker"
-          required: false
-      asOfVersion: "0.0.0"
-      description: "OPA authorizer max cache size"
-
-  - property: &opaAuthorizerCacheExpireAfterSeconds
-      propertyNames:
-        - name: "opa.authorizer.cache.expire.after.seconds"
-          kind:
-            type: "file"
-            file: "broker.properties"
-      datatype:
-        type: "integer"
-        unit: *unitCapacity
-      defaultValues:
-        - fromVersion: "0.0.0"
-          value: "0"
-      roles:
-        - name: "broker"
-          required: false
-      asOfVersion: "0.0.0"
-      description: "The number of seconds after which the OPA authorizer cache expires"
+  units: []
+properties: []
diff --git a/deploy/helm/kafka-operator/configs/properties.yaml b/deploy/helm/kafka-operator/configs/properties.yaml
@@ -1,152 +1,5 @@
 ---
 version: 0.1.0
 spec:
-  units:
-    - unit: &unitPort
-        name: "port"
-        regex: "^([0-9]{1,4}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$"
-
-    - unit: &unitUrl
-        name: "url"
-        regex: "^((https?|ftp|file)://)?[-a-zA-Z0-9+&@#}/%?=~_|!:,.;]*[-a-zA-Z0-9+&@#/%=~_|]"
-        examples:
-          - "https://www.stackable.de/blog/"
-
-    - unit: &unitCapacity
-        name: "capacity"
-        regex: "^[1-9]\\d*$"
-
-    - unit: &unitMilliseconds
-        name: "milliseconds"
-        regex: "^[1-9]\\d*$"
-
-properties:
-  - property:
-      propertyNames:
-        - name: "networkaddress.cache.ttl"
-          kind:
-            type: "file"
-            file: "security.properties"
-      datatype:
-        type: "integer"
-        min: "0"
-      recommendedValues:
-        - fromVersion: "0.0.0"
-          value: "30"
-      roles:
-        - name: "broker"
-          required: true
-        - name: "controller"
-          required: true
-      asOfVersion: "0.0.0"
-      comment: "TTL for successfully resolved domain names."
-      description: "TTL for successfully resolved domain names."
-
-  - property:
-      propertyNames:
-        - name: "networkaddress.cache.negative.ttl"
-          kind:
-            type: "file"
-            file: "security.properties"
-      datatype:
-        type: "integer"
-        min: "0"
-      recommendedValues:
-        - fromVersion: "0.0.0"
-          value: "0"
-      roles:
-        - name: "broker"
-          required: true
-        - name: "controller"
-          required: true
-      asOfVersion: "0.0.0"
-      comment: "TTL for domain names that cannot be resolved."
-      description: "TTL for domain names that cannot be resolved."
-
-  - property: &opaAuthorizerClassName
-      propertyNames:
-        - name: "authorizer.class.name"
-          kind:
-            type: "file"
-            file: "broker.properties"
-      datatype:
-        type: "string"
-      defaultValues:
-        - fromVersion: "0.0.0"
-          value: "com.bisnode.kafka.authorization.OpaAuthorizer"
-        - fromVersion: "3.0.0"
-          value: "org.openpolicyagent.kafka.OpaAuthorizer"
-      roles:
-        - name: "broker"
-          required: false
-      asOfVersion: "0.0.0"
-      description: "OPA Authorizer class name"
-
-  - property: &opaAuthorizerUrl
-      propertyNames:
-        - name: "opa.authorizer.url"
-          kind:
-            type: "file"
-            file: "broker.properties"
-      datatype:
-        type: "string"
-        unit: *unitUrl
-      roles:
-        - name: "broker"
-          required: false
-      asOfVersion: "0.0.0"
-      description: "OPA Authorizer URL"
-
-  - property: &opaAuthorizerInitialCacheCapacity
-      propertyNames:
-        - name: "opa.authorizer.cache.initial.capacity"
-          kind:
-            type: "file"
-            file: "broker.properties"
-      datatype:
-        type: "integer"
-        unit: *unitCapacity
-      defaultValues:
-        - fromVersion: "0.0.0"
-          value: "0"
-      roles:
-        - name: "broker"
-          required: false
-      asOfVersion: "0.0.0"
-      description: "OPA Authorizer initial cache capacity"
-
-  - property: &opaAuthorizerMaxCacheSize
-      propertyNames:
-        - name: "opa.authorizer.cache.maximum.size"
-          kind:
-            type: "file"
-            file: "broker.properties"
-      datatype:
-        type: "integer"
-        unit: *unitCapacity
-      defaultValues:
-        - fromVersion: "0.0.0"
-          value: "0"
-      roles:
-        - name: "broker"
-          required: false
-      asOfVersion: "0.0.0"
-      description: "OPA authorizer max cache size"
-
-  - property: &opaAuthorizerCacheExpireAfterSeconds
-      propertyNames:
-        - name: "opa.authorizer.cache.expire.after.seconds"
-          kind:
-            type: "file"
-            file: "broker.properties"
-      datatype:
-        type: "integer"
-        unit: *unitCapacity
-      defaultValues:
-        - fromVersion: "0.0.0"
-          value: "0"
-      roles:
-        - name: "broker"
-          required: false
-      asOfVersion: "0.0.0"
-      description: "The number of seconds after which the OPA authorizer cache expires"
+  units: []
+properties: []
diff --git a/docs/modules/kafka/pages/reference/commandline-parameters.adoc b/docs/modules/kafka/pages/reference/commandline-parameters.adoc
@@ -2,19 +2,6 @@
 
 This operator accepts the following command line parameters:
 
-== product-config
-
-*Default value*: `/etc/stackable/kafka-operator/config-spec/properties.yaml`
-
-*Required*: false
-
-*Multiple values:* false
-
-[source]
-----
-stackable-kafka-operator run --product-config /foo/bar/properties.yaml
-----
-
 == watch-namespace
 
 *Default value*: All namespaces
diff --git a/docs/modules/kafka/pages/reference/environment-variables.adoc b/docs/modules/kafka/pages/reference/environment-variables.adoc
@@ -33,32 +33,6 @@ docker run \
 oci.stackable.tech/sdp/kafka-operator:0.0.0-dev
 ----
 
-== PRODUCT_CONFIG
-
-*Default value*: `/etc/stackable/kafka-operator/config-spec/properties.yaml`
-
-*Required*: false
-
-*Multiple values*: false
-
-[source]
-----
-export PRODUCT_CONFIG=/foo/bar/properties.yaml
-stackable-kafka-operator run
-----
-
-or via docker:
-
-----
-docker run \
-    --name kafka-operator \
-    --network host \
-    --env KUBECONFIG=/home/stackable/.kube/config \
-    --env PRODUCT_CONFIG=/my/product/config.yaml \
-    --mount type=bind,source="$HOME/.kube/config",target="/home/stackable/.kube/config" \
-    oci.stackable.tech/sdp/kafka-operator:0.0.0-dev
-----
-
 == WATCH_NAMESPACE
 
 *Default value*: All namespaces
