Merge remote-tracking branch 'origin/main' into rust-2024-upgrade

# Conflicts:
#	Cargo.toml
#	rust/operator-binary/src/controller.rs
#	rust/operator-binary/src/controller/build/jvm.rs
#	rust/operator-binary/src/controller/build/resource/reporting_task.rs

Author: Saul-STFC

.github/workflows/build.yaml

@@ -23,9 +23,9 @@ on:
 
 env:
   OPERATOR_NAME: "nifi-operator"
-  RUST_NIGHTLY_TOOLCHAIN_VERSION: "nightly-2026-02-24"
+  RUST_NIGHTLY_TOOLCHAIN_VERSION: "nightly-2026-07-01"
   NIX_PKG_MANAGER_VERSION: "2.33.3"
-  RUST_TOOLCHAIN_VERSION: "1.93.0"
+  RUST_TOOLCHAIN_VERSION: "1.95.0"
   HADOLINT_VERSION: "v2.14.0"
   PYTHON_VERSION: "3.14"
   CARGO_TERM_COLOR: always
@@ -48,7 +48,7 @@ jobs:
 
       - name: Check for changed files
         id: check
-        uses: stackabletech/actions/detect-changes@6a84fcfccf4ee37d85217407bc6a94742afbb45f # v0.14.2
+        uses: stackabletech/actions/detect-changes@a8af17a19bdcc3b5da0065f76e73827ba0c072ce # v0.16.0
         with:
           patterns: |
             - '.github/workflows/build.yaml'
@@ -83,9 +83,8 @@ jobs:
           submodules: recursive
 
       - name: Install Rust ${{ env.RUST_TOOLCHAIN_VERSION }} toolchain
-        uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b
-        with:
-          toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
+        shell: bash
+        run: rustup toolchain install "${RUST_TOOLCHAIN_VERSION}"
 
       - name: Setup Rust Cache
         uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
@@ -160,22 +159,21 @@ jobs:
         uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31.5.2
 
       - name: Install Rust ${{ env.RUST_TOOLCHAIN_VERSION }} Toolchain
-        uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b
-        with:
-          toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
+        shell: bash
+        run: rustup toolchain install "${RUST_TOOLCHAIN_VERSION}"
 
       - name: Build Container Image
         id: build
-        uses: stackabletech/actions/build-container-image@6a84fcfccf4ee37d85217407bc6a94742afbb45f # v0.14.2
+        uses: stackabletech/actions/build-container-image@a8af17a19bdcc3b5da0065f76e73827ba0c072ce # v0.16.0
         with:
           image-name: ${{ env.OPERATOR_NAME }}
           image-index-manifest-tag: ${{ steps.version.outputs.OPERATOR_VERSION }}
           build-arguments: VERSION=${{ steps.version.outputs.OPERATOR_VERSION }}
           container-file: docker/Dockerfile
 
-      - name: Publish Container Image
+      - name: Publish Container Image to oci.stackable.tech
         if: ${{ !github.event.pull_request.head.repo.fork }}
-        uses: stackabletech/actions/publish-image@6a84fcfccf4ee37d85217407bc6a94742afbb45f # v0.14.2
+        uses: stackabletech/actions/publish-image@a8af17a19bdcc3b5da0065f76e73827ba0c072ce # v0.16.0
         with:
           image-registry-uri: oci.stackable.tech
           image-registry-username: robot$sdp+github-action-build
@@ -184,6 +182,17 @@ jobs:
           image-manifest-tag: ${{ steps.build.outputs.image-manifest-tag }}
           source-image-uri: ${{ steps.build.outputs.image-manifest-uri }}
 
+      - name: Publish Container Image to quay.io
+        if: ${{ !github.event.pull_request.head.repo.fork }}
+        uses: stackabletech/actions/publish-image@a8af17a19bdcc3b5da0065f76e73827ba0c072ce # v0.16.0
+        with:
+          image-registry-uri: quay.io
+          image-registry-username: stackable+robot_sdp_github_action_build
+          image-registry-password: ${{ secrets.QUAY_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
+          image-repository: stackable/sdp/${{ env.OPERATOR_NAME }}
+          image-manifest-tag: ${{ steps.build.outputs.image-manifest-tag }}
+          source-image-uri: ${{ steps.build.outputs.image-manifest-uri }}
+
   publish-index-manifest:
     name: Publish/Sign ${{ needs.build-container-image.outputs.operator-version }} Index
     if: |
@@ -196,21 +205,93 @@ jobs:
     permissions:
       id-token: write
     runs-on: ubuntu-latest
+    outputs:
+      oci-index-digest: ${{ steps.publish-oci.outputs.image-index-manifest-digest }}
+      quay-index-digest: ${{ steps.publish-quay.outputs.image-index-manifest-digest }}
     steps:
       - name: Checkout Repository
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
 
-      - name: Publish and Sign Image Index
-        uses: stackabletech/actions/publish-image-index-manifest@6a84fcfccf4ee37d85217407bc6a94742afbb45f # v0.14.2
+      - name: Publish and Sign Image Index to oci.stackable.tech
+        id: publish-oci
+        uses: stackabletech/actions/publish-image-index-manifest@a8af17a19bdcc3b5da0065f76e73827ba0c072ce # v0.16.0
         with:
           image-registry-uri: oci.stackable.tech
           image-registry-username: robot$sdp+github-action-build
           image-registry-password: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
           image-repository: sdp/${{ env.OPERATOR_NAME }}
           image-index-manifest-tag: ${{ needs.build-container-image.outputs.operator-version }}
 
+      - name: Publish and Sign Image Index to quay.io
+        id: publish-quay
+        uses: stackabletech/actions/publish-image-index-manifest@a8af17a19bdcc3b5da0065f76e73827ba0c072ce # v0.16.0
+        with:
+          image-registry-uri: quay.io
+          image-registry-username: stackable+robot_sdp_github_action_build
+          image-registry-password: ${{ secrets.QUAY_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
+          image-repository: stackable/sdp/${{ env.OPERATOR_NAME }}
+          image-index-manifest-tag: ${{ needs.build-container-image.outputs.operator-version }}
+
+  # Generate SLSA build provenance for the multi-arch image index and attach it
+  # to the published image in each registry. The reusable workflow signs the
+  # provenance with keyless signing (GitHub Actions as the OIDC identity) and
+  # pushes the attestation next to the image.
+  provenance-oci:
+    name: Generate Provenance for ${{ needs.build-container-image.outputs.operator-version }} (oci.stackable.tech)
+    if: |
+      (github.event_name != 'merge_group')
+      && needs.detect-changes.outputs.detected == 'true'
+      && !github.event.pull_request.head.repo.fork
+    needs:
+      - detect-changes
+      - build-container-image
+      - publish-index-manifest
+    permissions:
+      actions: read # detect the build workflow that generated the image
+      id-token: write # mint the OIDC token for keyless signing
+      packages: write # needed until https://github.com/slsa-framework/slsa-github-generator/issues/1257 is resolved
+    # MUST be referenced by a @vX.Y.Z tag (not a SHA), otherwise the reusable
+    # workflow cannot verify its own provenance.
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
+    with:
+      # The 'env' context is not available in job-level 'with' inputs of
+      # reusable workflow calls (unlike step-level 'with'), so OPERATOR_NAME
+      # can't be used here and the operator name is templated in directly.
+      image: oci.stackable.tech/sdp/nifi-operator
+      digest: ${{ needs.publish-index-manifest.outputs.oci-index-digest }}
+      registry-username: robot$sdp+github-action-build
+    secrets:
+      registry-password: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
+
+  provenance-quay:
+    name: Generate Provenance for ${{ needs.build-container-image.outputs.operator-version }} (quay.io)
+    if: |
+      (github.event_name != 'merge_group')
+      && needs.detect-changes.outputs.detected == 'true'
+      && !github.event.pull_request.head.repo.fork
+    needs:
+      - detect-changes
+      - build-container-image
+      - publish-index-manifest
+    permissions:
+      actions: read # detect the build workflow that generated the image
+      id-token: write # mint the OIDC token for keyless signing
+      packages: write # needed until https://github.com/slsa-framework/slsa-github-generator/issues/1257 is resolved
+    # MUST be referenced by a @vX.Y.Z tag (not a SHA), otherwise the reusable
+    # workflow cannot verify its own provenance.
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
+    with:
+      # The 'env' context is not available in job-level 'with' inputs of
+      # reusable workflow calls (unlike step-level 'with'), so OPERATOR_NAME
+      # can't be used here and the operator name is templated in directly.
+      image: quay.io/stackable/sdp/nifi-operator
+      digest: ${{ needs.publish-index-manifest.outputs.quay-index-digest }}
+      registry-username: stackable+robot_sdp_github_action_build
+    secrets:
+      registry-password: ${{ secrets.QUAY_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
+
   publish-helm-chart:
     name: Package/Publish ${{ needs.build-container-image.outputs.operator-version }} Helm Chart
     if: |
@@ -229,8 +310,8 @@ jobs:
           persist-credentials: false
           submodules: recursive
 
-      - name: Package, Publish, and Sign Helm Chart
-        uses: stackabletech/actions/publish-helm-chart@6a84fcfccf4ee37d85217407bc6a94742afbb45f # v0.14.2
+      - name: Package, Publish, and Sign Helm Chart to oci.stackable.tech
+        uses: stackabletech/actions/publish-helm-chart@a8af17a19bdcc3b5da0065f76e73827ba0c072ce # v0.16.0
         with:
           chart-registry-uri: oci.stackable.tech
           chart-registry-username: robot$sdp-charts+github-action-build
@@ -241,6 +322,19 @@ jobs:
           app-version: ${{ needs.build-container-image.outputs.operator-version }}
           publish-and-sign: ${{ !github.event.pull_request.head.repo.fork }}
 
+      - name: Package, Publish, and Sign Helm Chart to quay.io
+        uses: stackabletech/actions/publish-helm-chart@a8af17a19bdcc3b5da0065f76e73827ba0c072ce # v0.16.0
+        with:
+          chart-registry-uri: quay.io
+          chart-registry-username: stackable+robot_sdp_charts_github_action_build
+          chart-registry-password: ${{ secrets.QUAY_ROBOT_SDP_CHARTS_GITHUB_ACTION_BUILD_SECRET }}
+          chart-repository: stackable/sdp-charts
+          chart-directory: deploy/helm/${{ env.OPERATOR_NAME }}
+          chart-version: ${{ needs.build-container-image.outputs.operator-version }}
+          app-version: ${{ needs.build-container-image.outputs.operator-version }}
+          publish-and-sign: ${{ !github.event.pull_request.head.repo.fork }}
+          helm-version: v3.17.4 # This is currently the latest version which supports pushing to quay.io
+
   openshift-preflight-check:
     name: Run OpenShift Preflight Check for ${{ needs.build-container-image.outputs.operator-version }}-${{ matrix.arch }}
     if: |
@@ -259,12 +353,18 @@ jobs:
           - arm64
     runs-on: ubuntu-latest
     steps:
-      - name: Run OpenShift Preflight Check
-        uses: stackabletech/actions/run-openshift-preflight@6a84fcfccf4ee37d85217407bc6a94742afbb45f # v0.14.2
+      - name: Run OpenShift Preflight Check for oci.stackable.tech
+        uses: stackabletech/actions/run-openshift-preflight@a8af17a19bdcc3b5da0065f76e73827ba0c072ce # v0.16.0
         with:
           image-index-uri: oci.stackable.tech/sdp/${{ env.OPERATOR_NAME }}:${{ needs.build-container-image.outputs.operator-version }}
           image-architecture: ${{ matrix.arch }}
 
+      - name: Run OpenShift Preflight Check for quay.io
+        uses: stackabletech/actions/run-openshift-preflight@a8af17a19bdcc3b5da0065f76e73827ba0c072ce # v0.16.0
+        with:
+          image-index-uri: quay.io/stackable/sdp/${{ env.OPERATOR_NAME }}:${{ needs.build-container-image.outputs.operator-version }}
+          image-architecture: ${{ matrix.arch }}
+
   # This job is a required check in GitHub Settings for this repository.
   # It saves us having to list many required jobs, or work around dynamically
   # named jobs (since there is no concept of required settings).
@@ -291,6 +391,8 @@ jobs:
       - detect-changes
       - build-container-image
       - publish-index-manifest
+      - provenance-oci
+      - provenance-quay
       - publish-helm-chart
     runs-on: ubuntu-latest
     steps:
@@ -300,7 +402,7 @@ jobs:
           persist-credentials: false
 
       - name: Send Notification
-        uses: stackabletech/actions/send-slack-notification@6a84fcfccf4ee37d85217407bc6a94742afbb45f # v0.14.2
+        uses: stackabletech/actions/send-slack-notification@a8af17a19bdcc3b5da0065f76e73827ba0c072ce # v0.16.0
         with:
           publish-helm-chart-result: ${{ needs.publish-helm-chart.result }}
           publish-manifests-result: ${{ needs.publish-index-manifest.result }}

.github/workflows/integration-test.yml

@@ -23,6 +23,8 @@ on:
       test:
         description: Name of the test. Only used of test-mode is `custom`
 
+permissions: {}
+
 jobs:
   test:
     name: Run Integration Test
@@ -41,7 +43,7 @@ jobs:
       # TODO: Enable the scheduled runs which hard-code what profile to use
       - name: Run Integration Test
         id: test
-        uses: stackabletech/actions/run-integration-test@6a84fcfccf4ee37d85217407bc6a94742afbb45f # v0.14.2
+        uses: stackabletech/actions/run-integration-test@a8af17a19bdcc3b5da0065f76e73827ba0c072ce # v0.16.0
         with:
           replicated-api-token: ${{ secrets.REPLICATED_API_TOKEN }}
           test-mode-input: ${{ inputs.test-mode-input }}
@@ -51,7 +53,7 @@ jobs:
 
       - name: Send Notification
         if: ${{ failure() || github.run_attempt > 1 }}
-        uses: stackabletech/actions/send-slack-notification@6a84fcfccf4ee37d85217407bc6a94742afbb45f # v0.14.2
+        uses: stackabletech/actions/send-slack-notification@a8af17a19bdcc3b5da0065f76e73827ba0c072ce # v0.16.0
         with:
           slack-token: ${{ secrets.SLACK_INTEGRATION_TEST_TOKEN }}
           failed-tests: ${{ steps.test.outputs.failed-tests }}

.github/workflows/pr_pre-commit.yaml .github/workflows/pr_prek.yaml.github/workflows/pr_pre-commit.yaml renamed to .github/workflows/pr_prek.yaml

@@ -1,20 +1,21 @@
 ---
-name: pre-commit
+name: prek
 
 on:
   pull_request:
   merge_group:
 
+permissions: {}
+
 env:
   CARGO_TERM_COLOR: always
   NIX_PKG_MANAGER_VERSION: "2.33.3"
-  RUST_TOOLCHAIN_VERSION: "nightly-2026-02-24"
+  RUST_TOOLCHAIN_VERSION: "nightly-2026-07-01"
   HADOLINT_VERSION: "v2.14.0"
-  PYTHON_VERSION: "3.14"
   JINJA2_CLI_VERSION: "1.0.0"
 
 jobs:
-  pre-commit:
+  prek:
     runs-on: ubuntu-latest
     steps:
       - name: Install host dependencies
@@ -27,9 +28,8 @@ jobs:
           persist-credentials: false
           submodules: recursive
           fetch-depth: 0
-      - uses: stackabletech/actions/run-pre-commit@6a84fcfccf4ee37d85217407bc6a94742afbb45f # v0.14.2
+      - uses: stackabletech/actions/run-prek@a8af17a19bdcc3b5da0065f76e73827ba0c072ce # v0.16.0
         with:
-          python-version: ${{ env.PYTHON_VERSION }}
           rust: ${{ env.RUST_TOOLCHAIN_VERSION }}
           hadolint: ${{ env.HADOLINT_VERSION }}
           nix: ${{ env.NIX_PKG_MANAGER_VERSION }}

.pre-commit-config.yaml

@@ -15,7 +15,7 @@ repos:
       - id: detect-private-key
 
   - repo: https://github.com/EmbarkStudios/cargo-deny
-    rev: 8d76e7e991107da82c4a59cdc362a2739539f55d # 0.18.9
+    rev: 1c9ca2b643ee15722178c1350501aabb024dd6f3 # 0.19.9
     hooks:
       - id: cargo-deny
         args: ["--all-features", "check", "advisories", "bans", "licenses", "sources"]
@@ -27,7 +27,7 @@ repos:
         args: ["--strict"]
 
   - repo: https://github.com/igorshubovych/markdownlint-cli
-    rev: 192ad822316c3a22fb3d3cc8aa6eafa0b8488360 # 0.45.0
+    rev: a4d5d37e66ebcd6b3705204a1d6dbb56dea66338 # 0.49.0
     hooks:
       - id: markdownlint
         types: [text]
@@ -38,20 +38,24 @@ repos:
     hooks:
       - id: shellcheck
         args: ["--severity=info"]
+        # Temporarily needed until all getting_started.sh.j2 scripts are made non-executable.
+        # As long as they are, prek will treat them as shell scripts and so this hook will fail.
+        # pre-commit behaves differently apparently and doesn't pass .j2 files to this hook.
+        exclude: \.j2$
 
   # WARNING (@NickLarsenNZ): Nix users need to install ruff first.
   # If you do not, you will need to delete the cached ruff binary shown in the
   # error message
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: 3b4bc031619cde2e0a9f3c4441ac7cc8227245a4 # 0.14.1
+    rev: c59bba8fb259db0fec2bbb77ad8ba51ea7341b56 # 0.15.20
     hooks:
       # Run the linter.
       - id: ruff-check
       # Run the formatter.
       - id: ruff-format
 
   - repo: https://github.com/rhysd/actionlint
-    rev: e7d448ef7507c20fc4c88a95d0c448b848cd6127 # 1.7.8
+    rev: 914e7df21a07ef503a81201c76d2b11c789d3fca # 1.7.12
     hooks:
       - id: actionlint
 
@@ -105,7 +109,7 @@ repos:
       - id: cargo-rustfmt
         name: cargo-rustfmt
         language: system
-        entry: cargo +nightly-2026-02-24 fmt --all -- --check
+        entry: cargo +nightly-2026-07-01 fmt --all -- --check
         stages: [pre-commit, pre-merge-commit]
         pass_filenames: false
         files: \.rs$

.readme/partials/borrowed/overview_blurb.md.j2

@@ -1,2 +1,2 @@
 <!-- markdownlint-disable MD041 MD051 -->
-It is part of the Stackable Data Platform, a curated selection of the best open source data apps like Apache Kafka, Apache Druid, Trino or Apache Spark, [all](#other-operators) working together seamlessly. Based on Kubernetes, it runs everywhere – [on prem or in the cloud](#supported-platforms).
+It is part of the Stackable Data Platform, a curated selection of the best open source data apps like Apache Kafka®, OpenSearch, Trino or Apache Spark™, [all](#other-operators) working together seamlessly. Based on Kubernetes, it runs everywhere – [on prem or in the cloud](#supported-platforms).

.vscode/settings.json

@@ -1,7 +1,7 @@
 {
     "rust-analyzer.rustfmt.overrideCommand": [
         "rustfmt",
-        "+nightly-2026-02-24",
+        "+nightly-2026-07-01",
         "--edition",
         "2024",
         "--"

CHANGELOG.md

@@ -20,6 +20,8 @@ All notable changes to this project will be documented in this file.
 - Default `nifi.cluster.flow.election.max.wait.time` to NiFi's upstream value (`5 mins`) instead of the operator's previous `1 mins`. The operator no longer sets this property explicitly; the previous shorter value was left over from a TODO marked as "for testing" and may have caused flow election to settle on incomplete vote sets in cold-start scenarios ([#936]).
 - Set `nifi.content.repository.archive.max.retention.period` to `3 days` (previously empty, which NiFi interprets as `Long.MAX_VALUE` and effectively disables time-based archive purge). Without a time-based ceiling, the content archive can grow to half the content PVC and accumulate millions of files, which makes the synchronous startup directory scan in `FileSystemRepository.initializeRepository` very slow. Users requiring a longer content-replay window can extend via `configOverrides`. The provenance audit trail is independent of this setting and unaffected ([#936]).
 - test: Bump vector-aggregator to 0.55.0, replace /graphql call with gRPC call ([#940]).
+- BREAKING: Removed product-config machinery. This is a breaking change in terms of configuration.
+  Users relying on the product-config `properties.yaml` file have to set these properties via the CRD ([#945]).
 
 ### Fixed
 
@@ -34,6 +36,7 @@ All notable changes to this project will be documented in this file.
 [#935]: https://github.com/stackabletech/nifi-operator/pull/935
 [#936]: https://github.com/stackabletech/nifi-operator/pull/936
 [#940]: https://github.com/stackabletech/nifi-operator/pull/940
+[#945]: https://github.com/stackabletech/nifi-operator/pull/945
 
 ## [26.3.0] - 2026-03-16