Bunch of documentation updates

Author: sbernauer

CHANGELOG.md

@@ -30,6 +30,12 @@ All notable changes to this project will be documented in this file.
 
 - Fix broken link to the NiFi authorization usage guide in the `spec.clusterConfig.authorization` CRD doc (`usage-guide` -> `usage_guide`) ([#924]).
 
+### Removed
+
+- BREAKING: Remove support for NiFi 1.x.
+  This removes the Prometheus reporting-task Job (and its `spec.clusterConfig.createReportingTaskJob` field), the pre-2.x non-rolling upgrade handling, the dedicated metrics port, and the sensitive-properties algorithms that were only supported on NiFi 1.x.
+  `status.deployed_version` is retained even though it no longer drives the (now removed) non-rolling upgrade state machine, as we don't want a breaking change to the status just for this ([#954]).
+
 [#903]: https://github.com/stackabletech/nifi-operator/pull/903
 [#916]: https://github.com/stackabletech/nifi-operator/pull/916
 [#921]: https://github.com/stackabletech/nifi-operator/pull/921
@@ -41,6 +47,7 @@ All notable changes to this project will be documented in this file.
 [#940]: https://github.com/stackabletech/nifi-operator/pull/940
 [#945]: https://github.com/stackabletech/nifi-operator/pull/945
 [#953]: https://github.com/stackabletech/nifi-operator/pull/953
+[#954]: https://github.com/stackabletech/nifi-operator/pull/954
 [#959]: https://github.com/stackabletech/nifi-operator/pull/959
 
 ## [26.3.0] - 2026-03-16

deploy/helm/nifi-operator/templates/clusterrole-operator.yaml

@@ -81,17 +81,6 @@ rules:
       - list
       - patch
       - watch
-  # Optional reporting-task Job (NiFi 1.x only). Applied via SSA and tracked for orphan cleanup.
-  - apiGroups:
-      - batch
-    resources:
-      - jobs
-    verbs:
-      - create
-      - delete
-      - get
-      - list
-      - patch
   # PodDisruptionBudget created per role. Applied via SSA and tracked for orphan cleanup.
   - apiGroups:
       - policy

docs/modules/nifi/pages/index.adoc

@@ -35,7 +35,8 @@ Every role group is accessible through it's own Service, and there is a Service
 
 == Dependencies
 
-Apache NiFi 1.x depends on Apache ZooKeeper which you can run in Kubernetes with the xref:zookeeper:index.adoc[].
+NiFi builds its cluster quorum using Kubernetes by default and needs no additional dependencies.
+It can optionally use Apache ZooKeeper instead, which you can run in Kubernetes with the xref:zookeeper:index.adoc[].
 
 == [[demos]]Demos
 

docs/modules/nifi/pages/usage_guide/clustering.adoc

@@ -14,8 +14,6 @@ CAUTION: The cluster backend of an existing cluster should never be changed. Oth
 [#backend-kubernetes]
 == Kubernetes
 
-NOTE: The Kubernetes provider is only supported by Apache NiFi 2.0 or newer. When using NiFi 1.x, use the xref:#backend-zookeeper[] backend instead.
-
 The Kubernetes backend is used by default (unless the xref:#backend-zookeeper[] backend is configured), and stores all state in Kubernetes objects, in the same namespace as the `NifiCluster` object.
 
 It takes no configuration.

docs/modules/nifi/pages/usage_guide/custom-components.adoc

@@ -12,7 +12,7 @@ There are currently two types of custom components:
 
 1. Custom NiFi Archives (NARs) +
    The {nifi-docs-developers-guide}[NiFi Developer’s Guide] provides further information on how to develop custom NARs.
-2. Starting with NiFi 2.0, also custom Python extensions can be used. +
+2. Additionally, custom Python extensions can be used. +
    In the {nifi-docs-python-developers-guide}[NiFi Python Developer’s Guide], the development of custom components using Python is described.
 
 The Stackable image contains the required tooling for both types.
@@ -165,7 +165,7 @@ metadata:
   name: simple-nifi
 spec:
   image:
-    productVersion: 2.2.0
+    productVersion: 2.9.0
   clusterConfig:
     authentication:
     - authenticationClass: simple-nifi-admin-user
@@ -202,7 +202,7 @@ The basic Dockerfile below shows how to achieve this:
 
 [source,Dockerfile]
 ----
-FROM oci.stackable.tech/sdp/nifi:2.2.0-stackable25.3.0
+FROM oci.stackable.tech/sdp/nifi:2.9.0-stackable26.7.0
 COPY /path/to/your/nar.file /stackable/nifi/lib/
 COPY /path/to/your/Python.file /stackable/nifi/python/extensions/
 ----
@@ -213,8 +213,8 @@ You then need to make this image available to your Kubernetes cluster and specif
 ----
 spec:
   image:
-    productVersion: 2.2.0
-    custom: oci-registry.company.org/nifi:2.2.0-customprocessors
+    productVersion: 2.9.0
+    custom: oci-registry.company.org/nifi:2.9.0-customprocessors
 ----
 
 Also read the xref:guides:custom-images.adoc[Using customized product images] guide for additional information.
@@ -285,7 +285,7 @@ metadata:
   name: simple-nifi
 spec:
   image:
-    productVersion: 2.2.0
+    productVersion: 2.9.0
   clusterConfig:
     authentication:
     - authenticationClass: simple-nifi-admin-user

docs/modules/nifi/pages/usage_guide/flow-versioning.adoc

@@ -1,8 +1,7 @@
 = Flow Versioning
 
-IMPORTANT: The way described in this document to version flows is only available in NiFi 2.0.0 and later versions. Previous versions of NiFi relied exclusively on the NiFi Registry service for flow versioning.
-
-Starting with Apache NiFi 2.0.0, you can connect directly to Git repositories using either GitHub or GitLab as your flow registry without requiring a separate NiFi Registry service. This document explains how to configure and use these registry clients to version your NiFi flows.
+You can connect directly to Git repositories using either GitHub or GitLab as your flow registry without requiring a separate NiFi Registry service.
+This document explains how to configure and use these registry clients to version your NiFi flows.
 
 == Setting up the Registry Client
 

docs/modules/nifi/pages/usage_guide/monitoring.adoc

@@ -1,42 +1,10 @@
 = Monitoring
 :description: The Stackable Operator for Apache NiFi automatically configures NiFi to export Prometheus metrics.
-:k8s-job: https://kubernetes.io/docs/concepts/workloads/controllers/job/
-:k8s-network-policies: https://kubernetes.io/docs/concepts/services-networking/network-policies/
 :prometheus-operator: https://prometheus-operator.dev/
 
-In November 2024, Apache NiFi released a new major version https://cwiki.apache.org/confluence/display/NIFI/Release+Notes#ReleaseNotes-Version2.0.0[`2.0.0`,window=_blank].
+== Configure metrics
 
-The NiFi `2.0.0` release changed the way of exposing Prometheus metrics significantly.
-The following steps explain on how to expose Metrics in NiFi versions `1.x.x` and `2.x.x`.
-
-== Configure metrics in NiFi `1.x.x`
-
-For NiFi versions `1.x.x`, the operator automatically configures NiFi to export Prometheus metrics.
-This is done by creating a {k8s-job}[Job,window=_blank] that connects to NiFi and configures a https://nifi.apache.org/docs/nifi-docs/components/org.apache.nifi/nifi-prometheus-nar/1.26.0/org.apache.nifi.reporting.prometheus.PrometheusReportingTask/index.html[Prometheus Reporting Task,window=_blank].
-
-IMPORTANT: Network access from the Job to NiFi is required.
-If you are running a Kubernetes with restrictive {k8s-network-policies}[NetworkPolicies,window=_blank], make sure to allow access from the Job to NiFi.
-
-See xref:operators:monitoring.adoc[] for more details.
-
-== Disabling create-reporting-task Job
-
-It can be helpful to disable the Job, e.g. when you configOverride an authentication mechanism, which the Job currently cannot use to authenticate against NiFi.
-
-To achieve this use the following configuration:
-
-[source,yaml]
-----
-spec:
-  clusterConfig:
-    createReportingTaskJob:
-      enabled: false
-----
-
-== Configure metrics in NiFi `2.x.x`
-
-The Prometheus Reporting Task was removed in NiFi `2.x.x` in https://issues.apache.org/jira/browse/NIFI-13507[NIFI-13507,window=_blank].
-Metrics are now always exposed and can be scraped using the NiFi `metrics` Service and the HTTP path `/nifi-api/flow/metrics/prometheus`.
+Metrics are always exposed and can be scraped using the NiFi `metrics` Service and the HTTP path `/nifi-api/flow/metrics/prometheus`.
 
 For a deployed NiFi cluster called `simple-nifi`, containing a rolegroup called `default`, the metrics endpoint is reachable under:
 
@@ -49,9 +17,9 @@ To scrape metrics from a particular Pod, the FQDN of the Pod and the `headless`
 
 IMPORTANT: If NiFi is configured to do any user authentication, requests to the metrics endpoint must be authenticated and authorized.
 
-=== Authentication with NiFi `2.x.x`
+=== Authentication with NiFi
 
-To authenticate against the NiFi `2.x.x` API, you can configure mTLS between NiFi and the client calling NiFi. For more information about authentication between
+To authenticate against the NiFi API, you can configure mTLS between NiFi and the client calling NiFi. For more information about authentication between
 Kubernetes Pods, check out the xref:home:secret-operator:index.adoc[Secret Operator documentation].
 
 The following example illustrates the configuration of a Prometheus scraper for NiFi, using the aforementioned method of configuring mTLS

docs/modules/nifi/pages/usage_guide/overrides.adoc

@@ -94,25 +94,6 @@ Pod overrides allow you to configure any attributes that can be configured on a
 
 Read the xref:concepts:overrides.adoc#pod-overrides[Pod overrides concepts page] to learn more.
 
-=== Pod overrides on create-reporting-task Job
-
-In addition to podOverrides on the created StatefulSet we also support podOverrides on the created Kubernetes Job, which enables the export of Prometheus metrics within NiFi.
-
-[source,yaml]
-----
-spec:
-  clusterConfig:
-    createReportingTaskJob:
-      # enabled: false # You can also turn off the Job entirely
-      podOverrides: # podOverrides as usual
-        spec:
-          tolerations:
-            - key: "key1"
-              operator: "Equal"
-              value: "value1"
-              effect: "NoSchedule"
-----
-
 == JVM argument overrides
 
 Stackable operators automatically determine the set of needed JVM arguments, such as memory settings or trust- and keystores.

docs/modules/nifi/pages/usage_guide/updating.adoc

@@ -17,16 +17,4 @@ spec:
 
 <1> Change the NiFi version here
 
-[WARNING]
-====
-NiFi clusters cannot be upgraded or downgraded in a rolling fashion due to a limitation in NiFi prior to version 2.
-
-When upgrading between NiFi 1 versions or from NiFi 1 to NiFi 2, any change to the NiFi version in the CRD triggers a full cluster restart with brief downtime.
-However, the Stackable image version can be updated in a rolling manner, provided the NiFi version remains unchanged.
-
-Since NiFi version 2, rolling upgrades are supported.
-====
-
-== NiFi 2.0.0
-
-Before you can upgrade to `2.0.0` you https://cwiki.apache.org/confluence/display/NIFI/Migration+Guidance[need to update] to at least version 1.27.x!
+Rolling upgrades are supported, so changing the NiFi version in the CRD updates the cluster without downtime.