chore: Merge branch 'main' into feat/versioned-kube-override

Author: Techassi

Cargo.lock

@@ -29,6 +29,7 @@ either = "1.13.0"
 futures = "0.3.30"
 futures-util = "0.3.30"
 http = "1.3.1"
+humantime = "2.1.0"
 indexmap = "2.5.0"
 indoc = "2.0.6"
 jiff = "0.2.18"

Cargo.toml

@@ -23,7 +23,7 @@
 //!
 //! ### Constructing
 //!
-//! Alternatively, they can be constructed programatically using the
+//! Alternatively, they can be constructed programmatically using the
 //! [`ApiVersion::new()`] and [`ApiVersion::try_new()`] functions.
 //!
 //! ```

crates/k8s-version/src/lib.rs

@@ -14,7 +14,7 @@ All notable changes to this project will be documented in this file.
 
 - BREAKING: The functions `generate_leaf_certificate`, `generate_rsa_leaf_certificate` and
   `generate_ecdsa_leaf_certificate` of `CertificateAuthority` accept an additional parameter
-  `subject_alterative_dns_names` ([#1057]).
+  `subject_alternative_dns_names` ([#1057]).
   - The passed SANs are added to the generated certificate, this is needed when the HTTPS server is
     accessible on multiple DNS names and/or IPs.
   - Pass an empty list (`[]`) to keep the existing behavior.

crates/stackable-certs/CHANGELOG.md

@@ -163,7 +163,7 @@ where
 }
 
 /// A certificate authority (CA) which is used to generate and sign
-/// intermidiate or leaf certificates.
+/// intermediate or leaf certificates.
 #[derive(Debug)]
 pub struct CertificateAuthority<S>
 where
@@ -298,7 +298,7 @@ where
         key_pair: T,
         name: &str,
         scope: &str,
-        subject_alterative_dns_names: impl IntoIterator<Item = &'a str> + Debug,
+        subject_alternative_dns_names: impl IntoIterator<Item = &'a str> + Debug,
         validity: Duration,
     ) -> Result<CertificatePair<T>>
     where
@@ -353,7 +353,7 @@ where
             ]))
             .context(AddCertificateExtensionSnafu)?;
 
-        let sans = subject_alterative_dns_names
+        let sans = subject_alternative_dns_names
             .into_iter()
             .map(|dns_name| {
                 let ia5_dns_name =
@@ -385,11 +385,11 @@ where
         &mut self,
         name: &str,
         scope: &str,
-        subject_alterative_dns_names: impl IntoIterator<Item = &'a str> + Debug,
+        subject_alternative_dns_names: impl IntoIterator<Item = &'a str> + Debug,
         validity: Duration,
     ) -> Result<CertificatePair<rsa::SigningKey>> {
         let key = rsa::SigningKey::new().context(GenerateRsaSigningKeySnafu)?;
-        self.generate_leaf_certificate(key, name, scope, subject_alterative_dns_names, validity)
+        self.generate_leaf_certificate(key, name, scope, subject_alternative_dns_names, validity)
     }
 
     /// Generates an ECDSAasync -based leaf certificate which is signed by this CA.
@@ -401,11 +401,11 @@ where
         &mut self,
         name: &str,
         scope: &str,
-        subject_alterative_dns_names: impl IntoIterator<Item = &'a str> + Debug,
+        subject_alternative_dns_names: impl IntoIterator<Item = &'a str> + Debug,
         validity: Duration,
     ) -> Result<CertificatePair<ecdsa::SigningKey>> {
         let key = ecdsa::SigningKey::new().context(GenerateEcdsaSigningKeySnafu)?;
-        self.generate_leaf_certificate(key, name, scope, subject_alterative_dns_names, validity)
+        self.generate_leaf_certificate(key, name, scope, subject_alternative_dns_names, validity)
     }
 
     /// Create a [`CertificateAuthority`] from a Kubernetes [`Secret`].

crates/stackable-certs/src/ca/mod.rs

@@ -43,7 +43,7 @@ pub enum CertificatePairError<E>
 where
     E: std::error::Error + 'static,
 {
-    #[snafu(display("failed to seralize certificate as {key_encoding}"))]
+    #[snafu(display("failed to serialize certificate as {key_encoding}"))]
     SerializeCertificate {
         source: x509_cert::der::Error,
         key_encoding: KeyEncoding,

crates/stackable-certs/src/lib.rs

@@ -4,6 +4,22 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+### Added
+
+- Git sync: add support for CAs ([#1154]).
+- Add support for specifying a `clientAuthenticationMethod` for OIDC ([#1178]).
+  This was originally done in [#1158] and had been reverted in [#1170].
+- Implement `Deref` for `kvp::Key` to be more ergonomic to use ([#1182]).
+
+### Removed
+
+- BREAKING: Remove unused `add_prefix`, `try_add_prefix`, `set_name`, and `try_set_name` associated
+  functions from `kvp::Key` to disallow mutable access to inner values ([#1182]).
+
+[#1154]: https://github.com/stackabletech/operator-rs/pull/1154
+[#1178]: https://github.com/stackabletech/operator-rs/pull/1178
+[#1182]: https://github.com/stackabletech/operator-rs/pull/1182
+
 ## [0.108.0] - 2026-03-10
 
 ### Removed
@@ -1494,7 +1510,7 @@ Only rust documentation was changed.
 - status::condition module to compute the cluster resource status ([#571]).
 - Helper function to build RBAC resources ([#572]).
 - Add `ClusterResourceApplyStrategy` to `ClusterResource` ([#573]).
-- Add `ClusterOperation` common struct with `reconcilation_paused` and `stopped` flags ([#573]).
+- Add `ClusterOperation` common struct with `reconciliation_paused` and `stopped` flags ([#573]).
 
 [#571]: https://github.com/stackabletech/operator-rs/pull/571
 [#572]: https://github.com/stackabletech/operator-rs/pull/572
@@ -1839,7 +1855,7 @@ This is a rerelease of 0.25.1 which some last-minute incompatible API changes to
 
 ### Changed
 
-- BREAKING: Removed `commons::s3::S3ConnectionImplementation`. `commons::s3::InlinedBucketSpec::endpoint()` doesn't take arguments since the protocol decision is now based on the existance of TLS configuration ([#390]).
+- BREAKING: Removed `commons::s3::S3ConnectionImplementation`. `commons::s3::InlinedBucketSpec::endpoint()` doesn't take arguments since the protocol decision is now based on the existence of TLS configuration ([#390]).
 - BREAKING: Changes to resource requirements structs to enable deep merging ([#392])
   - Changed fields in `Resources` to no longer be optional
   - Changed atomic fields in `MemoryLimits`, `JvmHeapLimits`, `CpuLimits` and `PvcConfig` to be optional
@@ -1875,7 +1891,7 @@ This is a rerelease of 0.25.1 which some last-minute incompatible API changes to
 ### Added
 
 - Export logs to Jaeger ([#360]).
-- Added common datastructures shared between all operators like `Tls` oder `AuthenticationClass` ([#366]).
+- Added common datastructures shared between all operators like `Tls` or `AuthenticationClass` ([#366]).
 - Added helpers for env variables from Secrets or ConfigMaps ([#370]).
 
 ### Changed
@@ -2089,7 +2105,7 @@ This is a rerelease of 0.25.1 which some last-minute incompatible API changes to
 ### Changed
 
 - BREAKING: In builder: `add_stackable_agent_tolerations` to `add_tolerations` ([#255]).
-- Generic `VALUE` paramters to `impl Into<_>` arguments for consistency ([#253]).
+- Generic `VALUE` parameters to `impl Into<_>` arguments for consistency ([#253]).
 
 ### Removed
 

crates/stackable-operator/CHANGELOG.md

@@ -30,6 +30,16 @@ spec:
                     description: This field contains OIDC-specific configuration. It is only required in case OIDC is used.
                     nullable: true
                     properties:
+                      clientAuthenticationMethod:
+                        default: client_secret_basic
+                        description: 'The client authentication method used when communicating with the token endpoint. Defaults to `client_secret_basic`. The required contents of `clientCredentialsSecret` depend on the chosen method: secret-based methods (`client_secret_basic`, `client_secret_post`, `client_secret_jwt`) expect a client secret, while `private_key_jwt` expects a private key.'
+                        enum:
+                        - client_secret_basic
+                        - client_secret_post
+                        - client_secret_jwt
+                        - private_key_jwt
+                        - none
+                        type: string
                       clientCredentialsSecret:
                         description: |-
                           A reference to the OIDC client credentials secret. The secret contains
@@ -142,6 +152,56 @@ spec:
                     description: 'The git repository URL that will be cloned, for example: `https://github.com/stackabletech/airflow-operator` or `ssh://git@github.com:stackable-airflow/dags.git`.'
                     format: uri
                     type: string
+                  tls:
+                    default:
+                      verification:
+                        server:
+                          caCert:
+                            webPki: {}
+                    description: Configure a TLS connection. If not specified it will default to webPki validation.
+                    nullable: true
+                    properties:
+                      verification:
+                        description: The verification method used to verify the certificates of the server and/or the client.
+                        oneOf:
+                        - required:
+                          - none
+                        - required:
+                          - server
+                        properties:
+                          none:
+                            description: Use TLS but don't verify certificates.
+                            type: object
+                          server:
+                            description: Use TLS and a CA certificate to verify the server.
+                            properties:
+                              caCert:
+                                description: CA cert to verify the server.
+                                oneOf:
+                                - required:
+                                  - webPki
+                                - required:
+                                  - secretClass
+                                properties:
+                                  secretClass:
+                                    description: |-
+                                      Name of the [SecretClass](https://docs.stackable.tech/home/nightly/secret-operator/secretclass) which will provide the CA certificate.
+                                      Note that a SecretClass does not need to have a key but can also work with just a CA certificate,
+                                      so if you got provided with a CA cert but don't have access to the key you can still use this method.
+                                    type: string
+                                  webPki:
+                                    description: |-
+                                      Use TLS and the CA certificates trusted by the common web browsers to verify the server.
+                                      This can be useful when you e.g. use public AWS S3 or other public available services.
+                                    type: object
+                                type: object
+                            required:
+                            - caCert
+                            type: object
+                        type: object
+                    required:
+                    - verification
+                    type: object
                   wait:
                     default: 20s
                     description: |-
@@ -587,7 +647,7 @@ spec:
                                 type: object
                             type: object
                           enableVectorAgent:
-                            description: Wether or not to deploy a container with the Vector log agent.
+                            description: Whether or not to deploy a container with the Vector log agent.
                             nullable: true
                             type: boolean
                         type: object
@@ -1199,7 +1259,7 @@ spec:
                                       type: object
                                   type: object
                                 enableVectorAgent:
-                                  description: Wether or not to deploy a container with the Vector log agent.
+                                  description: Whether or not to deploy a container with the Vector log agent.
                                   nullable: true
                                   type: boolean
                               type: object

crates/stackable-operator/crds/DummyCluster.yaml

@@ -45,7 +45,7 @@ pub enum Error {
 pub struct PodDisruptionBudgetBuilder<ObjectMeta, LabelSelector, PodDisruptionBudgetConstraint> {
     metadata: ObjectMeta,
     selector: LabelSelector,
-    /// Tracks wether either `maxUnavailable` or `minAvailable` is set.
+    /// Tracks whether either `maxUnavailable` or `minAvailable` is set.
     constraint: Option<PodDisruptionBudgetConstraint>,
 }
 

crates/stackable-operator/src/builder/pdb.rs

@@ -667,7 +667,7 @@ mod tests {
             .build()
     }
 
-    /// A [`PodBuilder`] that already contains the minum setup to build a Pod (name and container).
+    /// A [`PodBuilder`] that already contains the minimum setup to build a Pod (name and container).
     #[fixture]
     fn pod_builder_with_name_and_container(dummy_container: Container) -> PodBuilder {
         let mut builder = PodBuilder::new();