Skip to content

Commit 6a8b770

Browse files
sbernauersbernauer
committed
Merge remote-tracking branch 'origin/main' into chore/security-context-stackable-defaults
2 parents 8e27a99 + 310758d commit 6a8b770

93 files changed

Lines changed: 6635 additions & 556 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎Cargo.lock‎

Lines changed: 436 additions & 430 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Cargo.toml‎

Lines changed: 30 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,9 @@ axum = { version = "0.8.1", features = ["http2"] }
1717
base64 = "0.22"
1818
clap = { version = "4.5.17", features = ["derive", "cargo", "env"] }
1919
const_format = "0.2.33"
20-
# Cannot be updated until x509-cert uses a newer version
20+
# Pinned to the old RustCrypto generation: const-oid 0.10 requires x509-cert 0.3,
21+
# which is not released yet. Tracking: https://github.com/RustCrypto/formats/issues/1289
22+
# See also the rand/rand_core and sha2/signature pins below.
2123
const-oid = { version = "0.9.6", features = ["db"] }
2224
convert_case = "0.11.0"
2325
convert_case_extras = "0.2.0"
@@ -34,30 +36,34 @@ humantime = "2.1.0"
3436
indexmap = "2.5.0"
3537
indoc = "2.0.6"
3638
jiff = "0.2.18"
37-
insta = { version = "1.40", features = ["glob"] }
39+
insta = { version = "1.48.0", features = ["glob"] }
3840
hyper = { version = "1.4.1", features = ["full"] }
3941
hyper-util = "0.1.8"
40-
itertools = "0.14.0"
42+
itertools = "0.15.0"
43+
java-properties = "2.0"
4144
json-patch = "4.0.0"
42-
k8s-openapi = { version = "0.27.0", default-features = false, features = ["schemars", "v1_35"] }
45+
k8s-openapi = { version = "0.28.0", default-features = false, features = ["schemars", "v1_36"] }
4346
# We use rustls instead of openssl for easier portability, e.g. so that we can build stackablectl without the need to vendor (build from source) openssl
4447
# We use ring instead of aws-lc-rs, as this currently fails to build in "make run-dev"
45-
kube = { version = "3.1.0", default-features = false, features = ["client", "jsonpatch", "runtime", "derive", "admission", "rustls-tls", "ring"] }
46-
opentelemetry = "0.31.0"
47-
opentelemetry_sdk = { version = "0.31.0", features = ["rt-tokio"] }
48-
opentelemetry-appender-tracing = "0.31.0"
49-
opentelemetry-otlp = "0.31.0"
50-
opentelemetry-semantic-conventions = "0.31.0"
48+
kube = { version = "4.0.0", default-features = false, features = ["client", "jsonpatch", "runtime", "derive", "admission", "rustls-tls", "ring"] }
49+
opentelemetry = "0.32.0"
50+
opentelemetry_sdk = { version = "0.32.0", features = ["rt-tokio"] }
51+
opentelemetry-appender-tracing = "0.32.0"
52+
opentelemetry-otlp = "0.32.0"
53+
opentelemetry-semantic-conventions = "0.32.0"
5154
p256 = { version = "0.13.2", features = ["ecdsa"] }
5255
paste = "1.0.15"
5356
pin-project = "1.1.5"
5457
prettyplease = "0.2.22"
5558
proc-macro2 = "1.0.86"
5659
quote = "1.0.37"
57-
# Cannot be updated until x509-cert uses a newer version
60+
# Pinned to the old RustCrypto generation: rand_core 0.9+ (and the matching rand) pulls
61+
# in the new digest/signature ecosystem that rsa 0.9 and x509-cert 0.2 do not support yet.
62+
# Bumping splits the graph into duplicate, incompatible crate versions.
63+
# Unblocked once rsa 0.10 (currently in RC) lands: https://github.com/RustCrypto/RSA
5864
rand = "0.9.0"
5965
rand_core = "0.6.4"
60-
regex = "1.10.6"
66+
regex = "1.12.4"
6167
rsa = { version = "0.9.6", features = ["sha2"] }
6268
rstest = "0.26.1"
6369
rstest_reuse = "0.7.0"
@@ -66,28 +72,34 @@ semver = "1.0.23"
6672
serde = { version = "1.0.210", features = ["derive"] }
6773
serde_json = "1.0.128"
6874
serde_yaml = "0.9.34" # This is the last available version, see https://github.com/dtolnay/serde-yaml/releases/tag/0.9.34 for details
75+
# Pinned to the old RustCrypto generation (digest 0.10 / signature 2.x): sha2 0.11 uses
76+
# digest 0.11 and signature 3.0, which rsa 0.9 and x509-cert 0.2 do not support yet.
77+
# Unblocked once rsa 0.10 (currently in RC) lands: https://github.com/RustCrypto/RSA
6978
sha2 = { version = "0.10.8", features = ["oid"] }
7079
signature = "2.2.0"
71-
snafu = "0.9.0"
80+
snafu = "0.9.1"
7281
stackable-operator-derive = { path = "stackable-operator-derive" }
7382
strum = { version = "0.28.0", features = ["derive"] }
74-
syn = "2.0.77"
83+
syn = "2.0.118"
7584
tempfile = "3.12.0"
76-
time = { version = "0.3.36" }
85+
time = { version = "0.3.49" }
7786
tokio = { version = "1.40.0", features = ["macros", "rt-multi-thread", "fs"] }
7887
# We use ring instead of aws-lc-rs, as this currently fails to build in "make run-dev"
7988
tokio-rustls = { version = "0.26.0", default-features = false, features = ["ring", "logging", "tls12"] }
8089
tokio-test = "0.4.4"
8190
tower = { version = "0.5.1", features = ["util"] }
82-
tower-http = { version = "0.6.1", features = ["trace"] }
91+
tower-http = { version = "0.7.0", features = ["trace"] } # We don't actually use this crate, but we need to enable the `trace` feature
8392
tracing = "0.1.40"
8493
tracing-appender = "0.2.3"
85-
tracing-opentelemetry = "0.32.0"
94+
tracing-opentelemetry = "0.33.0"
8695
tracing-subscriber = { version = "0.3.18", features = ["env-filter", "json"] }
8796
trybuild = "1.0.99"
8897
url = { version = "2.5.2", features = ["serde"] }
98+
uuid = "1.23.0"
99+
winnow = "1.0.3"
89100
x509-cert = { version = "0.2.5", features = ["builder"] }
90-
zeroize = "1.8.1"
101+
xml = "1.3.0"
102+
zeroize = "1.9.0"
91103

92104
[workspace.lints.clippy]
93105
# Enable all pedantic lints (with lower priority so individual lints can override)

‎crates/k8s-version/src/level/mod.rs‎

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -47,22 +47,18 @@ pub enum Level {
4747
impl FromStr for Level {
4848
type Err = ParseLevelError;
4949

50-
// SAFETY: We purposefully allow the `clippy::unwrap_in_result` lint below in this function.
51-
// We can use expect here, because the correct match labels must be used.
52-
//
53-
// FIXME (@Techassi): This attribute can be used on individual unwrap and expect calls since
54-
// Rust 1.91.0. We should move this attribute to not contaminate an unnecessarily large scope
55-
// once we bump the toolchain to 1.91.0.
56-
// See https://github.com/rust-lang/rust-clippy/pull/15445
57-
#[allow(clippy::unwrap_in_result)]
5850
fn from_str(input: &str) -> Result<Self, Self::Err> {
5951
let captures = LEVEL_REGEX.captures(input).context(InvalidFormatSnafu)?;
6052

53+
// SAFETY: We purposefully allow the `clippy::unwrap_in_result` lint here and below.
54+
// We can use expect here, because the correct match labels must be used.
55+
#[allow(clippy::unwrap_in_result)]
6156
let identifier = captures
6257
.name("identifier")
6358
.expect("internal error: check that the correct match label is specified")
6459
.as_str();
6560

61+
#[allow(clippy::unwrap_in_result)]
6662
let version = captures
6763
.name("version")
6864
.expect("internal error: check that the correct match label is specified")

‎crates/k8s-version/src/version/mod.rs‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -53,17 +53,13 @@ pub struct Version {
5353
impl FromStr for Version {
5454
type Err = ParseVersionError;
5555

56-
// SAFETY: We purposefully allow the `clippy::unwrap_in_result` lint below in this function.
57-
// We can use expect here, because the correct match label must be used.
58-
//
59-
// FIXME (@Techassi): This attribute can be used on individual unwrap and expect calls since
60-
// Rust 1.91.0. We should move this attribute to not contaminate an unnecessarily large scope
61-
// once we bump the toolchain to 1.91.0.
62-
// See https://github.com/rust-lang/rust-clippy/pull/15445
6356
#[allow(clippy::unwrap_in_result)]
6457
fn from_str(input: &str) -> Result<Self, Self::Err> {
6558
let captures = VERSION_REGEX.captures(input).context(InvalidFormatSnafu)?;
6659

60+
// SAFETY: We purposefully allow the `clippy::unwrap_in_result` lint below.
61+
// We can use expect here, because the correct match label must be used.
62+
#[allow(clippy::unwrap_in_result)]
6763
let major = captures
6864
.name("major")
6965
.expect("internal error: check that the correct match label is specified")

‎crates/stackable-certs/src/ca/mod.rs‎

Lines changed: 4 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -205,16 +205,6 @@ where
205205
/// validity, this function offers complete control over these parameters.
206206
/// If this level of control is not needed, use [`CertificateAuthority::new`]
207207
/// instead.
208-
//
209-
// SAFETY: We purposefully allow the `clippy::unwrap_in_result` lint below in this function.
210-
// We can use expect here, because the subject name is defined as a constant which must be able
211-
// to be parsed.
212-
//
213-
// FIXME (@Techassi): This attribute can be used on individual unwrap and expect calls since
214-
// Rust 1.91.0. We should move this attribute to not contaminate an unnecessarily large scope
215-
// once we bump the toolchain to 1.91.0.
216-
// See https://github.com/rust-lang/rust-clippy/pull/15445
217-
#[allow(clippy::unwrap_in_result)]
218208
#[instrument(name = "create_certificate_authority_with", skip(signing_key_pair))]
219209
pub fn new_with(signing_key_pair: S, serial_number: u64, validity: Duration) -> Result<Self> {
220210
let serial_number = SerialNumber::from(serial_number);
@@ -223,6 +213,10 @@ where
223213
// We don't allow customization of the CA subject by callers. Every CA
224214
// created by us should contain the same subject consisting a common set
225215
// of distinguished names (DNs).
216+
// SAFETY: We purposefully allow the `clippy::unwrap_in_result` lint below.
217+
// We can use expect here, because the subject name is defined as a constant which must be
218+
// able to be parsed.
219+
#[allow(clippy::unwrap_in_result)]
226220
let subject = Name::from_str(SDP_ROOT_CA_SUBJECT)
227221
.expect("the constant SDP_ROOT_CA_SUBJECT must be a valid subject");
228222

‎crates/stackable-operator/CHANGELOG.md‎

Lines changed: 38 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,47 @@ All notable changes to this project will be documented in this file.
66

77
### Changed
88

9-
- BREAKING: `PodSecurityContextBuilder::new` was removed in favor of `PodSecurityContextBuilder::with_stackable_defaults`.
9+
- BREAKING: `PodSecurityContextBuilder::new` was removed in favor of `PodSecurityContextBuilder::with_stackable_defaults` ([#XXXX]).
1010
This function already sets up some defaults we want to use across the platform.
11-
- BREAKING: `PodSecurityContextBuilder::run_as_non_root` now takes a `bool` instead of assuming consumers always want to set it to `true`.
11+
- BREAKING: `PodSecurityContextBuilder::run_as_non_root` now takes a `bool` instead of assuming consumers always want to set it to `true` ([#XXXX]).
1212
This is needed to allow users setting it to `false` in case the new `with_stackable_defaults` functions set's it to `true`.
1313

14+
[#XXXX]: https://github.com/stackabletech/operator-rs/pull/XXXX
15+
16+
## [0.113.0] - 2026-06-22
17+
18+
### Added
19+
20+
- Add documentation for the `roleGroups` field, which now shows up as a description in the generated CRDs ([#1227]).
21+
- Add root descriptions to all CRDs defined in this crate (`AuthenticationClass`, `Listener`,
22+
`ListenerClass`, `PodListeners`, `S3Bucket`, `S3Connection`, `Scaler`), now that the `versioned`
23+
macro requires a `doc` argument ([#1228]).
24+
25+
### Changed
26+
27+
- BREAKING: Bump to kube `4.0.0`, k8s-openapi `0.28.0` and enable the Kubernetes 1.36 feature ([#1224]).
28+
29+
[#1224]: https://github.com/stackabletech/operator-rs/pull/1224
30+
[#1227]: https://github.com/stackabletech/operator-rs/pull/1227
31+
[#1228]: https://github.com/stackabletech/operator-rs/pull/1228
32+
33+
## [0.112.0] - 2026-06-22
34+
35+
### Added
36+
37+
- Add `Client::{get_feature_gates,get_enabled_feature_gates,get_disabled_feature_gates}` associated
38+
functions to retrieve all, enabled, or disabled feature gates from the Kubernetes apiserver ([#1207], [#1208]).
39+
- Add a new `v2` module that provides more type-safe variants of the existing functions ([#1225]).
40+
41+
### Changed
42+
43+
- BREAKING: Use `serde_json::Value` instead of `String` for user-provided JSON `configOverrides`. This change is marked as breaking, as it causes a breaking change to the CRDs ([#1206]).
44+
45+
[#1206]: https://github.com/stackabletech/operator-rs/pull/1206
46+
[#1207]: https://github.com/stackabletech/operator-rs/pull/1207
47+
[#1208]: https://github.com/stackabletech/operator-rs/pull/1208
48+
[#1225]: https://github.com/stackabletech/operator-rs/pull/1225
49+
1450
## [0.111.1] - 2026-04-28
1551

1652
### Added

‎crates/stackable-operator/Cargo.toml‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,20 @@
11
[package]
22
name = "stackable-operator"
33
description = "Stackable Operator Framework"
4-
version = "0.111.1"
4+
version = "0.113.0"
55
authors.workspace = true
66
license.workspace = true
77
edition.workspace = true
88
repository.workspace = true
99

1010
[features]
1111
default = ["crds"]
12-
full = ["crds", "certs", "time", "webhook", "kube-ws"]
12+
full = ["client-feature-gates", "crds", "certs", "test-support", "time", "webhook", "kube-ws"]
1313

14+
client-feature-gates = ["dep:winnow"]
1415
crds = ["dep:stackable-versioned"]
1516
certs = ["dep:stackable-certs"]
17+
test-support = []
1618
time = ["stackable-shared/time"]
1719
webhook = ["dep:stackable-webhook"]
1820
kube-ws = ["kube/ws"]
@@ -35,8 +37,9 @@ educe.workspace = true
3537
futures.workspace = true
3638
http.workspace = true
3739
indexmap.workspace = true
40+
java-properties.workspace = true
3841
jiff.workspace = true
39-
json-patch.workspace = true
42+
json-patch = { workspace = true, features = ["schemars"] }
4043
k8s-openapi.workspace = true
4144
kube.workspace = true
4245
product-config.workspace = true
@@ -47,13 +50,17 @@ semver.workspace = true
4750
serde_json.workspace = true
4851
serde_yaml.workspace = true
4952
serde.workspace = true
53+
sha2.workspace = true
5054
snafu.workspace = true
5155
strum.workspace = true
5256
tokio.workspace = true
5357
tracing.workspace = true
5458
tracing-appender.workspace = true
5559
tracing-subscriber.workspace = true
5660
url.workspace = true
61+
uuid.workspace = true
62+
winnow = { workspace = true, optional = true }
63+
xml.workspace = true
5764

5865
[dev-dependencies]
5966
indoc.workspace = true

‎crates/stackable-operator/crds/AuthenticationClass.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ spec:
1717
name: v1alpha1
1818
schema:
1919
openAPIV3Schema:
20-
description: Auto-generated derived type for AuthenticationClassSpec via `CustomResource`
20+
description: The Stackable Platform uses the AuthenticationClass as a central mechanism to handle user authentication across supported products.
2121
properties:
2222
spec:
2323
description: |-

‎crates/stackable-operator/crds/DummyCluster.yaml‎

Lines changed: 72 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ spec:
1717
name: v1alpha1
1818
schema:
1919
openAPIV3Schema:
20-
description: Auto-generated derived type for DummyClusterSpec via `CustomResource`
20+
description: A DummyCluster is a test-only resource used by operator-rs to exercise CRD generation. It is not backed by a real operator.
2121
properties:
2222
spec:
2323
properties:
@@ -1007,8 +1007,34 @@ spec:
10071007
type: string
10081008
type: array
10091009
userProvided:
1010-
description: Override the entire config file with the specified String.
1011-
type: string
1010+
description: |-
1011+
Override the entire config file with the specified JSON document.
1012+
1013+
Please note that you can in-line JSON into YAML as follows:
1014+
1015+
```yaml
1016+
# ... other YAML content
1017+
userProvided: {
1018+
"myString": "test",
1019+
"myList": ["test"],
1020+
"myBool": true,
1021+
"my": {"nested.field.with.dots": 42}
1022+
}
1023+
```
1024+
1025+
As an alternative you can also stick to YAML:
1026+
1027+
```yaml
1028+
# ... other YAML content
1029+
userProvided:
1030+
myString: test
1031+
myList: [test]
1032+
myBool: true
1033+
my:
1034+
nested.field.with.dots: 42
1035+
```
1036+
type: object
1037+
x-kubernetes-preserve-unknown-fields: true
10121038
type: object
10131039
dummy.properties:
10141040
additionalProperties:
@@ -1659,8 +1685,34 @@ spec:
16591685
type: string
16601686
type: array
16611687
userProvided:
1662-
description: Override the entire config file with the specified String.
1663-
type: string
1688+
description: |-
1689+
Override the entire config file with the specified JSON document.
1690+
1691+
Please note that you can in-line JSON into YAML as follows:
1692+
1693+
```yaml
1694+
# ... other YAML content
1695+
userProvided: {
1696+
"myString": "test",
1697+
"myList": ["test"],
1698+
"myBool": true,
1699+
"my": {"nested.field.with.dots": 42}
1700+
}
1701+
```
1702+
1703+
As an alternative you can also stick to YAML:
1704+
1705+
```yaml
1706+
# ... other YAML content
1707+
userProvided:
1708+
myString: test
1709+
myList: [test]
1710+
myBool: true
1711+
my:
1712+
nested.field.with.dots: 42
1713+
```
1714+
type: object
1715+
x-kubernetes-preserve-unknown-fields: true
16641716
type: object
16651717
dummy.properties:
16661718
additionalProperties:
@@ -1699,6 +1751,21 @@ spec:
16991751
nullable: true
17001752
type: integer
17011753
type: object
1754+
description: |-
1755+
The set of role groups for this role, keyed by their name.
1756+
1757+
A role group is a subset of the replicas of a role that share the same configuration,
1758+
allowing finer-grained control than the role level. This is useful to e.g. schedule groups
1759+
onto different classes of nodes or into different regions, or to run them with different
1760+
settings. Configuration set on a role group is merged on top of the role-level `config`,
1761+
with the more specific role group values taking precedence.
1762+
1763+
Every role needs at least one role group. A role with a single role group conventionally
1764+
names it `default`.
1765+
1766+
Read the
1767+
[roles and role groups concept documentation](https://docs.stackable.tech/home/nightly/concepts/roles-and-role-groups)
1768+
for more details.
17021769
type: object
17031770
required:
17041771
- roleGroups

‎crates/stackable-operator/crds/Listener.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ spec:
1717
name: v1alpha1
1818
schema:
1919
openAPIV3Schema:
20-
description: Auto-generated derived type for ListenerSpec via `CustomResource`
20+
description: Exposes a set of Pods to the outside world.
2121
properties:
2222
spec:
2323
description: |-

0 commit comments

Comments
 (0)