Merge remote-tracking branch 'origin/main' into feat/kube-3

Author: sbernauer

Cargo.lock

@@ -247,7 +247,7 @@ where
         //
         // The root profile doesn't add the AuthorityKeyIdentifier extension.
         // We manually add it below by using the 160-bit SHA-1 hash of the
-        // subject pulic key. This conforms to one of the outlined methods for
+        // subject public key. This conforms to one of the outlined methods for
         // generating key identifiers outlined in RFC 5280, section 4.2.1.2.
         //
         // Prepare extensions so we can avoid clones.

crates/stackable-certs/src/ca/mod.rs

@@ -4,11 +4,60 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+### Fixed
+
+- Store the Vector state in the log directory to ensure it persists across container restarts ([#1149]).
+
+[#1149]: https://github.com/stackabletech/operator-rs/pull/1149
+
+## [0.105.0] - 2026-02-03
+
+### Added
+
+- BREAKING: Add support to gracefully shutdown `EosChecker`.
+  `EosChecker::run` now requires passing a shutdown signal, which is any `Future<Output = ()>` ([#1146]).
+- Add `SignalWatcher` which can be used to watch signals and multiply them to gracefully shutdown
+  multiple concurrent tasks/futures ([#1147]).
+
+[#1146]: https://github.com/stackabletech/operator-rs/pull/1146
+[#1147]: https://github.com/stackabletech/operator-rs/pull/1147
+
+## [0.104.0] - 2026-01-26
+
+### Added
+
+- Add `serviceOverrides` field of type `Service` to `ListenerClass.spec.serviceOverrides` ([#1142]).
+
+### Changed
+
+- BREAKING: `ListenerClassSpec` no longer implements `Eq` ([#1142]).
+
+[#1142]: https://github.com/stackabletech/operator-rs/pull/1142
+
+## [0.103.0] - 2026-01-16
+
+### Changed
+
+- BREAKING: Add support for the SSH protocol for pulling git content ([#1121]).
+  This is a user-facing breaking change and should also be highlighted by operators using this functionality.
+
+[#1121]: https://github.com/stackabletech/operator-rs/pull/1121
+
+## [0.102.0] - 2026-01-14
+
+### Added
+
+- BREAKING: Add `objectOverrides` field to `ListenerSpec` ([#1136]).
+- Added `stackable_operator::constants::RESTART_CONTROLLER_ENABLED_LABEL` constant, which represents the `restarter.stackable.tech/enabled=true` label ([#1139]).
+
 ### Changed
 
 - Revert and pin k8s-openapi to 0.26.0 ([#1135]).
+- BREAKING: `ListenerSpec` no longer derives `Eq` ([#1136]).
 
 [#1135]: https://github.com/stackabletech/operator-rs/pull/1135
+[#1136]: https://github.com/stackabletech/operator-rs/pull/1136
+[#1139]: https://github.com/stackabletech/operator-rs/pull/1139
 
 ## [0.101.2] - 2026-01-07
 

crates/stackable-operator/CHANGELOG.md

@@ -1,7 +1,7 @@
 [package]
 name = "stackable-operator"
 description = "Stackable Operator Framework"
-version = "0.101.2"
+version = "0.105.0"
 authors.workspace = true
 license.workspace = true
 edition.workspace = true

crates/stackable-operator/Cargo.toml

@@ -75,6 +75,86 @@ spec:
               domainName:
                 description: A validated domain name type conforming to RFC 1123, so e.g. not an IP address
                 type: string
+              gitSync:
+                properties:
+                  branch:
+                    default: main
+                    description: |-
+                      The branch to clone; defaults to `main`.
+
+                      Since git-sync v4.x.x this field is mapped to the flag `--ref`.
+                    type: string
+                  credentials:
+                    anyOf:
+                    - oneOf:
+                      - required:
+                        - basicAuthSecretName
+                      - required:
+                        - sshPrivateKeySecretName
+                    - enum:
+                      - null
+                      nullable: true
+                    description: An optional secret used for git access.
+                    properties:
+                      basicAuthSecretName:
+                        description: |-
+                          The name of the Secret used to access the repository via Basic Authentication if it is not public.
+
+                          The referenced Secret must include two fields: `user` and `password`.
+                          The `password` field can either be an actual password (not recommended) or a GitHub token,
+                          as described in the git-sync [documentation].
+
+                          [documentation]: https://github.com/kubernetes/git-sync/tree/v4.2.4?tab=readme-ov-file#manual
+                        type: string
+                      sshPrivateKeySecretName:
+                        description: |-
+                          The name of the Secret used for SSH access to the repository.
+
+                          The referenced Secret must include two fields: `key` and `knownHosts`.
+
+                          [documentation]: https://github.com/kubernetes/git-sync/tree/v4.2.4?tab=readme-ov-file#manual
+                        type: string
+                    type: object
+                  depth:
+                    default: 1
+                    description: The depth of syncing, i.e. the number of commits to clone; defaults to 1.
+                    format: uint32
+                    minimum: 0.0
+                    type: integer
+                  gitFolder:
+                    default: /
+                    description: |-
+                      Location in the Git repository containing the resource; defaults to the root folder.
+
+                      It can optionally start with `/`, however, no trailing slash is recommended.
+                      An empty string (``) or slash (`/`) corresponds to the root folder in Git.
+                    type: string
+                  gitSyncConf:
+                    additionalProperties:
+                      type: string
+                    default: {}
+                    description: |-
+                      A map of optional configuration settings that are listed in the git-sync [documentation].
+
+                      Also read the git-sync [example] in our documentation. These settings are not verified.
+
+                      [documentation]: https://github.com/kubernetes/git-sync/tree/v4.2.4?tab=readme-ov-file#manual
+                      [example]: https://docs.stackable.tech/home/nightly/airflow/usage-guide/mounting-dags#_example
+                    type: object
+                  repo:
+                    description: 'The git repository URL that will be cloned, for example: `https://github.com/stackabletech/airflow-operator` or `ssh://git@github.com:stackable-airflow/dags.git`.'
+                    format: uri
+                    type: string
+                  wait:
+                    default: 20s
+                    description: |-
+                      The synchronization interval, e.g. `20s` or `5m`; defaults to `20s`.
+
+                      Since git-sync v4.x.x this field is mapped to the flag `--period`.
+                    type: string
+                required:
+                - repo
+                type: object
               hostName:
                 type: string
               kerberosRealmName:
@@ -655,7 +735,7 @@ spec:
                     default: {}
                     description: |-
                       In the `podOverrides` property you can define a
-                      [PodTemplateSpec](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#podtemplatespec-v1-core)
+                      [PodTemplateSpec](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#podtemplatespec-v1-core)
                       to override any property that can be set on a Kubernetes Pod.
                       Read the
                       [Pod overrides documentation](https://docs.stackable.tech/home/nightly/concepts/overrides#pod-overrides)
@@ -1268,7 +1348,7 @@ spec:
                           default: {}
                           description: |-
                             In the `podOverrides` property you can define a
-                            [PodTemplateSpec](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#podtemplatespec-v1-core)
+                            [PodTemplateSpec](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#podtemplatespec-v1-core)
                             to override any property that can be set on a Kubernetes Pod.
                             Read the
                             [Pod overrides documentation](https://docs.stackable.tech/home/nightly/concepts/overrides#pod-overrides)
@@ -2054,6 +2134,7 @@ spec:
             - clientAuthenticationDetails
             - clusterOperation
             - domainName
+            - gitSync
             - hostName
             - kerberosRealmName
             - opaConfig

crates/stackable-operator/crds/DummyCluster.yaml

@@ -41,6 +41,20 @@ spec:
                 default: {}
                 description: Extra labels that the Pods must match in order to be exposed. They must _also_ still have a Volume referring to the Listener.
                 type: object
+              objectOverrides:
+                default: []
+                description: |-
+                  A list of generic Kubernetes objects, which are merged into the objects that the operator
+                  creates.
+
+                  List entries are arbitrary YAML objects, which need to be valid Kubernetes objects.
+
+                  Read the [Object overrides documentation](https://docs.stackable.tech/home/nightly/concepts/overrides#object-overrides)
+                  for more information.
+                items:
+                  type: object
+                  x-kubernetes-preserve-unknown-fields: true
+                type: array
               ports:
                 description: Ports that should be exposed.
                 items:

crates/stackable-operator/crds/Listener.yaml

@@ -106,6 +106,20 @@ spec:
                   sophisticated LoadBalancer, that respects what Pods run on which nodes and routes traffic only
                   to these nodes accordingly. Some cloud providers or bare metal installations do not implement
                   some of the required features.
+              serviceOverrides:
+                default:
+                  apiVersion: v1
+                  kind: Service
+                  metadata: {}
+                description: |-
+                  In the `serviceOverrides` property you can define a
+                  [Service](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#service-v1-core)
+                  to override any property that can be set on a Kubernetes Service.
+
+                  This mechanism is similar to the `podOverrides`, which are documented in the
+                  [Pod overrides documentation](https://docs.stackable.tech/home/nightly/concepts/overrides#pod-overrides).
+                type: object
+                x-kubernetes-preserve-unknown-fields: true
               serviceType:
                 description: The method used to access the services.
                 enum:

crates/stackable-operator/crds/ListenerClass.yaml

@@ -1 +1,10 @@
+use std::sync::LazyLock;
+
+use crate::kvp::Label;
+
 pub mod secret;
+
+pub static RESTART_CONTROLLER_ENABLED_LABEL: LazyLock<Label> = LazyLock::new(|| {
+    Label::try_from(("restarter.stackable.tech/enabled", "true"))
+        .expect("static label is always valid")
+});

crates/stackable-operator/src/constants/mod.rs

@@ -7,61 +7,116 @@ use serde::{Deserialize, Serialize};
 use stackable_shared::time::Duration;
 use url::Url;
 
-use crate::versioned::versioned;
+use crate::{crd::git_sync::v1alpha2::Credentials, versioned::versioned};
 
 mod v1alpha1_impl;
+mod v1alpha2_impl;
 
-#[versioned(version(name = "v1alpha1"))]
+#[versioned(version(name = "v1alpha1"), version(name = "v1alpha2"))]
 pub mod versioned {
     pub mod v1alpha1 {
         pub use v1alpha1_impl::{Error, GitSyncResources};
     }
+    pub mod v1alpha2 {
+        pub use v1alpha2_impl::{Error, GitSyncResources};
+    }
 
     #[derive(Clone, Debug, Deserialize, JsonSchema, PartialEq, Eq, Serialize)]
     #[serde(rename_all = "camelCase")]
     pub struct GitSync {
-        /// The git repository URL that will be cloned, for example: `https://github.com/stackabletech/airflow-operator`.
+        /// The git repository URL that will be cloned, for example: `https://github.com/stackabletech/airflow-operator` or `ssh://git@github.com:stackable-airflow/dags.git`.
         pub repo: Url,
 
         /// The branch to clone; defaults to `main`.
         ///
         /// Since git-sync v4.x.x this field is mapped to the flag `--ref`.
-        #[serde(default = "GitSync::default_branch")]
+        #[serde(default = "default_branch")]
         pub branch: String,
 
         /// Location in the Git repository containing the resource; defaults to the root folder.
         ///
         /// It can optionally start with `/`, however, no trailing slash is recommended.
         /// An empty string (``) or slash (`/`) corresponds to the root folder in Git.
-        #[serde(default = "GitSync::default_git_folder")]
+        #[serde(default = "default_git_folder")]
         pub git_folder: PathBuf,
 
         /// The depth of syncing, i.e. the number of commits to clone; defaults to 1.
-        #[serde(default = "GitSync::default_depth")]
+        #[serde(default = "default_depth")]
         pub depth: u32,
 
         /// The synchronization interval, e.g. `20s` or `5m`; defaults to `20s`.
         ///
         /// Since git-sync v4.x.x this field is mapped to the flag `--period`.
-        #[serde(default = "GitSync::default_wait")]
+        #[serde(default = "default_wait")]
         pub wait: Duration,
 
-        /// The name of the Secret used to access the repository if it is not public.
+        /// A map of optional configuration settings that are listed in the git-sync [documentation].
+        ///
+        /// Also read the git-sync [example] in our documentation. These settings are not verified.
+        ///
+        /// [documentation]: https://github.com/kubernetes/git-sync/tree/v4.2.4?tab=readme-ov-file#manual
+        /// [example]: DOCS_BASE_URL_PLACEHOLDER/airflow/usage-guide/mounting-dags#_example
+        #[serde(default)]
+        pub git_sync_conf: BTreeMap<String, String>,
+
+        /// An optional secret used for git access.
+        #[versioned(changed(
+            since = "v1alpha2",
+            from_name = "credentials_secret",
+            from_type = "Option<String>",
+            upgrade_with = credentials_secret_to_basic_auth,
+            downgrade_with = credentials_to_secret
+        ))]
+        pub credentials: Option<Credentials>,
+    }
+
+    #[derive(strum::Display, Clone, Debug, Deserialize, Eq, JsonSchema, PartialEq, Serialize)]
+    #[serde(rename_all = "camelCase")]
+    #[schemars(rename_all = "camelCase")]
+    pub enum Credentials {
+        /// The name of the Secret used to access the repository via Basic Authentication if it is not public.
         ///
         /// The referenced Secret must include two fields: `user` and `password`.
         /// The `password` field can either be an actual password (not recommended) or a GitHub token,
         /// as described in the git-sync [documentation].
         ///
         /// [documentation]: https://github.com/kubernetes/git-sync/tree/v4.2.4?tab=readme-ov-file#manual
-        pub credentials_secret: Option<String>,
-
-        /// A map of optional configuration settings that are listed in the git-sync [documentation].
+        BasicAuthSecretName(String),
+        /// The name of the Secret used for SSH access to the repository.
         ///
-        /// Also read the git-sync [example] in our documentation. These settings are not verified.
+        /// The referenced Secret must include two fields: `key` and `knownHosts`.
         ///
         /// [documentation]: https://github.com/kubernetes/git-sync/tree/v4.2.4?tab=readme-ov-file#manual
-        /// [example]: DOCS_BASE_URL_PLACEHOLDER/airflow/usage-guide/mounting-dags#_example
-        #[serde(default)]
-        pub git_sync_conf: BTreeMap<String, String>,
+        SshPrivateKeySecretName(String),
+    }
+}
+
+pub(crate) fn default_branch() -> String {
+    "main".to_string()
+}
+
+pub(crate) fn default_git_folder() -> PathBuf {
+    PathBuf::from("/")
+}
+
+pub(crate) fn default_depth() -> u32 {
+    1
+}
+
+pub(crate) fn default_wait() -> Duration {
+    Duration::from_secs(20)
+}
+
+pub fn credentials_to_secret(input: Option<Credentials>) -> Option<String> {
+    if let Some(Credentials::BasicAuthSecretName(credentials_secret)) = input {
+        Some(credentials_secret)
+    } else {
+        // We cannot downgrade SshPrivateKeySecretName as it does not map onto
+        // anything in v1alpha1
+        None
     }
 }
+
+pub fn credentials_secret_to_basic_auth(input: Option<String>) -> Option<Credentials> {
+    input.map(Credentials::BasicAuthSecretName)
+}