Merge branch 'main' into feat/roundtrip-tests

Author: sbernauer

Cargo.lock

@@ -29,6 +29,7 @@ either = "1.13.0"
 futures = "0.3.30"
 futures-util = "0.3.30"
 http = "1.3.1"
+humantime = "2.1.0"
 indexmap = "2.5.0"
 indoc = "2.0.6"
 jiff = "0.2.18"

Cargo.toml

@@ -23,7 +23,7 @@
 //!
 //! ### Constructing
 //!
-//! Alternatively, they can be constructed programatically using the
+//! Alternatively, they can be constructed programmatically using the
 //! [`ApiVersion::new()`] and [`ApiVersion::try_new()`] functions.
 //!
 //! ```

crates/k8s-version/src/lib.rs

@@ -14,7 +14,7 @@ All notable changes to this project will be documented in this file.
 
 - BREAKING: The functions `generate_leaf_certificate`, `generate_rsa_leaf_certificate` and
   `generate_ecdsa_leaf_certificate` of `CertificateAuthority` accept an additional parameter
-  `subject_alterative_dns_names` ([#1057]).
+  `subject_alternative_dns_names` ([#1057]).
   - The passed SANs are added to the generated certificate, this is needed when the HTTPS server is
     accessible on multiple DNS names and/or IPs.
   - Pass an empty list (`[]`) to keep the existing behavior.

crates/stackable-certs/CHANGELOG.md

@@ -163,7 +163,7 @@ where
 }
 
 /// A certificate authority (CA) which is used to generate and sign
-/// intermidiate or leaf certificates.
+/// intermediate or leaf certificates.
 #[derive(Debug)]
 pub struct CertificateAuthority<S>
 where
@@ -298,7 +298,7 @@ where
         key_pair: T,
         name: &str,
         scope: &str,
-        subject_alterative_dns_names: impl IntoIterator<Item = &'a str> + Debug,
+        subject_alternative_dns_names: impl IntoIterator<Item = &'a str> + Debug,
         validity: Duration,
     ) -> Result<CertificatePair<T>>
     where
@@ -353,7 +353,7 @@ where
             ]))
             .context(AddCertificateExtensionSnafu)?;
 
-        let sans = subject_alterative_dns_names
+        let sans = subject_alternative_dns_names
             .into_iter()
             .map(|dns_name| {
                 let ia5_dns_name =
@@ -385,11 +385,11 @@ where
         &mut self,
         name: &str,
         scope: &str,
-        subject_alterative_dns_names: impl IntoIterator<Item = &'a str> + Debug,
+        subject_alternative_dns_names: impl IntoIterator<Item = &'a str> + Debug,
         validity: Duration,
     ) -> Result<CertificatePair<rsa::SigningKey>> {
         let key = rsa::SigningKey::new().context(GenerateRsaSigningKeySnafu)?;
-        self.generate_leaf_certificate(key, name, scope, subject_alterative_dns_names, validity)
+        self.generate_leaf_certificate(key, name, scope, subject_alternative_dns_names, validity)
     }
 
     /// Generates an ECDSAasync -based leaf certificate which is signed by this CA.
@@ -401,11 +401,11 @@ where
         &mut self,
         name: &str,
         scope: &str,
-        subject_alterative_dns_names: impl IntoIterator<Item = &'a str> + Debug,
+        subject_alternative_dns_names: impl IntoIterator<Item = &'a str> + Debug,
         validity: Duration,
     ) -> Result<CertificatePair<ecdsa::SigningKey>> {
         let key = ecdsa::SigningKey::new().context(GenerateEcdsaSigningKeySnafu)?;
-        self.generate_leaf_certificate(key, name, scope, subject_alterative_dns_names, validity)
+        self.generate_leaf_certificate(key, name, scope, subject_alternative_dns_names, validity)
     }
 
     /// Create a [`CertificateAuthority`] from a Kubernetes [`Secret`].

crates/stackable-certs/src/ca/mod.rs

@@ -43,7 +43,7 @@ pub enum CertificatePairError<E>
 where
     E: std::error::Error + 'static,
 {
-    #[snafu(display("failed to seralize certificate as {key_encoding}"))]
+    #[snafu(display("failed to serialize certificate as {key_encoding}"))]
     SerializeCertificate {
         source: x509_cert::der::Error,
         key_encoding: KeyEncoding,

crates/stackable-certs/src/lib.rs

@@ -4,6 +4,20 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+### Added
+
+- Implement `Deref` for `kvp::Key` to be more ergonomic to use ([#1182]).
+- Add support for specifying a `clientAuthenticationMethod` for OIDC ([#1178]).
+  This was originally done in [#1158] and had been reverted in [#1170].
+
+### Removed
+
+- BREAKING: Remove unused `add_prefix`, `try_add_prefix`, `set_name`, and `try_set_name` associated
+  functions from `kvp::Key` to disallow mutable access to inner values ([#1182]).
+
+[#1178]: https://github.com/stackabletech/operator-rs/pull/1178
+[#1182]: https://github.com/stackabletech/operator-rs/pull/1182
+
 ## [0.108.0] - 2026-03-10
 
 ### Removed
@@ -1494,7 +1508,7 @@ Only rust documentation was changed.
 - status::condition module to compute the cluster resource status ([#571]).
 - Helper function to build RBAC resources ([#572]).
 - Add `ClusterResourceApplyStrategy` to `ClusterResource` ([#573]).
-- Add `ClusterOperation` common struct with `reconcilation_paused` and `stopped` flags ([#573]).
+- Add `ClusterOperation` common struct with `reconciliation_paused` and `stopped` flags ([#573]).
 
 [#571]: https://github.com/stackabletech/operator-rs/pull/571
 [#572]: https://github.com/stackabletech/operator-rs/pull/572
@@ -1839,7 +1853,7 @@ This is a rerelease of 0.25.1 which some last-minute incompatible API changes to
 
 ### Changed
 
-- BREAKING: Removed `commons::s3::S3ConnectionImplementation`. `commons::s3::InlinedBucketSpec::endpoint()` doesn't take arguments since the protocol decision is now based on the existance of TLS configuration ([#390]).
+- BREAKING: Removed `commons::s3::S3ConnectionImplementation`. `commons::s3::InlinedBucketSpec::endpoint()` doesn't take arguments since the protocol decision is now based on the existence of TLS configuration ([#390]).
 - BREAKING: Changes to resource requirements structs to enable deep merging ([#392])
   - Changed fields in `Resources` to no longer be optional
   - Changed atomic fields in `MemoryLimits`, `JvmHeapLimits`, `CpuLimits` and `PvcConfig` to be optional
@@ -1875,7 +1889,7 @@ This is a rerelease of 0.25.1 which some last-minute incompatible API changes to
 ### Added
 
 - Export logs to Jaeger ([#360]).
-- Added common datastructures shared between all operators like `Tls` oder `AuthenticationClass` ([#366]).
+- Added common datastructures shared between all operators like `Tls` or `AuthenticationClass` ([#366]).
 - Added helpers for env variables from Secrets or ConfigMaps ([#370]).
 
 ### Changed
@@ -2089,7 +2103,7 @@ This is a rerelease of 0.25.1 which some last-minute incompatible API changes to
 ### Changed
 
 - BREAKING: In builder: `add_stackable_agent_tolerations` to `add_tolerations` ([#255]).
-- Generic `VALUE` paramters to `impl Into<_>` arguments for consistency ([#253]).
+- Generic `VALUE` parameters to `impl Into<_>` arguments for consistency ([#253]).
 
 ### Removed
 

crates/stackable-operator/CHANGELOG.md

@@ -30,6 +30,16 @@ spec:
                     description: This field contains OIDC-specific configuration. It is only required in case OIDC is used.
                     nullable: true
                     properties:
+                      clientAuthenticationMethod:
+                        default: client_secret_basic
+                        description: 'The client authentication method used when communicating with the token endpoint. Defaults to `client_secret_basic`. The required contents of `clientCredentialsSecret` depend on the chosen method: secret-based methods (`client_secret_basic`, `client_secret_post`, `client_secret_jwt`) expect a client secret, while `private_key_jwt` expects a private key.'
+                        enum:
+                        - client_secret_basic
+                        - client_secret_post
+                        - client_secret_jwt
+                        - private_key_jwt
+                        - none
+                        type: string
                       clientCredentialsSecret:
                         description: |-
                           A reference to the OIDC client credentials secret. The secret contains
@@ -587,7 +597,7 @@ spec:
                                 type: object
                             type: object
                           enableVectorAgent:
-                            description: Wether or not to deploy a container with the Vector log agent.
+                            description: Whether or not to deploy a container with the Vector log agent.
                             nullable: true
                             type: boolean
                         type: object
@@ -1199,7 +1209,7 @@ spec:
                                       type: object
                                   type: object
                                 enableVectorAgent:
-                                  description: Wether or not to deploy a container with the Vector log agent.
+                                  description: Whether or not to deploy a container with the Vector log agent.
                                   nullable: true
                                   type: boolean
                               type: object

crates/stackable-operator/crds/DummyCluster.yaml

@@ -45,7 +45,7 @@ pub enum Error {
 pub struct PodDisruptionBudgetBuilder<ObjectMeta, LabelSelector, PodDisruptionBudgetConstraint> {
     metadata: ObjectMeta,
     selector: LabelSelector,
-    /// Tracks wether either `maxUnavailable` or `minAvailable` is set.
+    /// Tracks whether either `maxUnavailable` or `minAvailable` is set.
     constraint: Option<PodDisruptionBudgetConstraint>,
 }
 

crates/stackable-operator/src/builder/pdb.rs

@@ -667,7 +667,7 @@ mod tests {
             .build()
     }
 
-    /// A [`PodBuilder`] that already contains the minum setup to build a Pod (name and container).
+    /// A [`PodBuilder`] that already contains the minimum setup to build a Pod (name and container).
     #[fixture]
     fn pod_builder_with_name_and_container(dummy_container: Container) -> PodBuilder {
         let mut builder = PodBuilder::new();