Merge branch 'main' into feat/annotation-auto-tls-cert-subject-dn

Author: siegfriedweber

Cargo.lock

@@ -17,7 +17,9 @@ axum = { version = "0.8.1", features = ["http2"] }
 base64 = "0.22"
 clap = { version = "4.5.17", features = ["derive", "cargo", "env"] }
 const_format = "0.2.33"
-# Cannot be updated until x509-cert uses a newer version
+# Pinned to the old RustCrypto generation: const-oid 0.10 requires x509-cert 0.3,
+# which is not released yet. Tracking: https://github.com/RustCrypto/formats/issues/1289
+# See also the rand/rand_core and sha2/signature pins below.
 const-oid = { version = "0.9.6", features = ["db"] }
 convert_case = "0.11.0"
 convert_case_extras = "0.2.0"
@@ -34,30 +36,34 @@ humantime = "2.1.0"
 indexmap = "2.5.0"
 indoc = "2.0.6"
 jiff = "0.2.18"
-insta = { version = "1.40", features = ["glob"] }
+insta = { version = "1.48.0", features = ["glob"] }
 hyper = { version = "1.4.1", features = ["full"] }
 hyper-util = "0.1.8"
-itertools = "0.14.0"
+itertools = "0.15.0"
+java-properties = "2.0"
 json-patch = "4.0.0"
-k8s-openapi = { version = "0.27.0", default-features = false, features = ["schemars", "v1_35"] }
+k8s-openapi = { version = "0.28.0", default-features = false, features = ["schemars", "v1_36"] }
 # We use rustls instead of openssl for easier portability, e.g. so that we can build stackablectl without the need to vendor (build from source) openssl
 # We use ring instead of aws-lc-rs, as this currently fails to build in "make run-dev"
-kube = { version = "3.1.0", default-features = false, features = ["client", "jsonpatch", "runtime", "derive", "admission", "rustls-tls", "ring"] }
-opentelemetry = "0.31.0"
-opentelemetry_sdk = { version = "0.31.0", features = ["rt-tokio"] }
-opentelemetry-appender-tracing = "0.31.0"
-opentelemetry-otlp = "0.31.0"
-opentelemetry-semantic-conventions = "0.31.0"
+kube = { version = "4.0.0", default-features = false, features = ["client", "jsonpatch", "runtime", "derive", "admission", "rustls-tls", "ring"] }
+opentelemetry = "0.32.0"
+opentelemetry_sdk = { version = "0.32.0", features = ["rt-tokio"] }
+opentelemetry-appender-tracing = "0.32.0"
+opentelemetry-otlp = "0.32.0"
+opentelemetry-semantic-conventions = "0.32.0"
 p256 = { version = "0.13.2", features = ["ecdsa"] }
 paste = "1.0.15"
 pin-project = "1.1.5"
 prettyplease = "0.2.22"
 proc-macro2 = "1.0.86"
 quote = "1.0.37"
-# Cannot be updated until x509-cert uses a newer version
+# Pinned to the old RustCrypto generation: rand_core 0.9+ (and the matching rand) pulls
+# in the new digest/signature ecosystem that rsa 0.9 and x509-cert 0.2 do not support yet.
+# Bumping splits the graph into duplicate, incompatible crate versions.
+# Unblocked once rsa 0.10 (currently in RC) lands: https://github.com/RustCrypto/RSA
 rand = "0.9.0"
 rand_core = "0.6.4"
-regex = "1.10.6"
+regex = "1.12.4"
 rsa = { version = "0.9.6", features = ["sha2"] }
 rstest = "0.26.1"
 rstest_reuse = "0.7.0"
@@ -66,29 +72,34 @@ semver = "1.0.23"
 serde = { version = "1.0.210", features = ["derive"] }
 serde_json = "1.0.128"
 serde_yaml = "0.9.34" # This is the last available version, see https://github.com/dtolnay/serde-yaml/releases/tag/0.9.34 for details
+# Pinned to the old RustCrypto generation (digest 0.10 / signature 2.x): sha2 0.11 uses
+# digest 0.11 and signature 3.0, which rsa 0.9 and x509-cert 0.2 do not support yet.
+# Unblocked once rsa 0.10 (currently in RC) lands: https://github.com/RustCrypto/RSA
 sha2 = { version = "0.10.8", features = ["oid"] }
 signature = "2.2.0"
-snafu = "0.9.0"
+snafu = "0.9.1"
 stackable-operator-derive = { path = "stackable-operator-derive" }
 strum = { version = "0.28.0", features = ["derive"] }
-syn = "2.0.77"
+syn = "2.0.118"
 tempfile = "3.12.0"
-time = { version = "0.3.36" }
+time = { version = "0.3.49" }
 tokio = { version = "1.40.0", features = ["macros", "rt-multi-thread", "fs"] }
 # We use ring instead of aws-lc-rs, as this currently fails to build in "make run-dev"
 tokio-rustls = { version = "0.26.0", default-features = false, features = ["ring", "logging", "tls12"] }
 tokio-test = "0.4.4"
 tower = { version = "0.5.1", features = ["util"] }
-tower-http = { version = "0.6.1", features = ["trace"] }
+tower-http = { version = "0.7.0", features = ["trace"] } # We don't actually use this crate, but we need to enable the `trace` feature
 tracing = "0.1.40"
 tracing-appender = "0.2.3"
-tracing-opentelemetry = "0.32.0"
+tracing-opentelemetry = "0.33.0"
 tracing-subscriber = { version = "0.3.18", features = ["env-filter", "json"] }
 trybuild = "1.0.99"
 url = { version = "2.5.2", features = ["serde"] }
+uuid = "1.23.0"
 winnow = "1.0.3"
 x509-cert = { version = "0.2.5", features = ["builder"] }
-zeroize = "1.8.1"
+xml = "1.3.0"
+zeroize = "1.9.0"
 
 [workspace.lints.clippy]
 # Enable all pedantic lints (with lower priority so individual lints can override)

Cargo.toml

@@ -47,22 +47,18 @@ pub enum Level {
 impl FromStr for Level {
     type Err = ParseLevelError;
 
-    // SAFETY: We purposefully allow the `clippy::unwrap_in_result` lint below in this function.
-    // We can use expect here, because the correct match labels must be used.
-    //
-    // FIXME (@Techassi): This attribute can be used on individual unwrap and expect calls since
-    // Rust 1.91.0. We should move this attribute to not contaminate an unnecessarily large scope
-    // once we bump the toolchain to 1.91.0.
-    // See https://github.com/rust-lang/rust-clippy/pull/15445
-    #[allow(clippy::unwrap_in_result)]
     fn from_str(input: &str) -> Result<Self, Self::Err> {
         let captures = LEVEL_REGEX.captures(input).context(InvalidFormatSnafu)?;
 
+        // SAFETY: We purposefully allow the `clippy::unwrap_in_result` lint here and below.
+        // We can use expect here, because the correct match labels must be used.
+        #[allow(clippy::unwrap_in_result)]
         let identifier = captures
             .name("identifier")
             .expect("internal error: check that the correct match label is specified")
             .as_str();
 
+        #[allow(clippy::unwrap_in_result)]
         let version = captures
             .name("version")
             .expect("internal error: check that the correct match label is specified")

crates/k8s-version/src/level/mod.rs

@@ -53,17 +53,13 @@ pub struct Version {
 impl FromStr for Version {
     type Err = ParseVersionError;
 
-    // SAFETY: We purposefully allow the `clippy::unwrap_in_result` lint below in this function.
-    // We can use expect here, because the correct match label must be used.
-    //
-    // FIXME (@Techassi): This attribute can be used on individual unwrap and expect calls since
-    // Rust 1.91.0. We should move this attribute to not contaminate an unnecessarily large scope
-    // once we bump the toolchain to 1.91.0.
-    // See https://github.com/rust-lang/rust-clippy/pull/15445
     #[allow(clippy::unwrap_in_result)]
     fn from_str(input: &str) -> Result<Self, Self::Err> {
         let captures = VERSION_REGEX.captures(input).context(InvalidFormatSnafu)?;
 
+        // SAFETY: We purposefully allow the `clippy::unwrap_in_result` lint below.
+        // We can use expect here, because the correct match label must be used.
+        #[allow(clippy::unwrap_in_result)]
         let major = captures
             .name("major")
             .expect("internal error: check that the correct match label is specified")

crates/k8s-version/src/version/mod.rs

@@ -205,16 +205,6 @@ where
     /// validity, this function offers complete control over these parameters.
     /// If this level of control is not needed, use [`CertificateAuthority::new`]
     /// instead.
-    //
-    // SAFETY: We purposefully allow the `clippy::unwrap_in_result` lint below in this function.
-    // We can use expect here, because the subject name is defined as a constant which must be able
-    // to be parsed.
-    //
-    // FIXME (@Techassi): This attribute can be used on individual unwrap and expect calls since
-    // Rust 1.91.0. We should move this attribute to not contaminate an unnecessarily large scope
-    // once we bump the toolchain to 1.91.0.
-    // See https://github.com/rust-lang/rust-clippy/pull/15445
-    #[allow(clippy::unwrap_in_result)]
     #[instrument(name = "create_certificate_authority_with", skip(signing_key_pair))]
     pub fn new_with(signing_key_pair: S, serial_number: u64, validity: Duration) -> Result<Self> {
         let serial_number = SerialNumber::from(serial_number);
@@ -223,6 +213,10 @@ where
         // We don't allow customization of the CA subject by callers. Every CA
         // created by us should contain the same subject consisting a common set
         // of distinguished names (DNs).
+        // SAFETY: We purposefully allow the `clippy::unwrap_in_result` lint below.
+        // We can use expect here, because the subject name is defined as a constant which must be
+        // able to be parsed.
+        #[allow(clippy::unwrap_in_result)]
         let subject = Name::from_str(SDP_ROOT_CA_SUBJECT)
             .expect("the constant SDP_ROOT_CA_SUBJECT must be a valid subject");
 

crates/stackable-certs/src/ca/mod.rs

@@ -6,18 +6,35 @@ All notable changes to this project will be documented in this file.
 
 ### Added
 
-- Add `Client::{get_feature_gates,get_enabled_feature_gates,get_disabled_feature_gates}` associated
-  functions to retrieve all, enabled, or disabled feature gates from the Kubernetes apiserver ([#1207]).
+- Add root descriptions to all CRDs defined in this crate (`AuthenticationClass`, `Listener`,
+  `ListenerClass`, `PodListeners`, `S3Bucket`, `S3Connection`, `Scaler`), now that the `versioned`
+  macro requires a `doc` argument ([#1228]).
 - Support the annotation `secrets.stackable.tech/backend.autotls.cert.domain-components-in-subject-dn`
   in the `SecretOperatorVolumeSourceBuilder` ([#1209]).
 
+[#1209]: https://github.com/stackabletech/operator-rs/pull/1209
+[#1228]: https://github.com/stackabletech/operator-rs/pull/1228
+
+## [0.112.0] - 2026-06-22
+
+### Added
+
+- Add `Client::{get_feature_gates,get_enabled_feature_gates,get_disabled_feature_gates}` associated
+  functions to retrieve all, enabled, or disabled feature gates from the Kubernetes apiserver ([#1207], [#1208]).
+- Add a new `v2` module that provides more type-safe variants of the existing functions ([#1225]).
+- Add documentation for the `roleGroups` field, which now shows up as a description in the generated CRDs ([#1227]).
+
 ### Changed
 
 - BREAKING: Use `serde_json::Value` instead of `String` for user-provided JSON `configOverrides`. This change is marked as breaking, as it causes a breaking change to the CRDs ([#1206]).
+- BREAKING: Bump to kube `4.0.0`, k8s-openapi `0.28.0` and enable the Kubernetes 1.36 feature ([#1224]).
 
 [#1206]: https://github.com/stackabletech/operator-rs/pull/1206
 [#1207]: https://github.com/stackabletech/operator-rs/pull/1207
-[#1209]: https://github.com/stackabletech/operator-rs/pull/1209
+[#1208]: https://github.com/stackabletech/operator-rs/pull/1208
+[#1224]: https://github.com/stackabletech/operator-rs/pull/1224
+[#1225]: https://github.com/stackabletech/operator-rs/pull/1225
+[#1227]: https://github.com/stackabletech/operator-rs/pull/1227
 
 ## [0.111.1] - 2026-04-28
 

crates/stackable-operator/CHANGELOG.md

@@ -1,18 +1,20 @@
 [package]
 name = "stackable-operator"
 description = "Stackable Operator Framework"
-version = "0.111.1"
+version = "0.112.0"
 authors.workspace = true
 license.workspace = true
 edition.workspace = true
 repository.workspace = true
 
 [features]
 default = ["crds"]
-full = ["crds", "certs", "time", "webhook", "kube-ws"]
+full = ["client-feature-gates", "crds", "certs", "test-support", "time", "webhook", "kube-ws"]
 
+client-feature-gates = ["dep:winnow"]
 crds = ["dep:stackable-versioned"]
 certs = ["dep:stackable-certs"]
+test-support = []
 time = ["stackable-shared/time"]
 webhook = ["dep:stackable-webhook"]
 kube-ws = ["kube/ws"]
@@ -35,8 +37,9 @@ educe.workspace = true
 futures.workspace = true
 http.workspace = true
 indexmap.workspace = true
+java-properties.workspace = true
 jiff.workspace = true
-json-patch.workspace = true
+json-patch = { workspace = true, features = ["schemars"] }
 k8s-openapi.workspace = true
 kube.workspace = true
 product-config.workspace = true
@@ -47,14 +50,17 @@ semver.workspace = true
 serde_json.workspace = true
 serde_yaml.workspace = true
 serde.workspace = true
+sha2.workspace = true
 snafu.workspace = true
 strum.workspace = true
 tokio.workspace = true
 tracing.workspace = true
 tracing-appender.workspace = true
 tracing-subscriber.workspace = true
 url.workspace = true
-winnow.workspace = true
+uuid.workspace = true
+winnow = { workspace = true, optional = true }
+xml.workspace = true
 
 [dev-dependencies]
 indoc.workspace = true

crates/stackable-operator/Cargo.toml

@@ -17,7 +17,7 @@ spec:
     name: v1alpha1
     schema:
       openAPIV3Schema:
-        description: Auto-generated derived type for AuthenticationClassSpec via `CustomResource`
+        description: The Stackable Platform uses the AuthenticationClass as a central mechanism to handle user authentication across supported products.
         properties:
           spec:
             description: |-

crates/stackable-operator/crds/AuthenticationClass.yaml

@@ -17,7 +17,7 @@ spec:
     name: v1alpha1
     schema:
       openAPIV3Schema:
-        description: Auto-generated derived type for DummyClusterSpec via `CustomResource`
+        description: A DummyCluster is a test-only resource used by operator-rs to exercise CRD generation. It is not backed by a real operator.
         properties:
           spec:
             properties:
@@ -1751,6 +1751,21 @@ spec:
                           nullable: true
                           type: integer
                       type: object
+                    description: |-
+                      The set of role groups for this role, keyed by their name.
+
+                      A role group is a subset of the replicas of a role that share the same configuration,
+                      allowing finer-grained control than the role level. This is useful to e.g. schedule groups
+                      onto different classes of nodes or into different regions, or to run them with different
+                      settings. Configuration set on a role group is merged on top of the role-level `config`,
+                      with the more specific role group values taking precedence.
+
+                      Every role needs at least one role group. A role with a single role group conventionally
+                      names it `default`.
+
+                      Read the
+                      [roles and role groups concept documentation](https://docs.stackable.tech/home/nightly/concepts/roles-and-role-groups)
+                      for more details.
                     type: object
                 required:
                 - roleGroups

crates/stackable-operator/crds/DummyCluster.yaml

@@ -17,7 +17,7 @@ spec:
     name: v1alpha1
     schema:
       openAPIV3Schema:
-        description: Auto-generated derived type for ListenerSpec via `CustomResource`
+        description: Exposes a set of Pods to the outside world.
         properties:
           spec:
             description: |-