Merge branch 'main' into bump/hbase-2.6.1

Author: dervoeti

stacks/data-lakehouse-iceberg-trino-spark/trino.yaml

@@ -114,7 +114,7 @@ metadata:
   name: opa
 spec:
   image:
-    productVersion: 1.0.0
+    productVersion: 1.0.1
   servers:
     roleGroups:
       default: {}

stacks/dual-hive-hdfs-s3/trino.yaml

@@ -86,7 +86,7 @@ metadata:
   name: opa
 spec:
   image:
-    productVersion: 1.0.0
+    productVersion: 1.0.1
   servers:
     roleGroups:
       default:

stacks/end-to-end-security/opa.yaml

@@ -5,7 +5,7 @@ metadata:
   name: opa
 spec:
   image:
-    productVersion: 1.0.0
+    productVersion: 1.0.1
   clusterConfig:
     userInfo:
       backend:

stacks/end-to-end-security/rbac.yaml

@@ -0,0 +1,35 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: superset-job-rb
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: superset-job-role
+subjects:
+- apiGroup: rbac.authorization.k8s.io
+  kind: Group
+  name: system:serviceaccounts
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: superset-job-role
+rules:
+  - apiGroups:
+      - batch
+    resources:
+      - jobs
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - apps
+    resources:
+      - statefulsets
+    verbs:
+      - get
+      - list
+      - watch

stacks/end-to-end-security/setup-postgresql.yaml

@@ -0,0 +1,50 @@
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: setup-db-job
+spec:
+  template:
+    spec:
+      initContainers:
+        # The postgres image does not contain curl or wget...
+        - name: download-dump
+          image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable0.0.0-dev
+          command:
+            - bash
+            - -c
+            - |
+              kubectl rollout status --watch statefulset/postgresql-superset
+              cd /tmp
+              curl --fail -O https://raw.githubusercontent.com/stackabletech/demos/main/stacks/end-to-end-security/postgres_superset_dump.sql.gz
+              gunzip postgres_superset_dump.sql.gz
+
+              # We need to omit changing the users password, as otherwise the content in the Secrets does not match
+              # the actual password in Postgres.
+              grep -vwE '(CREATE ROLE postgres;|CREATE ROLE superset;|ALTER ROLE postgres|ALTER ROLE superset)' postgres_superset_dump.sql > /dump/postgres_superset_dump.sql
+          volumeMounts:
+            - name: dump
+              mountPath: /dump/
+      containers:
+        - name: restore-postgres
+          image: docker.io/bitnami/postgresql:16.1.0-debian-11-r11 # Same image as the bitnami postgres helm-chart is using
+          command:
+            - bash
+            - -c
+            - |
+              echo "Preparing restore..."
+              psql --host postgresql-superset --user postgres < /dump/postgres_superset_dump.sql
+          env:
+            - name: PGPASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: postgresql-superset
+                  key: postgres-password
+          volumeMounts:
+            - name: dump
+              mountPath: /dump/
+      volumes:
+        - name: dump
+          emptyDir: {}
+      restartPolicy: OnFailure
+  backoffLimit: 20

stacks/end-to-end-security/superset.yaml

@@ -21,49 +21,14 @@ spec:
         replicas: 1
     podOverrides:
       spec:
-        # We need to restore the postgres state before the superset container itself starts some database migrations
         initContainers:
-          # The postgres image does not contain curl or wget...
-          - name: download-dump
+          - name: wait-for-setup-db-job
             image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable0.0.0-dev
             command:
               - bash
               - -c
               - |
-                cd /tmp
-                curl --fail -O https://raw.githubusercontent.com/stackabletech/demos/main/stacks/end-to-end-security/postgres_superset_dump.sql.gz
-                gunzip postgres_superset_dump.sql.gz
-
-                # We need to omit changing the users password, as otherwise the content in the Secrets does not match
-                # the actual password in Postgres.
-                grep -vwE '(CREATE ROLE postgres;|CREATE ROLE superset;|ALTER ROLE postgres|ALTER ROLE superset)' postgres_superset_dump.sql > /dump/postgres_superset_dump.sql
-            volumeMounts:
-              - name: dump
-                mountPath: /dump/
-          - name: restore-postgres
-            image: docker.io/bitnami/postgresql:16.1.0-debian-11-r11 # Same image as the bitnami postgres helm-chart is using
-            command:
-              - bash
-              - -c
-              - |
-                if psql --host postgresql-superset --user postgres --csv -c "SELECT datname FROM pg_database where datname = 'superset' limit 1" | grep -q superset; then
-                  # The flask app will do any necessary migrations.
-                  echo "Skip restoring the DB as it already exists"
-                  exit 0
-                fi
-                psql --host postgresql-superset --user postgres < /dump/postgres_superset_dump.sql
-            env:
-              - name: PGPASSWORD
-                valueFrom:
-                  secretKeyRef:
-                    name: postgresql-superset
-                    key: postgres-password
-            volumeMounts:
-              - name: dump
-                mountPath: /dump/
-        volumes:
-          - name: dump
-            emptyDir: {}
+                kubectl wait --for=condition=complete job/setup-db-job
 ---
 apiVersion: v1
 kind: Secret

stacks/keycloak-opa-poc/opa.yaml

@@ -5,7 +5,7 @@ metadata:
   name: opa
 spec:
   image:
-    productVersion: 1.0.0
+    productVersion: 1.0.1
   servers:
     roleGroups:
       default: {}

stacks/observability/grafana-loki.yaml

@@ -5,7 +5,7 @@ name: loki
 repo:
   name: loki
   url: https://grafana.github.io/helm-charts
-version: 6.19.0
+version: 5.48.0
 options:
   loki:
     auth_enabled: false

stacks/observability/grafana-tempo.yaml

@@ -5,7 +5,9 @@ name: tempo
 repo:
   name: tempo
   url: https://grafana.github.io/helm-charts
-version: 1.13.0
+# Watch out for https://github.com/grafana/helm-charts/issues/3417
+# and https://github.com/grafana/helm-charts/pull/3503!
+version: 1.12.0
 options:
   tempo:
     server:

stacks/observability/jaeger.yaml

@@ -14,15 +14,8 @@ options:
     cassandra: false
   allInOne:
     enabled: true
-    extraEnv: []
-    service:
-      headless: true
-      collector:
-        otlp:
-          # http:
-          #   name: otlp-http
-          grpc:
-            name: otlp-grpc
+  storage:
+    type: memory
   agent:
     enabled: false
   collector: