feat: Add graceful shutdown (#894)

* feat: Add graceful shutdown

* chore: Update CRD documentation

* chore: Bump bytes crate to 1.11.1

Fixes RUSTSEC-2026-0007.

* chore: Add changelog entry

Author: Techassi

CHANGELOG.md

@@ -11,12 +11,9 @@ All notable changes to this project will be documented in this file.
 - Enable the [restart-controller](https://docs.stackable.tech/home/nightly/commons-operator/restarter/), so that the Pods are automatically restarted on config changes ([#888]).
 - Added support for `2.7.2` ([#893]).
 
-### Removed
-
-- Removed support for `1.27.0` and `2.4.0` ([#893]).
-
 ### Changed
 
+- Gracefully shutdown all concurrent tasks by forwarding the SIGTERM signal ([#894]).
 - BREAKING: Reworked authorization config to closer match the Apache NiFi internal authorizer interfaces ([#884]).
 
 ### Fixed
@@ -25,12 +22,17 @@ All notable changes to this project will be documented in this file.
 - The operator now utilizes the `.spec.clusterConfig.authorization.opa.package` property instead of hard-coding the package name to `nifi` ([#881]).
 - An `initialAdminUser` can now be provided for file-based authorization (e.g. LDAP) ([#884]).
 
+### Removed
+
+- Removed support for `1.27.0` and `2.4.0` ([#893]).
+
 [#870]: https://github.com/stackabletech/nifi-operator/pull/870
 [#881]: https://github.com/stackabletech/nifi-operator/pull/881
 [#884]: https://github.com/stackabletech/nifi-operator/pull/884
 [#885]: https://github.com/stackabletech/nifi-operator/pull/885
 [#888]: https://github.com/stackabletech/nifi-operator/pull/888
 [#893]: https://github.com/stackabletech/nifi-operator/pull/893
+[#894]: https://github.com/stackabletech/nifi-operator/pull/894
 
 ## [25.11.0] - 2025-11-07
 

Cargo.lock

@@ -11,7 +11,7 @@ repository = "https://github.com/stackabletech/nifi-operator"
 
 [workspace.dependencies]
 product-config = { git = "https://github.com/stackabletech/product-config.git", tag = "0.8.0" }
-stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", tag = "stackable-operator-0.102.0", features = ["telemetry", "versioned"] }
+stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", tag = "stackable-operator-0.105.0", features = ["telemetry", "versioned"] }
 
 anyhow = "1.0"
 built = { version = "0.8", features = ["chrono", "git2"] }

Cargo.nix

@@ -184,14 +184,7 @@ spec:
                               Since git-sync v4.x.x this field is mapped to the flag `--ref`.
                             type: string
                           credentialsSecret:
-                            description: |-
-                              The name of the Secret used to access the repository if it is not public.
-
-                              The referenced Secret must include two fields: `user` and `password`.
-                              The `password` field can either be an actual password (not recommended) or a GitHub token,
-                              as described in the git-sync [documentation].
-
-                              [documentation]: https://github.com/kubernetes/git-sync/tree/v4.2.4?tab=readme-ov-file#manual
+                            description: An optional secret used for git access.
                             nullable: true
                             type: string
                           depth:
@@ -221,7 +214,7 @@ spec:
                               [example]: https://docs.stackable.tech/home/nightly/airflow/usage-guide/mounting-dags#_example
                             type: object
                           repo:
-                            description: 'The git repository URL that will be cloned, for example: `https://github.com/stackabletech/airflow-operator`.'
+                            description: 'The git repository URL that will be cloned, for example: `https://github.com/stackabletech/airflow-operator` or `ssh://git@github.com:stackable-airflow/dags.git`.'
                             format: uri
                             type: string
                           wait:
@@ -996,7 +989,7 @@ spec:
                       default: {}
                       description: |-
                         In the `podOverrides` property you can define a
-                        [PodTemplateSpec](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#podtemplatespec-v1-core)
+                        [PodTemplateSpec](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#podtemplatespec-v1-core)
                         to override any property that can be set on a Kubernetes Pod.
                         Read the
                         [Pod overrides documentation](https://docs.stackable.tech/home/nightly/concepts/overrides#pod-overrides)
@@ -1596,7 +1589,7 @@ spec:
                             default: {}
                             description: |-
                               In the `podOverrides` property you can define a
-                              [PodTemplateSpec](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#podtemplatespec-v1-core)
+                              [PodTemplateSpec](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#podtemplatespec-v1-core)
                               to override any property that can be set on a Kubernetes Pod.
                               Read the
                               [Pod overrides documentation](https://docs.stackable.tech/home/nightly/concepts/overrides#pod-overrides)

Cargo.toml

@@ -28,6 +28,7 @@ use stackable_operator::{
     logging::controller::report_controller_reconciled,
     shared::yaml::SerializeOptions,
     telemetry::Tracing,
+    utils::signal::SignalWatcher,
 };
 
 use crate::{
@@ -88,9 +89,13 @@ async fn main() -> anyhow::Result<()> {
                 description = built_info::PKG_DESCRIPTION
             );
 
+            // Watches for the SIGTERM signal and sends a signal to all receivers, which gracefully
+            // shuts down all concurrent tasks below (EoS checker, controller).
+            let sigterm_watcher = SignalWatcher::sigterm()?;
+
             let eos_checker =
                 EndOfSupportChecker::new(built_info::BUILT_TIME_UTC, maintenance.end_of_support)?
-                    .run()
+                    .run(sigterm_watcher.handle())
                     .map(anyhow::Ok);
 
             let product_config = product_config.load(&[
@@ -133,7 +138,6 @@ async fn main() -> anyhow::Result<()> {
                     watch_namespace.get_api::<ConfigMap>(&client),
                     watcher::Config::default(),
                 )
-                .shutdown_on_signal()
                 .watches(
                     client
                         .get_api::<DeserializeGuard<auth_core::v1alpha1::AuthenticationClass>>(&()),
@@ -156,6 +160,7 @@ async fn main() -> anyhow::Result<()> {
                             .map(|nifi| ObjectRef::from_obj(&*nifi))
                     },
                 )
+                .graceful_shutdown_on(sigterm_watcher.handle())
                 .run(
                     controller::reconcile_nifi,
                     controller::error_policy,