feat: Enable restart controller

CHANGELOG.md

@@ -8,6 +8,7 @@ All notable changes to this project will be documented in this file.
 
 - Support objectOverrides using `.spec.objectOverrides`.
   See [objectOverrides concepts page](https://docs.stackable.tech/home/nightly/concepts/overrides/#object-overrides) for details ([#885]).
+- Enable the [restart-controller](https://docs.stackable.tech/home/nightly/commons-operator/restarter/), so that the Pods are automatically restarted on config changes ([#888]).
 
 ### Changed
 
@@ -23,6 +24,7 @@ All notable changes to this project will be documented in this file.
 [#881]: https://github.com/stackabletech/nifi-operator/pull/881
 [#884]: https://github.com/stackabletech/nifi-operator/pull/884
 [#885]: https://github.com/stackabletech/nifi-operator/pull/885
+[#888]: https://github.com/stackabletech/nifi-operator/pull/888
 
 ## [25.11.0] - 2025-11-07
 

Cargo.toml

@@ -11,7 +11,7 @@ repository = "https://github.com/stackabletech/nifi-operator"
 
 [workspace.dependencies]
 product-config = { git = "https://github.com/stackabletech/product-config.git", tag = "0.8.0" }
-stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", tag = "stackable-operator-0.101.2", features = ["telemetry", "versioned"] }
+stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", tag = "stackable-operator-0.102.0", features = ["telemetry", "versioned"] }
 
 anyhow = "1.0"
 built = { version = "0.8", features = ["chrono", "git2"] }

rust/operator-binary/src/controller.rs

@@ -30,6 +30,7 @@ use stackable_operator::{
         product_image_selection::{self, ResolvedProductImage},
         rbac::build_rbac_resources,
     },
+    constants::RESTART_CONTROLLER_ENABLED_LABEL,
     crd::{authentication::oidc::v1alpha1::AuthenticationProvider, git_sync},
     k8s_openapi::{
         DeepMerge,
@@ -598,6 +599,10 @@ pub async fn reconcile_nifi(
                 .with_context(|_| ApplyRoleGroupConfigSnafu {
                     rolegroup: rolegroup.clone(),
                 })?;
+
+            // Note: The StatefulSet needs to be applied after all ConfigMaps and Secrets it mounts
+            // to prevent unnecessary Pod restarts.
+            // See https://github.com/stackabletech/commons-operator/issues/111 for details.
             ss_cond_builder.add(
                 cluster_resources
                     .add(client, rg_statefulset)
@@ -1416,6 +1421,7 @@ async fn build_node_rolegroup_statefulset(
             .context(ObjectMissingMetadataForOwnerRefSnafu)?
             .with_recommended_labels(recommended_object_labels)
             .context(MetadataBuildSnafu)?
+            .with_label(RESTART_CONTROLLER_ENABLED_LABEL.to_owned())
             .build(),
         spec: Some(StatefulSetSpec {
             pod_management_policy: Some("Parallel".to_string()),

tests/templates/kuttl/smoke_v1/30-assert.yaml

@@ -7,6 +7,10 @@ apiVersion: apps/v1
 kind: StatefulSet
 metadata:
   name: nifi-node-default
+  # generation: 1 # Im not sure why we end up with generation 2 instead of 1...
+  # But at least we don't have any unnecessary Pod restart :)
+  labels:
+    restarter.stackable.tech/enabled: "true"
 spec:
   template:
     spec:

tests/templates/kuttl/smoke_v1/30-install-nifi.yaml.j2

@@ -1,4 +1,39 @@
 ---
+apiVersion: authentication.stackable.tech/v1alpha1
+kind: AuthenticationClass
+metadata:
+  name: nifi-users
+spec:
+  provider:
+    static:
+      userCredentialsSecret:
+        name: nifi-users
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: nifi-users
+stringData:
+  admin: >
+    passwordWithSpecialCharacter\@<&>"'
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: nifi-sensitive-property-key
+stringData:
+  nifiSensitivePropsKey: mYsUp3rS3cr3tk3y
+---
+apiVersion: zookeeper.stackable.tech/v1alpha1
+kind: ZookeeperZnode
+metadata:
+  name: nifi-znode
+spec:
+  clusterRef:
+    name: zookeeper
+---
+# We need to create the NifiCluster last, so that the ConfigMaps/Secrets it mounts are already
+# existing to prevent unnecessary Pod restarts.
 apiVersion: nifi.stackable.tech/v1alpha1
 kind: NifiCluster
 metadata:
@@ -49,36 +84,3 @@ spec:
           "nifi.properties":
             "nifi.diagnostics.on.shutdown.enabled": "false"
             "nifi.diagnostics.on.shutdown.max.filecount": "20"
----
-apiVersion: authentication.stackable.tech/v1alpha1
-kind: AuthenticationClass
-metadata:
-  name: nifi-users
-spec:
-  provider:
-    static:
-      userCredentialsSecret:
-        name: nifi-users
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: nifi-users
-stringData:
-  admin: >
-    passwordWithSpecialCharacter\@<&>"'
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: nifi-sensitive-property-key
-stringData:
-  nifiSensitivePropsKey: mYsUp3rS3cr3tk3y
----
-apiVersion: zookeeper.stackable.tech/v1alpha1
-kind: ZookeeperZnode
-metadata:
-  name: nifi-znode
-spec:
-  clusterRef:
-    name: zookeeper

tests/templates/kuttl/smoke_v2/30-assert.yaml

@@ -7,6 +7,10 @@ apiVersion: apps/v1
 kind: StatefulSet
 metadata:
   name: nifi-node-default
+  # generation: 1 # Im not sure why we end up with generation 2 instead of 1...
+  # But at least we don't have any unnecessary Pod restart :)
+  labels:
+    restarter.stackable.tech/enabled: "true"
 spec:
   template:
     spec: