Merge branch 'main' into feat/service-discovery-and-exposition

Author: siegfriedweber

CHANGELOG.md

@@ -11,6 +11,7 @@ All notable changes to this project will be documented in this file.
 - Allow adding entries to the OpenSearch keystore ([#76]).
 - Support objectOverrides using `.spec.objectOverrides`.
   See [objectOverrides concepts page](https://docs.stackable.tech/home/nightly/concepts/overrides/#object-overrides) for details ([#93]).
+- Enable the [restart-controller](https://docs.stackable.tech/home/nightly/commons-operator/restarter/), so that the Pods are automatically restarted on config changes ([#97]).
 
 ### Changed
 
@@ -21,6 +22,7 @@ All notable changes to this project will be documented in this file.
 [#76]: https://github.com/stackabletech/opensearch-operator/pull/76
 [#91]: https://github.com/stackabletech/opensearch-operator/pull/91
 [#93]: https://github.com/stackabletech/opensearch-operator/pull/93
+[#97]: https://github.com/stackabletech/opensearch-operator/pull/97
 
 ## [25.11.0] - 2025-11-07
 

Cargo.lock

@@ -10,7 +10,7 @@ edition = "2024"
 repository = "https://github.com/stackabletech/opensearch-operator"
 
 [workspace.dependencies]
-stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", tag = "stackable-operator-0.101.2", features = ["telemetry", "versioned"] }
+stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", tag = "stackable-operator-0.102.0", features = ["telemetry", "versioned"] }
 
 built = { version = "0.8.0", features = ["chrono", "git2"] }
 clap = "4.5"

Cargo.nix

@@ -76,8 +76,6 @@ impl<'a> Applier<'a> {
         mut self,
         resources: KubernetesResources<Prepared>,
     ) -> Result<KubernetesResources<Applied>> {
-        let stateful_sets = self.add_resources(resources.stateful_sets).await?;
-
         let services = self.add_resources(resources.services).await?;
 
         let listeners = self.add_resources(resources.listeners).await?;
@@ -90,6 +88,11 @@ impl<'a> Applier<'a> {
 
         let pod_disruption_budgets = self.add_resources(resources.pod_disruption_budgets).await?;
 
+        // Note: The StatefulSet needs to be applied after all ConfigMaps and Secrets it mounts
+        // to prevent unnecessary Pod restarts.
+        // See https://github.com/stackabletech/commons-operator/issues/111 for details.
+        let stateful_sets = self.add_resources(resources.stateful_sets).await?;
+
         self.cluster_resources
             .delete_orphaned_resources(self.client)
             .await

Cargo.toml

@@ -7,6 +7,7 @@ use stackable_operator::{
         meta::ObjectMetaBuilder,
         pod::volume::{SecretFormat, SecretOperatorVolumeSourceBuilder, VolumeBuilder},
     },
+    constants::RESTART_CONTROLLER_ENABLED_LABEL,
     crd::listener::{self},
     k8s_openapi::{
         DeepMerge,
@@ -189,6 +190,7 @@ impl<'a> RoleGroupBuilder<'a> {
     pub fn build_stateful_set(&self) -> StatefulSet {
         let metadata = self
             .common_metadata(self.resource_names.stateful_set_name())
+            .with_label(RESTART_CONTROLLER_ENABLED_LABEL.to_owned())
             .build();
 
         let template = self.build_pod_template();
@@ -1090,7 +1092,8 @@ mod tests {
                         "app.kubernetes.io/name": "opensearch",
                         "app.kubernetes.io/role-group": "default",
                         "app.kubernetes.io/version": "3.1.0",
-                        "stackable.tech/vendor": "Stackable"
+                        "stackable.tech/vendor": "Stackable",
+                        "restarter.stackable.tech/enabled": "true"
                     },
                     "name": "my-opensearch-cluster-nodes-default",
                     "namespace": "default",
@@ -1745,6 +1748,7 @@ mod tests {
                 "spec": {
                     "className": "cluster-internal",
                     "extraPodSelectorLabels": {},
+                    "objectOverrides": [],
                     "ports": [
                         {
                             "name": "http",

crate-hashes.json

@@ -0,0 +1,96 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: opensearch-security-config
+stringData:
+  action_groups.yml: |
+    ---
+    _meta:
+      type: actiongroups
+      config_version: 2
+  allowlist.yml: |
+    ---
+    _meta:
+      type: allowlist
+      config_version: 2
+
+    config:
+      enabled: false
+  audit.yml: |
+    ---
+    _meta:
+      type: audit
+      config_version: 2
+
+    config:
+      enabled: false
+  config.yml: |
+    ---
+    _meta:
+      type: config
+      config_version: 2
+
+    config:
+      dynamic:
+        authc:
+          basic_internal_auth_domain:
+            description: Authenticate via HTTP Basic against internal users database
+            http_enabled: true
+            transport_enabled: true
+            order: 1
+            http_authenticator:
+              type: basic
+              challenge: true
+            authentication_backend:
+              type: intern
+        authz: {}
+  internal_users.yml: |
+    ---
+    # The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh
+
+    _meta:
+      type: internalusers
+      config_version: 2
+
+    admin:
+      hash: $2y$10$xRtHZFJ9QhG9GcYhRpAGpufCZYsk//nxsuel5URh0GWEBgmiI4Q/e
+      reserved: true
+      backend_roles:
+        - admin
+      description: OpenSearch admin user
+
+    kibanaserver:
+      hash: $2y$10$vPgQ/6ilKDM5utawBqxoR.7euhVQ0qeGl8mPTeKhmFT475WUDrfQS
+      reserved: true
+      description: OpenSearch Dashboards user
+  nodes_dn.yml: |
+    ---
+    _meta:
+      type: nodesdn
+      config_version: 2
+  roles.yml: |
+    ---
+    _meta:
+      type: roles
+      config_version: 2
+  roles_mapping.yml: |
+    ---
+    _meta:
+      type: rolesmapping
+      config_version: 2
+
+    all_access:
+      reserved: false
+      backend_roles:
+        - admin
+
+    kibana_server:
+      reserved: true
+      users:
+        - kibanaserver
+  tenants.yml: |
+    ---
+    _meta:
+      type: tenants
+      config_version: 2

rust/operator-binary/src/controller/apply.rs

@@ -9,6 +9,7 @@ timeout: 600
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
+  name: opensearch-nodes-cluster-manager
   labels:
     app.kubernetes.io/component: nodes
     app.kubernetes.io/instance: opensearch
@@ -17,7 +18,8 @@ metadata:
     app.kubernetes.io/role-group: cluster-manager
     app.kubernetes.io/version: {{ test_scenario['values']['opensearch'].split(',')[0] }}
     stackable.tech/vendor: Stackable
-  name: opensearch-nodes-cluster-manager
+    restarter.stackable.tech/enabled: "true"
+  generation: 1 # There should be no unneeded Pod restarts
   ownerReferences:
   - apiVersion: opensearch.stackable.tech/v1alpha1
     controller: true
@@ -380,6 +382,7 @@ status:
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
+  name: opensearch-nodes-data
   labels:
     app.kubernetes.io/component: nodes
     app.kubernetes.io/instance: opensearch
@@ -388,7 +391,8 @@ metadata:
     app.kubernetes.io/role-group: data
     app.kubernetes.io/version: {{ test_scenario['values']['opensearch'].split(',')[0] }}
     stackable.tech/vendor: Stackable
-  name: opensearch-nodes-data
+    restarter.stackable.tech/enabled: "true"
+  generation: 1 # There should be no unneeded Pod restarts
   ownerReferences:
   - apiVersion: opensearch.stackable.tech/v1alpha1
     controller: true