feat!: Add a new CLI flag/env to disabling CRD maintenance

crates/stackable-operator/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+### Added
+
+- BREAKING: Add a new CLI flag/env to disabling CRD maintenance: `--disable-crd-maintenance` ([#1085]).
+
+[#1085]: https://github.com/stackabletech/operator-rs/pull/1085
+
 ## [0.96.0] - 2025-08-25
 
 ### Added

crates/stackable-operator/src/cli.rs

@@ -208,6 +208,7 @@ pub enum Command<Run: Args = ProductOperatorRun> {
 ///             operator_namespace: "stackable-operators".to_string(),
 ///             operator_service_name: "foo-operator".to_string(),
 ///         },
+///         disable_crd_maintenance: false,
 ///     },
 /// }));
 /// ```
@@ -245,6 +246,17 @@ pub struct ProductOperatorRun {
     /// Provides a specific namespace to watch (instead of watching all namespaces)
     #[arg(long, env, default_value = "")]
     pub watch_namespace: WatchNamespace,
+
+    /// Don't maintain the CustomResourceDefinitions (CRDs) the operator is responsible for.
+    ///
+    /// Maintenance includes creating the CRD initially, adding new versions and keeping the TLS
+    /// certificate of webhooks up to date. Turning this off can be desirable to reduce the RBAC
+    /// permission of the operators.
+    ///
+    /// WARNING: If you disable CRD maintenance you are responsible for maintaining it, including
+    /// the points above.
+    #[arg(long, env)]
+    pub disable_crd_maintenance: bool,
 }
 
 /// All the CLI arguments that all (or at least most) Stackable applications use.

crates/stackable-webhook/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+### Added
+
+- BREAKING: Support disabling CRD maintenance using a new boolean flag in `ConversionWebhookServer::new` ([#1085]).
+
+[#1085]: https://github.com/stackabletech/operator-rs/pull/1085
+
 ## [0.5.0] - 2025-08-21
 
 ### Changed

crates/stackable-webhook/src/servers/conversion.rs

@@ -91,17 +91,22 @@ pub struct ConversionWebhookServer {
     options: ConversionWebhookOptions,
     router: Router,
     client: Client,
+    maintain_crds: bool,
 }
 
 impl ConversionWebhookServer {
     /// Creates a new conversion webhook server, which expects POST requests being made to the
     /// `/convert/{crd name}` endpoint.
     ///
-    /// You need to provide two things for every CRD passed in via the `crds_and_handlers` argument:
+    /// You need to provide a few things for every CRD passed in via the `crds_and_handlers` argument:
     ///
     /// 1. The CRD
     /// 2. A conversion function to convert between CRD versions. Typically you would use the
-    ///   the auto-generated `try_convert` function on CRD spec definition structs for this.
+    ///    the auto-generated `try_convert` function on CRD spec definition structs for this.
+    /// 3. A [`kube::Client`] used to create/update the CRDs.
+    /// 4. If we should maintain the CRDs. Use `stackable_operator::cli::ProductOperatorRun::disable_crd_maintenance`
+    /// for this.
+    // # Because of https://github.com/rust-lang/cargo/issues/3475 we can not use a real link here
     ///
     /// The [`ConversionWebhookServer`] takes care of reconciling the CRDs into the Kubernetes
     /// cluster and takes care of adding itself as conversion webhook. This includes TLS
@@ -119,14 +124,18 @@ impl ConversionWebhookServer {
     /// use stackable_operator::{
     ///     kube::Client,
     ///     crd::s3::{S3Connection, S3ConnectionVersion},
-    ///     cli::OperatorEnvironmentOptions,
+    ///     cli::ProductOperatorRun,
     /// };
     ///
     /// # async fn test() {
     /// // Things that should already be in you operator:
     /// const OPERATOR_NAME: &str = "product-operator";
     /// let client = Client::try_default().await.expect("failed to create Kubernetes client");
-    /// let operator_environment = OperatorEnvironmentOptions::parse();
+    /// let ProductOperatorRun {
+    ///     operator_environment,
+    ///     disable_crd_maintenance,
+    ///     ..
+    /// } = ProductOperatorRun::parse();
     ///
     ///  let crds_and_handlers = [
     ///     (
@@ -150,6 +159,7 @@ impl ConversionWebhookServer {
     ///     crds_and_handlers,
     ///     options,
     ///     client,
+    ///     !disable_crd_maintenance,
     /// )
     /// .await
     /// .expect("failed to create ConversionWebhookServer");
@@ -165,6 +175,7 @@ impl ConversionWebhookServer {
         crds_and_handlers: impl IntoIterator<Item = (CustomResourceDefinition, H)>,
         options: ConversionWebhookOptions,
         client: Client,
+        maintain_crds: bool,
     ) -> Result<Self, ConversionWebhookError>
     where
         H: WebhookHandler<ConversionReview, ConversionReview> + Clone + Send + Sync + 'static,
@@ -190,6 +201,7 @@ impl ConversionWebhookServer {
             router,
             client,
             crds,
+            maintain_crds,
         })
     }
 
@@ -201,6 +213,7 @@ impl ConversionWebhookServer {
             router,
             client,
             crds,
+            maintain_crds,
         } = self;
 
         let ConversionWebhookOptions {
@@ -233,28 +246,34 @@ impl ConversionWebhookServer {
             .recv()
             .await
             .context(ReceiveCertificateFromChannelSnafu)?;
-        Self::reconcile_crds(
-            &client,
-            field_manager,
-            &crds,
-            operator_namespace,
-            operator_service_name,
-            current_cert,
-        )
-        .await
-        .context(ReconcileCrdsSnafu)?;
-
-        try_join!(
-            Self::run_webhook_server(server),
-            Self::run_crd_reconciliation_loop(
-                cert_rx,
+        if maintain_crds {
+            Self::reconcile_crds(
                 &client,
                 field_manager,
                 &crds,
                 operator_namespace,
                 operator_service_name,
-            ),
-        )?;
+                current_cert,
+            )
+            .await
+            .context(ReconcileCrdsSnafu)?;
+        }
+
+        if maintain_crds {
+            try_join!(
+                Self::run_webhook_server(server),
+                Self::run_crd_reconciliation_loop(
+                    cert_rx,
+                    &client,
+                    field_manager,
+                    &crds,
+                    operator_namespace,
+                    operator_service_name,
+                ),
+            )?;
+        } else {
+            Self::run_webhook_server(server).await?;
+        };
 
         Ok(())
     }