feat: Add v1alpha2 for SecretClass, rename experimentalGenerateSamAccountName #634

sbernauer · 2025-08-22T07:46:41Z

Note

Load-balancing over the secret-op DaemonSet Pods seems to work fine, but we should also test it on a cloud provider with multiple nodes as well.

This PR marks samAccountName as non-experimental as per #627. It is the first use of the stackable-versioned macro as well as the conversion webhook machinery.

Note

This PR makes changes to things that are templated by operator-templating! We are aware of this and will have a diff until we roll this out to all operators and update operator-templating. secret-operator is our guinea-pig

_test.yaml

rust/operator-binary/src/webhooks/conversion.rs

crds.yaml

Techassi

I think this is mostly done, but I left a few small comments/reminders.

Cargo.toml

Techassi · 2025-09-09T08:18:16Z

Makefile

+	mkdir -p extra
+	cargo run --bin stackable-"${OPERATOR_NAME}" -- crd > extra/crds.yaml


This eventually needs to be upstreamed into operator-templating.

Added a comment in the PR description about this

Techassi · 2025-09-09T08:19:18Z

Tiltfile

+k8s_yaml(helm(
+   'deploy/helm/' + operator_name,
+   name=operator_name,
+   namespace="stackable-operators",
+   set=[
+      'image.repository=' + registry + '/' + operator_name,
+      'telemetry.consoleLog.level=trace,h2=off',
+   ],
+))


Also needs to be upstreamed into operator-templating.

Added a comment in the PR description about this

rust/operator-binary/src/webhooks/conversion.rs

sbernauer · 2025-09-16T13:07:52Z

I can not approve my own PR but LGTM

sbernauer · 2025-09-18T06:06:54Z

deploy/helm/secret-operator/crds/crds.yaml

@razvan reported

❯ helm upgrade --install --namespace stackable-operators secret-operator deploy/helm/secret-operator/ Error: unable to build kubernetes objects from release manifest: resource mapping not found for name: "tls" namespace: "" from "": no matches for kind "SecretClass" in version "secrets.stackable.tech/v1alpha1" ensure CRDs are installed first

I guess the easiest solution is to move the SecretClass creation into a Job, WDYT?

can we have an initial crd deployment done by Helm/OLM as before?

I would vote "no". There should be no need for it, as the operator immediately deploys it when starting up for the first time.

This moved into a decision: https://github.com/stackabletech/decisions/issues/62.

This (and the connected decision) was discussed amongst @sbernauer, @NickLarsenNZ, and @razvan and we agreed this is the best way forward.

@razvan confirmed in #634 (comment) that the approach works, by manually creating the default custom resource. In the future, this will be done automatically by the operator.

razvan · 2025-09-19T10:58:36Z

I'll put this here for lack of a better place now.

I tried installing this op version with OLM on OpenShift.

OLM of course has the same problem as Helm (see comment above). It tries to create a tls secret class but there is no CRD for it.

I manually added the exported CRDs to OLM, but then the operator refuses to start with this error:

secret-operator 2025-09-19T10:47:38.191165Z  INFO reconcile_crds: stackable_webhook::servers::conversion: Reconciling CRDs crds=["secretclasses.secrets.sta
kable.tech", "truststores.secrets.stackable.tech"[]
secret-operator Error: failed to run conversion webhook
secret-operator
secret-operator Caused by:
secret-operator     0: failed to reconcile CRDs
secret-operator     1: failed to update CRD "secretclasses.secrets.stackable.tech"
secret-operator     2: ApiError: Apply failed with 2 conflicts: conflicts with "catalog" using apiextensions.k8s.io/v1:
secret-operator        - .spec.versions
secret-operator        - .spec.conversion.strategy: Conflict (ErrorResponse { status: "Failure", message: "Apply failed with 2 conflicts: conflicts with \"
catalog\" using apiextensions.k8s.io/v1:\n- .spec.versions\n- .spec.conversion.strategy", reason: "Conflict", code: 409 })
secret-operator     3: Apply failed with 2 conflicts: conflicts with "catalog" using apiextensions.k8s.io/v1:
secret-operator        - .spec.versions
secret-operator        - .spec.conversion.strategy: Conflict
stream closed EOF for stackable-operators/secret-operator-daemonset-zvvdt (secret-operator)

No idea if this is expected or a bug.

My 2 cents: I don't know why you decided to take CRD management out of the hands of package managers because I don't remember discussing it and I find no explanation. But I think one implication of this is that we now have to implement Helm ourselves by having to ensure object creation order at least.

razvan · 2025-09-19T15:04:44Z

Tests on OKD are 🟢 though no test was added or updated for this PR.

I removed tls from the OLM manifests and installed it manually after the operator installation.

Then I ran the test suite:

❯ ./scripts/run-tests --skip-operator secret --test-suite openshift
...
--- PASS: kuttl (217.55s)
    --- PASS: kuttl/harness (0.00s)
        --- PASS: kuttl/harness/listener_openshift-true (78.90s)
        --- PASS: kuttl/harness/tls_openshift-true_rsa-key-length-2048_custom-secret-names-True (90.95s)
        --- PASS: kuttl/harness/tls_openshift-true_rsa-key-length-3072_custom-secret-names-True (47.89s)
        --- PASS: kuttl/harness/tls_openshift-true_rsa-key-length-3072_custom-secret-names-False (29.27s)
        --- PASS: kuttl/harness/tls-truststore_openshift-true_truststore-target-kind-Secret (11.55s)
        --- PASS: kuttl/harness/kerberos_krb5-1.21.1_openshift-true (80.06s)
        --- PASS: kuttl/harness/tls-truststore_openshift-true_truststore-target-kind-ConfigMap (10.13s)
        --- PASS: kuttl/harness/tls_openshift-true_rsa-key-length-2048_custom-secret-names-False (26.14s)
        --- PASS: kuttl/harness/cert-manager-tls_openshift-true (35.56s)
PASS

This implements are very simple CR applier. This commit is a first step towards maintaining CRs in our operator. It is not refined and is missing various features to be usable in the real world.

feat: Introduce CRD versioning

dd0c321

sbernauer commented Aug 22, 2025

View reviewed changes

_test.yaml Outdated Show resolved Hide resolved

rust/operator-binary/src/webhooks/conversion.rs Outdated Show resolved Hide resolved

sbernauer added 3 commits September 2, 2025 08:55

Merge remote-tracking branch 'origin/main' into feat/crd-versioning

fae2648

Add SecretClass and TrustStore to conversion webhook

3bc0563

Remove testing Person struct

ffcc13d

Techassi self-assigned this Sep 2, 2025

This was referenced Sep 2, 2025

fix(stackable-versioned): Correctly emit enum fields in From impls stackabletech/operator-rs#1086

Merged

refactor(stackable-versioned): Introduce idents for fields/variants stackabletech/operator-rs#1088

Merged

Techassi added 6 commits September 5, 2025 12:41

temp: Temporarily patch stackable-operator

82138a5

chore: Handle CRD management CLI flag

781bdb5

feat: Add v1alpha2, rename experimentalGenerateSamAccountName

bb3f331

chore: Add rendered CRD

f6088b7

chore: Enable trace console logging in Tiltfile

5b29a38

chore: Remove commented-out macro argument

b6ac8a1

Techassi reviewed Sep 5, 2025

View reviewed changes

crds.yaml Show resolved Hide resolved

chore: Separate SecretClass and TrustStore specs

5935ac1

Techassi added this to Stackable Engineering Sep 8, 2025

Techassi moved this to Development: In Progress in Stackable Engineering Sep 8, 2025

Techassi mentioned this pull request Sep 8, 2025

feat(stackable-versioned): Add argument to hint for wrapped types stackabletech/operator-rs#1089

Merged

Techassi added 3 commits September 9, 2025 10:05

chore: Merge branch 'main' into feat/crd-versioning

aaa53f3

chore: Move generated CRDs into folder

2c40510

chore: Use main branch for stackable-operator

2ea2060

Techassi reviewed Sep 9, 2025

View reviewed changes

Techassi added 2 commits September 9, 2025 10:38

docs: Fix TrustStore reference

0f9fa29

chore: Use single try_join!

c532029

Techassi marked this pull request as ready for review September 9, 2025 08:41

Techassi moved this from Development: In Progress to Development: Waiting for Review in Stackable Engineering Sep 9, 2025

Techassi changed the title ~~feat: Introduce CRD versioning~~ feat: Add v1alpha2 for SecretClass, rename experimentalGenerateSamAccountName Sep 9, 2025

Techassi and others added 2 commits September 9, 2025 12:08

chore: Use default socket address constant

3e7f87a

Use op-rs 0.97.0

29ccbdf

sbernauer force-pushed the feat/crd-versioning branch from 761a56c to 29ccbdf Compare September 16, 2025 12:55

sbernauer added 2 commits September 16, 2025 14:56

nix

09cbad6

Merge remote-tracking branch 'origin/main' into feat/crd-versioning

8098b86

sbernauer moved this from Development: Waiting for Review to Development: In Review in Stackable Engineering Sep 16, 2025

sbernauer commented Sep 18, 2025

View reviewed changes

Techassi mentioned this pull request Sep 23, 2025

feat!: Add CRD maintainer stackabletech/operator-rs#1099

Open

sbernauer added the status/blocked label Sep 29, 2025

Techassi added 2 commits October 1, 2025 14:49

feat: Add simple CR applier

4a0c0b8

This implements are very simple CR applier. This commit is a first step towards maintaining CRs in our operator. It is not refined and is missing various features to be usable in the real world.

chore: Update CRD schema descriptions

5c54a30

		mkdir -p extra
		cargo run --bin stackable-"${OPERATOR_NAME}" -- crd > extra/crds.yaml

Uh oh!

feat: Add v1alpha2 for SecretClass, rename experimentalGenerateSamAccountName #634

Are you sure you want to change the base?

feat: Add v1alpha2 for SecretClass, rename experimentalGenerateSamAccountName #634

Uh oh!

Conversation

sbernauer commented Aug 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Techassi left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Techassi Sep 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sbernauer commented Sep 16, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

razvan commented Sep 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

razvan commented Sep 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

sbernauer commented Aug 22, 2025 •

edited

Loading

Techassi Sep 9, 2025 •

edited

Loading

razvan commented Sep 19, 2025 •

edited

Loading

razvan commented Sep 19, 2025 •

edited

Loading