feat: Add v1alpha2 for SecretClass, rename experimentalGenerateSamAccountName #634

sbernauer · 2025-08-22T07:46:41Z

Note

Load-balancing over the secret-op DaemonSet Pods seems to work fine, but we should also test it on a cloud provider with multiple nodes as well.

This PR marks samAccountName as non-experimental as per #627. It is the first use of the stackable-versioned macro as well as the conversion webhook machinery.

Note

This PR makes changes to things that are templated by operator-templating! We are aware of this and will have a diff until we roll this out to all operators and update operator-templating. secret-operator is our guinea-pig

_test.yaml

rust/operator-binary/src/webhooks/conversion.rs

crds.yaml

Techassi

I think this is mostly done, but I left a few small comments/reminders.

Cargo.toml

Techassi · 2025-09-09T08:18:16Z

Makefile

+	mkdir -p extra
+	cargo run --bin stackable-"${OPERATOR_NAME}" -- crd > extra/crds.yaml


This eventually needs to be upstreamed into operator-templating.

Added a comment in the PR description about this

Techassi · 2025-09-09T08:19:18Z

Tiltfile

+k8s_yaml(helm(
+   'deploy/helm/' + operator_name,
+   name=operator_name,
+   namespace="stackable-operators",
+   set=[
+      'image.repository=' + registry + '/' + operator_name,
+      'telemetry.consoleLog.level=trace,h2=off',
+   ],
+))


Also needs to be upstreamed into operator-templating.

Added a comment in the PR description about this

rust/operator-binary/src/webhooks/conversion.rs

sbernauer · 2025-09-16T13:07:52Z

I can not approve my own PR but LGTM

sbernauer · 2025-09-18T06:06:54Z

deploy/helm/secret-operator/crds/crds.yaml

@razvan reported

❯ helm upgrade --install --namespace stackable-operators secret-operator deploy/helm/secret-operator/ Error: unable to build kubernetes objects from release manifest: resource mapping not found for name: "tls" namespace: "" from "": no matches for kind "SecretClass" in version "secrets.stackable.tech/v1alpha1" ensure CRDs are installed first

I guess the easiest solution is to move the SecretClass creation into a Job, WDYT?

can we have an initial crd deployment done by Helm/OLM as before?

I would vote "no". There should be no need for it, as the operator immediately deploys it when starting up for the first time.

This moved into a decision: https://github.com/stackabletech/decisions/issues/62.

razvan · 2025-09-19T10:58:36Z

I'll put this here for lack of a better place now.

I tried installing this op version with OLM on OpenShift.

OLM of course has the same problem as Helm (see comment above). It tries to create a tls secret class but there is no CRD for it.

I manually added the exported CRDs to OLM, but then the operator refuses to start with this error:

secret-operator 2025-09-19T10:47:38.191165Z  INFO reconcile_crds: stackable_webhook::servers::conversion: Reconciling CRDs crds=["secretclasses.secrets.sta
kable.tech", "truststores.secrets.stackable.tech"[]
secret-operator Error: failed to run conversion webhook
secret-operator
secret-operator Caused by:
secret-operator     0: failed to reconcile CRDs
secret-operator     1: failed to update CRD "secretclasses.secrets.stackable.tech"
secret-operator     2: ApiError: Apply failed with 2 conflicts: conflicts with "catalog" using apiextensions.k8s.io/v1:
secret-operator        - .spec.versions
secret-operator        - .spec.conversion.strategy: Conflict (ErrorResponse { status: "Failure", message: "Apply failed with 2 conflicts: conflicts with \"
catalog\" using apiextensions.k8s.io/v1:\n- .spec.versions\n- .spec.conversion.strategy", reason: "Conflict", code: 409 })
secret-operator     3: Apply failed with 2 conflicts: conflicts with "catalog" using apiextensions.k8s.io/v1:
secret-operator        - .spec.versions
secret-operator        - .spec.conversion.strategy: Conflict
stream closed EOF for stackable-operators/secret-operator-daemonset-zvvdt (secret-operator)

No idea if this is expected or a bug.

My 2 cents: I don't know why you decided to take CRD management out of the hands of package managers because I don't remember discussing it and I find no explanation. But I think one implication of this is that we now have to implement Helm ourselves by having to ensure object creation order at least.

razvan · 2025-09-19T15:04:44Z

Tests on OKD are 🟢 though no test was added or updated for this PR.

I removed tls from the OLM manifests and installed it manually after the operator installation.

Then I ran the test suite:

❯ ./scripts/run-tests --skip-operator secret --test-suite openshift
...
--- PASS: kuttl (217.55s)
    --- PASS: kuttl/harness (0.00s)
        --- PASS: kuttl/harness/listener_openshift-true (78.90s)
        --- PASS: kuttl/harness/tls_openshift-true_rsa-key-length-2048_custom-secret-names-True (90.95s)
        --- PASS: kuttl/harness/tls_openshift-true_rsa-key-length-3072_custom-secret-names-True (47.89s)
        --- PASS: kuttl/harness/tls_openshift-true_rsa-key-length-3072_custom-secret-names-False (29.27s)
        --- PASS: kuttl/harness/tls-truststore_openshift-true_truststore-target-kind-Secret (11.55s)
        --- PASS: kuttl/harness/kerberos_krb5-1.21.1_openshift-true (80.06s)
        --- PASS: kuttl/harness/tls-truststore_openshift-true_truststore-target-kind-ConfigMap (10.13s)
        --- PASS: kuttl/harness/tls_openshift-true_rsa-key-length-2048_custom-secret-names-False (26.14s)
        --- PASS: kuttl/harness/cert-manager-tls_openshift-true (35.56s)
PASS

feat: Introduce CRD versioning

dd0c321

sbernauer commented Aug 22, 2025

View reviewed changes

_test.yaml Outdated Show resolved Hide resolved

rust/operator-binary/src/webhooks/conversion.rs Outdated Show resolved Hide resolved

sbernauer added 3 commits September 2, 2025 08:55

Merge remote-tracking branch 'origin/main' into feat/crd-versioning

fae2648

Add SecretClass and TrustStore to conversion webhook

3bc0563

Remove testing Person struct

ffcc13d

Techassi self-assigned this Sep 2, 2025

This was referenced Sep 2, 2025

fix(stackable-versioned): Correctly emit enum fields in From impls stackabletech/operator-rs#1086

Merged

refactor(stackable-versioned): Introduce idents for fields/variants stackabletech/operator-rs#1088

Merged

Techassi added 6 commits September 5, 2025 12:41

temp: Temporarily patch stackable-operator

82138a5

chore: Handle CRD management CLI flag

781bdb5

feat: Add v1alpha2, rename experimentalGenerateSamAccountName

bb3f331

chore: Add rendered CRD

f6088b7

chore: Enable trace console logging in Tiltfile

5b29a38

chore: Remove commented-out macro argument

b6ac8a1

Techassi reviewed Sep 5, 2025

View reviewed changes

crds.yaml Show resolved Hide resolved

chore: Separate SecretClass and TrustStore specs

5935ac1

Techassi added this to Stackable Engineering Sep 8, 2025

Techassi moved this to Development: In Progress in Stackable Engineering Sep 8, 2025

Techassi mentioned this pull request Sep 8, 2025

feat(stackable-versioned): Add argument to hint for wrapped types stackabletech/operator-rs#1089

Merged

Techassi added 3 commits September 9, 2025 10:05

chore: Merge branch 'main' into feat/crd-versioning

aaa53f3

chore: Move generated CRDs into folder

2c40510

chore: Use main branch for stackable-operator

2ea2060

Techassi reviewed Sep 9, 2025

View reviewed changes

Techassi added 2 commits September 9, 2025 10:38

docs: Fix TrustStore reference

0f9fa29

chore: Use single try_join!

c532029

Techassi marked this pull request as ready for review September 9, 2025 08:41

Techassi moved this from Development: In Progress to Development: Waiting for Review in Stackable Engineering Sep 9, 2025

Techassi changed the title ~~feat: Introduce CRD versioning~~ feat: Add v1alpha2 for SecretClass, rename experimentalGenerateSamAccountName Sep 9, 2025

Techassi and others added 2 commits September 9, 2025 12:08

chore: Use default socket address constant

3e7f87a

Use op-rs 0.97.0

29ccbdf

sbernauer force-pushed the feat/crd-versioning branch from 761a56c to 29ccbdf Compare September 16, 2025 12:55

sbernauer added 2 commits September 16, 2025 14:56

nix

09cbad6

Merge remote-tracking branch 'origin/main' into feat/crd-versioning

8098b86

sbernauer moved this from Development: Waiting for Review to Development: In Review in Stackable Engineering Sep 16, 2025

sbernauer commented Sep 18, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

feat: Add v1alpha2 for SecretClass, rename experimentalGenerateSamAccountName #634

feat: Add v1alpha2 for SecretClass, rename experimentalGenerateSamAccountName #634

Uh oh!

sbernauer commented Aug 22, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Techassi left a comment

Uh oh!

Uh oh!

Techassi Sep 9, 2025 •

edited

Loading

Uh oh!

sbernauer Sep 15, 2025

Uh oh!

Techassi Sep 9, 2025

Uh oh!

sbernauer Sep 15, 2025

Uh oh!

Uh oh!

sbernauer commented Sep 16, 2025

Uh oh!

sbernauer Sep 18, 2025

Uh oh!

razvan Sep 18, 2025

Uh oh!

Techassi Sep 19, 2025

Uh oh!

Techassi Sep 19, 2025

Uh oh!

razvan commented Sep 19, 2025 •

edited

Loading

Uh oh!

razvan commented Sep 19, 2025 •

edited

Loading

Uh oh!

Uh oh!

		mkdir -p extra
		cargo run --bin stackable-"${OPERATOR_NAME}" -- crd > extra/crds.yaml

Uh oh!

feat: Add v1alpha2 for SecretClass, rename experimentalGenerateSamAccountName #634

Are you sure you want to change the base?

feat: Add v1alpha2 for SecretClass, rename experimentalGenerateSamAccountName #634

Uh oh!

Conversation

sbernauer commented Aug 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Techassi left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Techassi Sep 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sbernauer Sep 15, 2025

Choose a reason for hiding this comment

Uh oh!

Techassi Sep 9, 2025

Choose a reason for hiding this comment

Uh oh!

sbernauer Sep 15, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sbernauer commented Sep 16, 2025

Uh oh!

sbernauer Sep 18, 2025

Choose a reason for hiding this comment

Uh oh!

razvan Sep 18, 2025

Choose a reason for hiding this comment

Uh oh!

Techassi Sep 19, 2025

Choose a reason for hiding this comment

Uh oh!

Techassi Sep 19, 2025

Choose a reason for hiding this comment

Uh oh!

razvan commented Sep 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

razvan commented Sep 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

sbernauer commented Aug 22, 2025 •

edited

Loading

Techassi Sep 9, 2025 •

edited

Loading

razvan commented Sep 19, 2025 •

edited

Loading

razvan commented Sep 19, 2025 •

edited

Loading