From 251cb4deffc26da3f4eb1212dec308db4026d468 Mon Sep 17 00:00:00 2001 From: Andrew Kenworthy Date: Mon, 24 Aug 2026 14:24:37 +0200 Subject: [PATCH 1/4] add missing owns, early-exit reconcile and unit tests --- Cargo.lock | 115 +++++++-------- Cargo.nix | 133 +++++++++-------- Cargo.toml | 1 + .../templates/clusterrole-operator.yaml | 12 +- rust/operator-binary/Cargo.toml | 1 + rust/operator-binary/src/main.rs | 26 +++- rust/operator-binary/src/nifi_controller.rs | 138 ++++++++++++++++++ 7 files changed, 297 insertions(+), 129 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 3e2c2cb8..e4aadf5a 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -169,7 +169,7 @@ checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667" dependencies = [ "proc-macro2", "quote", - "syn 3.0.3", + "syn 3.0.4", ] [[package]] @@ -316,9 +316,9 @@ checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04" [[package]] name = "cc" -version = "1.4.3" +version = "1.4.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "509591b7bcd67f4ef775afad7662703b4935daaa6ec0e5605cfb1090b32a2b6d" +checksum = "0ad534f4357a5264cce5019c989cf66a4f0dc4e0d1b1d15f8aacec0ff7360273" dependencies = [ "find-msvc-tools", "jobserver", @@ -385,7 +385,7 @@ dependencies = [ "heck", "proc-macro2", "quote", - "syn 3.0.3", + "syn 3.0.4", ] [[package]] @@ -491,9 +491,9 @@ dependencies = [ [[package]] name = "crc32fast" -version = "1.5.0" +version = "1.5.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511" +checksum = "8498c871161e1742aaa9d52551b2d6ebdd4c3d45a3be423e3728f33b955be550" dependencies = [ "cfg-if", ] @@ -547,12 +547,12 @@ dependencies = [ [[package]] name = "darling" -version = "0.24.0" +version = "0.24.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "88490bf1b990d87eaaa7ac8aa887f629a08e7359765b4911faf63c3763347d23" +checksum = "ed17f5901b6630b993ca003def43f2f8ef4014fc13b047b57aad617ff32bc2ec" dependencies = [ - "darling_core 0.24.0", - "darling_macro 0.24.0", + "darling_core 0.24.1", + "darling_macro 0.24.1", ] [[package]] @@ -570,15 +570,15 @@ dependencies = [ [[package]] name = "darling_core" -version = "0.24.0" +version = "0.24.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "084e274f91c482280130e1e34e0b8d6e66776a060d7b6de7b84289ca778868c4" +checksum = "6837e2cf7485aaae18f86181d2f0e9a7ed297a025e220aeabf63fdebd3a2ddff" dependencies = [ "ident_case", "proc-macro2", "quote", "strsim", - "syn 3.0.3", + "syn 3.0.4", ] [[package]] @@ -594,13 +594,13 @@ dependencies = [ [[package]] name = "darling_macro" -version = "0.24.0" +version = "0.24.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "68f5792fa0d41cd2325ce0ffa64f0a340eaebd4971a3a0c5e1ffd2cc488a355e" +checksum = "2ac7135c3ef02b2f7833bbeb1be5ba7f966dcde8a87c6b87f65a778d71a02785" dependencies = [ - "darling_core 0.24.0", + "darling_core 0.24.1", "quote", - "syn 3.0.3", + "syn 3.0.4", ] [[package]] @@ -722,7 +722,7 @@ checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8" dependencies = [ "proc-macro2", "quote", - "syn 3.0.3", + "syn 3.0.4", ] [[package]] @@ -786,14 +786,14 @@ dependencies = [ "enum-ordinalize", "proc-macro2", "quote", - "syn 3.0.3", + "syn 3.0.4", ] [[package]] name = "either" -version = "1.17.0" +version = "1.18.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9e5e8f6c15a24b9a3ee5efec809ccd006d3b30e8b3bb63c39af737c7f87daa1d" +checksum = "252afb9ae5eaa683babdc6a068b3f5726eb19e05070c731f9b2a23a7c3e8ed34" [[package]] name = "elliptic-curve" @@ -859,7 +859,7 @@ checksum = "a65863d15a4ce2888bd2f0f543cc963d3879c3a022c8ee43f6141d479a3ac815" dependencies = [ "proc-macro2", "quote", - "syn 3.0.3", + "syn 3.0.4", ] [[package]] @@ -1019,7 +1019,7 @@ checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44" dependencies = [ "proc-macro2", "quote", - "syn 3.0.3", + "syn 3.0.4", ] [[package]] @@ -1160,9 +1160,9 @@ dependencies = [ [[package]] name = "h2" -version = "0.4.16" +version = "0.4.18" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a9f37a958b41b3b19ee2707c06439c0e9e547e847223eb791ecb0cb821c65e27" +checksum = "839c0e8a181239723652be9062bb56ca5bf5f64011f73b623f6f4fc59086a228" dependencies = [ "atomic-waker", "bytes", @@ -1440,9 +1440,9 @@ checksum = "e590f038c1464a96894fd6d10127e90a8be4509f56ff7ecef851b15cee0b7caa" [[package]] name = "icu_provider" -version = "2.3.0" +version = "2.3.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "92a7ed671a6aad807a8651a2e1782a6598fda9ce5185dd8158549e95a91c6428" +checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73" dependencies = [ "displaydoc", "icu_locale_core", @@ -1723,7 +1723,7 @@ name = "k8s-version" version = "0.1.3" source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.116.0#7b9f9ac9a76fa425ab27f2821377ef86571ca121" dependencies = [ - "darling 0.24.0", + "darling 0.24.1", "regex", "snafu 0.9.2", ] @@ -1869,9 +1869,9 @@ checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2" [[package]] name = "libgit2-sys" -version = "0.18.7+1.9.6" +version = "0.18.8+1.9.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "23c7391e4b9f4ffab1a624223cc1d7385ff9a678f490768add717de7ea2f4d89" +checksum = "7f7c568b25d7489bc3fb2988ed69ab111d2944d2f5fec3d5c987fe545ea97b50" dependencies = [ "cc", "libc", @@ -1914,9 +1914,9 @@ dependencies = [ [[package]] name = "log" -version = "0.4.33" +version = "0.4.34" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad" +checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6" [[package]] name = "matchers" @@ -2530,22 +2530,22 @@ dependencies = [ [[package]] name = "ref-cast" -version = "1.0.26" +version = "1.0.27" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "216e8f773d7923bcba9ceb86a86c93cabb3903a11872fc3f138c49630e50b96d" +checksum = "7e440fb4e4b4147295338efb76001ab9e4efc0e5839df2c47fc5ac2381d365c3" dependencies = [ "ref-cast-impl", ] [[package]] name = "ref-cast-impl" -version = "1.0.26" +version = "1.0.27" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2c9283685feec7d69af75fb0e858d5e7378f33fe4fc699383b2916ab9273e03c" +checksum = "92ecd8964f8453721699a1ed72037b0db49ce2f5a5138486ee89bed6f67cdf3a" dependencies = [ "proc-macro2", "quote", - "syn 3.0.3", + "syn 3.0.4", ] [[package]] @@ -2762,9 +2762,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" [[package]] name = "rustls-webpki" -version = "0.103.14" +version = "0.103.15" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0527518605e68109d875e248ea259b6758801cf165e4b2c2733ae3b51f12535a" +checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" dependencies = [ "ring", "rustls-pki-types", @@ -2824,7 +2824,7 @@ dependencies = [ "proc-macro2", "quote", "serde_derive_internals", - "syn 3.0.3", + "syn 3.0.4", ] [[package]] @@ -2941,7 +2941,7 @@ checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348" dependencies = [ "proc-macro2", "quote", - "syn 3.0.3", + "syn 3.0.4", ] [[package]] @@ -2952,7 +2952,7 @@ checksum = "f852137cce035d6a4df67ccce505ff6b3e9fd3a10e3e52b24dc71e650bb1a9bd" dependencies = [ "proc-macro2", "quote", - "syn 3.0.3", + "syn 3.0.4", ] [[package]] @@ -3203,6 +3203,7 @@ dependencies = [ "const_format", "fnv", "futures 0.3.34", + "http", "indoc", "pin-project", "pretty_assertions", @@ -3269,10 +3270,10 @@ name = "stackable-operator-derive" version = "0.3.1" source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.116.0#7b9f9ac9a76fa425ab27f2821377ef86571ca121" dependencies = [ - "darling 0.24.0", + "darling 0.24.1", "proc-macro2", "quote", - "syn 3.0.3", + "syn 3.0.4", ] [[package]] @@ -3337,7 +3338,7 @@ source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-ope dependencies = [ "convert_case", "convert_case_extras", - "darling 0.24.0", + "darling 0.24.1", "indoc", "itertools 0.15.0", "k8s-openapi", @@ -3345,7 +3346,7 @@ dependencies = [ "kube", "proc-macro2", "quote", - "syn 3.0.3", + "syn 3.0.4", ] [[package]] @@ -3443,9 +3444,9 @@ dependencies = [ [[package]] name = "syn" -version = "3.0.3" +version = "3.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3" +checksum = "e6275cddf4610d1775e6d1fe9469b2e77d0f39fd98fb7450901b821e0c53649f" dependencies = [ "proc-macro2", "quote", @@ -3509,7 +3510,7 @@ checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af" dependencies = [ "proc-macro2", "quote", - "syn 3.0.3", + "syn 3.0.4", ] [[package]] @@ -3607,7 +3608,7 @@ checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e" dependencies = [ "proc-macro2", "quote", - "syn 3.0.3", + "syn 3.0.4", ] [[package]] @@ -3979,9 +3980,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821" [[package]] name = "uuid" -version = "1.24.1" +version = "1.25.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2cefc03fd367c0c6d4305de1b312cf00248c4114f4a0418ce6a6af769e3b0bd9" +checksum = "f053576934f05a761a402421fbbe3d425d9366f75f978806a037b3ca481abecc" dependencies = [ "js-sys", "wasm-bindgen", @@ -4417,9 +4418,9 @@ dependencies = [ [[package]] name = "zerovec" -version = "0.11.7" +version = "0.11.8" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "94b5c6b5976d66c1d703c4fd17d3f5e43c8cedaacf604961b171adc7130896d8" +checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8" dependencies = [ "yoke", "zerofrom", @@ -4428,13 +4429,13 @@ dependencies = [ [[package]] name = "zerovec-derive" -version = "0.11.5" +version = "0.11.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9f212a141d820099d57ffafb9569be9617a6f27d3dc881fbee8fb56642f917a9" +checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da" dependencies = [ "proc-macro2", "quote", - "syn 3.0.3", + "syn 3.0.4", ] [[package]] diff --git a/Cargo.nix b/Cargo.nix index dd1cb000..2de85109 100644 --- a/Cargo.nix +++ b/Cargo.nix @@ -508,7 +508,7 @@ rec { } { name = "syn"; - packageId = "syn 3.0.3"; + packageId = "syn 3.0.4"; usesDefaultFeatures = false; features = [ "clone-impls" "full" "parsing" "printing" "proc-macro" "visit-mut" ]; } @@ -989,9 +989,9 @@ rec { }; "cc" = rec { crateName = "cc"; - version = "1.4.3"; + version = "1.4.4"; edition = "2021"; - sha256 = "0v9b5arr047vbihfbh3fmbd3aj9vf1i7dbdgfpvlwzynpjvr35ah"; + sha256 = "0wq26vvhzv5ci9gx3cfiw320skvaysf9i701wp668lks6ps39m8a"; dependencies = [ { name = "find-msvc-tools"; @@ -1220,7 +1220,7 @@ rec { } { name = "syn"; - packageId = "syn 3.0.3"; + packageId = "syn 3.0.4"; features = [ "full" ]; } ]; @@ -1528,9 +1528,9 @@ rec { }; "crc32fast" = rec { crateName = "crc32fast"; - version = "1.5.0"; + version = "1.5.1"; edition = "2021"; - sha256 = "04d51liy8rbssra92p0qnwjw8i9rm9c4m3bwy19wjamz1k4w30cl"; + sha256 = "0l75bfakpwr86wz45gm38lylrpgbssr529fmm6m445qy2rqwi644"; authors = [ "Sam Rijs " "Alex Crichton " @@ -1681,22 +1681,22 @@ rec { }; resolvedDefaultFeatures = [ "default" "suggestions" ]; }; - "darling 0.24.0" = rec { + "darling 0.24.1" = rec { crateName = "darling"; - version = "0.24.0"; + version = "0.24.1"; edition = "2021"; - sha256 = "08vx6iikfg7nz88ljnvnb5rqx819ys3si2mclym7xn4hp7qhnjc8"; + sha256 = "1v625grpyqddgaslgc0kzha41vzqy91yyg80ra9vjc363f8ga5zd"; authors = [ "Ted Driggs " ]; dependencies = [ { name = "darling_core"; - packageId = "darling_core 0.24.0"; + packageId = "darling_core 0.24.1"; } { name = "darling_macro"; - packageId = "darling_macro 0.24.0"; + packageId = "darling_macro 0.24.1"; } ]; features = { @@ -1746,11 +1746,11 @@ rec { }; resolvedDefaultFeatures = [ "strsim" "suggestions" ]; }; - "darling_core 0.24.0" = rec { + "darling_core 0.24.1" = rec { crateName = "darling_core"; - version = "0.24.0"; + version = "0.24.1"; edition = "2021"; - sha256 = "1i38i1vwm2a2p3knsyqd0rm7frkfil5lxqz1600ji0n4j57jfkh8"; + sha256 = "1zyxlb9ypzb3pzm0l8jy09x2kvd7x7qd50b1z0caxal5fk7y4dv8"; authors = [ "Ted Driggs " ]; @@ -1774,7 +1774,7 @@ rec { } { name = "syn"; - packageId = "syn 3.0.3"; + packageId = "syn 3.0.4"; features = [ "full" "extra-traits" ]; } ]; @@ -1810,11 +1810,11 @@ rec { ]; }; - "darling_macro 0.24.0" = rec { + "darling_macro 0.24.1" = rec { crateName = "darling_macro"; - version = "0.24.0"; + version = "0.24.1"; edition = "2021"; - sha256 = "0pimi94crlpzw72s18vi96ysw3il197sdzz0bhrd476ll0ppkxb8"; + sha256 = "1197l1qqsxssys3nnz58x36nv5kzpbjipsxv6dw2yazh7rf17ira"; procMacro = true; authors = [ "Ted Driggs " @@ -1822,7 +1822,7 @@ rec { dependencies = [ { name = "darling_core"; - packageId = "darling_core 0.24.0"; + packageId = "darling_core 0.24.1"; } { name = "quote"; @@ -1830,7 +1830,7 @@ rec { } { name = "syn"; - packageId = "syn 3.0.3"; + packageId = "syn 3.0.4"; } ]; @@ -2208,7 +2208,7 @@ rec { } { name = "syn"; - packageId = "syn 3.0.3"; + packageId = "syn 3.0.4"; } ]; features = { @@ -2416,13 +2416,13 @@ rec { } { name = "syn"; - packageId = "syn 3.0.3"; + packageId = "syn 3.0.4"; } ]; devDependencies = [ { name = "syn"; - packageId = "syn 3.0.3"; + packageId = "syn 3.0.4"; features = [ "full" ]; } ]; @@ -2434,9 +2434,9 @@ rec { }; "either" = rec { crateName = "either"; - version = "1.17.0"; + version = "1.18.0"; edition = "2021"; - sha256 = "07dagpwcfdzpkb1n7fxkx0q3nv80rnf81v7gwlz9ljx22mn8yply"; + sha256 = "0d7dx31sf8rakcgp63070ngb2vkjynrni866pnx879pawndgnai5"; features = { "default" = [ "std" ]; "serde" = [ "dep:serde" ]; @@ -2636,7 +2636,7 @@ rec { } { name = "syn"; - packageId = "syn 3.0.3"; + packageId = "syn 3.0.4"; } ]; features = { @@ -3095,7 +3095,7 @@ rec { } { name = "syn"; - packageId = "syn 3.0.3"; + packageId = "syn 3.0.4"; features = [ "full" ]; } ]; @@ -3631,9 +3631,9 @@ rec { }; "h2" = rec { crateName = "h2"; - version = "0.4.16"; + version = "0.4.18"; edition = "2021"; - sha256 = "09syqqhvh36b3rwyn8vjhiz597hfki1hcz3hwagb3cs1ifapmwx9"; + sha256 = "0a52hs8cakvg7xi3pxqi83vganyaasxn545ya8v74f8j3250x743"; authors = [ "Carl Lerche " "Sean McArthur " @@ -4618,9 +4618,9 @@ rec { }; "icu_provider" = rec { crateName = "icu_provider"; - version = "2.3.0"; + version = "2.3.1"; edition = "2024"; - sha256 = "0a343jlrb7jlb20xv1airslzv63559wf38jihrx81bba39kyv9wj"; + sha256 = "0wrydhwprwgyka3r3sw6276syjnlw6fpqr2zsm2srvxv7afvnyyj"; authors = [ "The ICU4X Project Developers" ]; @@ -5456,7 +5456,7 @@ rec { dependencies = [ { name = "darling"; - packageId = "darling 0.24.0"; + packageId = "darling 0.24.1"; optional = true; } { @@ -6119,10 +6119,10 @@ rec { }; "libgit2-sys" = rec { crateName = "libgit2-sys"; - version = "0.18.7+1.9.6"; + version = "0.18.8+1.9.7"; edition = "2021"; links = "git2"; - sha256 = "12ad5zmffzbivn57d47lg2kgjprqsz0kq8i4lsqzlkwz9cg3kir3"; + sha256 = "0l3vm5g59zl7r7aw7zpms922j78imdlyv219zg1rnj6p4n5mcz3z"; libName = "libgit2_sys"; libPath = "lib.rs"; authors = [ @@ -6260,9 +6260,9 @@ rec { }; "log" = rec { crateName = "log"; - version = "0.4.33"; + version = "0.4.34"; edition = "2021"; - sha256 = "1bd9dmk22pxgnf0h0slba6rz99zb0a0b2mdhpk8p92bp26ycbvhc"; + sha256 = "1ihkzn0m33ab79fcl4mkb04n5iwqzbxzyw7l7hazqkffaqzbvy7r"; authors = [ "The Rust Project Developers" ]; @@ -6276,11 +6276,12 @@ rec { "kv_unstable_sval" = [ "kv_sval" "kv_unstable" ]; "serde" = [ "serde_core" ]; "serde_core" = [ "dep:serde_core" ]; + "std" = [ "alloc" ]; "sval" = [ "dep:sval" ]; "sval_ref" = [ "dep:sval_ref" ]; "value-bag" = [ "dep:value-bag" ]; }; - resolvedDefaultFeatures = [ "std" ]; + resolvedDefaultFeatures = [ "alloc" "std" ]; }; "matchers" = rec { crateName = "matchers"; @@ -8174,9 +8175,9 @@ rec { }; "ref-cast" = rec { crateName = "ref-cast"; - version = "1.0.26"; + version = "1.0.27"; edition = "2021"; - sha256 = "0vdra0766jcc2czzqwhql41kkfyajdnai1pbkjxbq8vr7mvqyvi1"; + sha256 = "1hv5sf0j7b65gz2g57c3wp0fzr5r3807dywf6fap455lwjs0yi3y"; libName = "ref_cast"; authors = [ "David Tolnay " @@ -8191,9 +8192,9 @@ rec { }; "ref-cast-impl" = rec { crateName = "ref-cast-impl"; - version = "1.0.26"; + version = "1.0.27"; edition = "2021"; - sha256 = "0g70ff9an5i97cw9kijgzqrqydz7smcfic2zyydddizfbxl874ic"; + sha256 = "0fnzgkvddgl9xs3884x5ypi9rd0dgc1p5vd1k4b74lw49ybdiv4j"; procMacro = true; libName = "ref_cast_impl"; authors = [ @@ -8210,7 +8211,7 @@ rec { } { name = "syn"; - packageId = "syn 3.0.3"; + packageId = "syn 3.0.4"; } ]; @@ -9131,9 +9132,9 @@ rec { }; "rustls-webpki" = rec { crateName = "rustls-webpki"; - version = "0.103.14"; + version = "0.103.15"; edition = "2021"; - sha256 = "0njk28gvbqrsfg1b5r35y4f80n37kcjylj72fpc0k0g60n3529q5"; + sha256 = "1hhanq3lz384v4nccacnjfwsyy99n3yc6m6iw8kljz8yicfwzhzk"; libName = "webpki"; dependencies = [ { @@ -9334,13 +9335,13 @@ rec { } { name = "syn"; - packageId = "syn 3.0.3"; + packageId = "syn 3.0.4"; } ]; devDependencies = [ { name = "syn"; - packageId = "syn 3.0.3"; + packageId = "syn 3.0.4"; features = [ "extra-traits" ]; } ]; @@ -9706,7 +9707,7 @@ rec { } { name = "syn"; - packageId = "syn 3.0.3"; + packageId = "syn 3.0.4"; usesDefaultFeatures = false; features = [ "clone-impls" "derive" "parsing" "printing" "proc-macro" ]; } @@ -9738,7 +9739,7 @@ rec { } { name = "syn"; - packageId = "syn 3.0.3"; + packageId = "syn 3.0.4"; usesDefaultFeatures = false; features = [ "clone-impls" "derive" "parsing" "printing" ]; } @@ -10563,6 +10564,10 @@ rec { } ]; devDependencies = [ + { + name = "http"; + packageId = "http"; + } { name = "pretty_assertions"; packageId = "pretty_assertions"; @@ -10792,7 +10797,7 @@ rec { dependencies = [ { name = "darling"; - packageId = "darling 0.24.0"; + packageId = "darling 0.24.1"; } { name = "proc-macro2"; @@ -10804,7 +10809,7 @@ rec { } { name = "syn"; - packageId = "syn 3.0.3"; + packageId = "syn 3.0.4"; } ]; @@ -11076,7 +11081,7 @@ rec { } { name = "darling"; - packageId = "darling 0.24.0"; + packageId = "darling 0.24.1"; } { name = "indoc"; @@ -11113,7 +11118,7 @@ rec { } { name = "syn"; - packageId = "syn 3.0.3"; + packageId = "syn 3.0.4"; } ]; @@ -11405,11 +11410,11 @@ rec { }; resolvedDefaultFeatures = [ "clone-impls" "default" "derive" "extra-traits" "fold" "full" "parsing" "printing" "proc-macro" "visit" "visit-mut" ]; }; - "syn 3.0.3" = rec { + "syn 3.0.4" = rec { crateName = "syn"; - version = "3.0.3"; + version = "3.0.4"; edition = "2021"; - sha256 = "18srnql3cd39j9q6hf1az02p67rlr1rf6njx9zx4vxj9i3jvmsak"; + sha256 = "17v4ac61x0hvj1879ywqzlwhyzg7n9lr9zniwrsif3b1ykfmq9z6"; authors = [ "David Tolnay " ]; @@ -11574,7 +11579,7 @@ rec { } { name = "syn"; - packageId = "syn 3.0.3"; + packageId = "syn 3.0.4"; } ]; @@ -11938,7 +11943,7 @@ rec { } { name = "syn"; - packageId = "syn 3.0.3"; + packageId = "syn 3.0.4"; features = [ "full" ]; } ]; @@ -13324,9 +13329,9 @@ rec { }; "uuid" = rec { crateName = "uuid"; - version = "1.24.1"; + version = "1.25.0"; edition = "2021"; - sha256 = "1n8b7fg7dbx6ws64387l2i0qq900rw9b7qax63acdh37sczw1vrc"; + sha256 = "1k5y394cmcrpl038i5szyxk96pa27nzgn89480d7cnph6ilmflzh"; authors = [ "Ashley Mannix" "Dylan DPC" @@ -15401,9 +15406,9 @@ rec { }; "zerovec" = rec { crateName = "zerovec"; - version = "0.11.7"; + version = "0.11.8"; edition = "2021"; - sha256 = "1n4n109wgbbin5hljq6gmbnqqg74yp9igzf40gbw2rkdjyswddcl"; + sha256 = "1n3xlvyba8riys9s8awy4xp533phqycr78nbsmvdkh86g3hn815v"; authors = [ "The ICU4X Project Developers" ]; @@ -15447,9 +15452,9 @@ rec { }; "zerovec-derive" = rec { crateName = "zerovec-derive"; - version = "0.11.5"; + version = "0.11.6"; edition = "2021"; - sha256 = "1a8pz516ddcgxvxq3j1xgprac5wnprlrbyzsgzarj0423la2l8cz"; + sha256 = "1ni5j8v99x3fcf3l8kp64b7aq4vf8y22jshfq74xs9mxkp1nzprl"; procMacro = true; libName = "zerovec_derive"; authors = [ @@ -15466,7 +15471,7 @@ rec { } { name = "syn"; - packageId = "syn 3.0.3"; + packageId = "syn 3.0.4"; features = [ "extra-traits" ]; } ]; diff --git a/Cargo.toml b/Cargo.toml index cac97bdd..022f321b 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -18,6 +18,7 @@ clap = "4.6" const_format = "0.2" fnv = "1.0" futures = { version = "0.3", features = ["compat"] } +http = "1.3" indoc = "2.0" pin-project = "1.1" pretty_assertions = "1.4" diff --git a/deploy/helm/nifi-operator/templates/clusterrole-operator.yaml b/deploy/helm/nifi-operator/templates/clusterrole-operator.yaml index fa4777b2..4fd82ea6 100644 --- a/deploy/helm/nifi-operator/templates/clusterrole-operator.yaml +++ b/deploy/helm/nifi-operator/templates/clusterrole-operator.yaml @@ -28,7 +28,7 @@ rules: - patch - watch # ServiceAccount created per NifiCluster for workload pod identity. - # Applied via SSA and tracked for orphan cleanup. + # Applied via SSA and tracked for orphan cleanup, and owned by the controller. - apiGroups: - "" resources: @@ -39,6 +39,7 @@ rules: - get - list - patch + - watch # Sensitive properties key and (when OIDC) admin password Secret. Applied via SSA like every # other resource, but deliberately not owned by the NifiCluster, so they are never orphan-deleted # (which is also why no `list` is needed here). @@ -51,7 +52,7 @@ rules: - create - patch # RoleBinding created per NifiCluster to bind the product ClusterRole to the workload - # ServiceAccount. Applied via SSA and tracked for orphan cleanup. + # ServiceAccount. Applied via SSA and tracked for orphan cleanup, and owned by the controller. - apiGroups: - rbac.authorization.k8s.io resources: @@ -62,6 +63,7 @@ rules: - get - list - patch + - watch # Required to bind the product ClusterRole to per-cluster ServiceAccounts - apiGroups: - rbac.authorization.k8s.io @@ -84,7 +86,7 @@ rules: - list - patch - watch - # PodDisruptionBudget created per role. Applied via SSA and tracked for orphan cleanup. + # PodDisruptionBudget created per role. Applied via SSA and tracked for orphan cleanup, and owned by the controller. - apiGroups: - policy resources: @@ -95,6 +97,7 @@ rules: - get - list - patch + - watch # Required for maintaining the CRDs within the operator (including the conversion webhook info). # Also for the startup condition check before the controller can run. - apiGroups: @@ -120,7 +123,7 @@ rules: - create - patch # Listener created per role group for external access. Applied via SSA and tracked for orphan - # cleanup. + # cleanup, and owned by the controller. - apiGroups: - listeners.stackable.tech resources: @@ -131,6 +134,7 @@ rules: - get - list - patch + - watch # Primary CRD: watched by the controller and read during reconciliation. - apiGroups: - {{ include "operator.name" . }}.stackable.tech diff --git a/rust/operator-binary/Cargo.toml b/rust/operator-binary/Cargo.toml index 555e0a47..ee47fc91 100644 --- a/rust/operator-binary/Cargo.toml +++ b/rust/operator-binary/Cargo.toml @@ -29,6 +29,7 @@ tracing.workspace = true url.workspace = true [dev-dependencies] +http.workspace = true pretty_assertions.workspace = true rstest.workspace = true serde_yaml.workspace = true diff --git a/rust/operator-binary/src/main.rs b/rust/operator-binary/src/main.rs index fb8f637f..c174723c 100644 --- a/rust/operator-binary/src/main.rs +++ b/rust/operator-binary/src/main.rs @@ -10,11 +10,13 @@ use futures::{FutureExt, StreamExt, TryFutureExt}; use stackable_operator::{ YamlSchema, cli::{Command, RunArguments}, - crd::authentication::core as auth_core, + crd::{authentication::core as auth_core, listener}, eos::EndOfSupportChecker, k8s_openapi::api::{ apps::v1::StatefulSet, - core::v1::{ConfigMap, Service}, + core::v1::{ConfigMap, Service, ServiceAccount}, + policy::v1::PodDisruptionBudget, + rbac::v1::RoleBinding, }, kube::{ CustomResourceExt as _, ResourceExt, @@ -130,16 +132,32 @@ async fn main() -> anyhow::Result<()> { let config_map_store = nifi_controller.store(); let nifi_controller = nifi_controller + .owns( + watch_namespace.get_api::(&client), + watcher::Config::default(), + ) + .owns( + watch_namespace.get_api::(&client), + watcher::Config::default(), + ) + .owns( + watch_namespace.get_api::(&client), + watcher::Config::default(), + ) + .owns( + watch_namespace.get_api::(&client), + watcher::Config::default(), + ) .owns( watch_namespace.get_api::(&client), watcher::Config::default(), ) .owns( - watch_namespace.get_api::(&client), + watch_namespace.get_api::(&client), watcher::Config::default(), ) .owns( - watch_namespace.get_api::(&client), + watch_namespace.get_api::(&client), watcher::Config::default(), ) .watches( diff --git a/rust/operator-binary/src/nifi_controller.rs b/rust/operator-binary/src/nifi_controller.rs index 3ded94cd..8580aaa9 100644 --- a/rust/operator-binary/src/nifi_controller.rs +++ b/rust/operator-binary/src/nifi_controller.rs @@ -14,6 +14,7 @@ use stackable_operator::{ client::Client, cluster_resources::ClusterResourceApplyStrategy, kube::{ + Resource, core::{DeserializeGuard, error_boundary}, runtime::controller::Action, }, @@ -79,6 +80,11 @@ pub async fn reconcile_nifi( ctx: Arc, ) -> Result { tracing::info!("Starting reconcile"); + + if nifi.meta().deletion_timestamp.is_some() { + return Ok(Action::await_change()); + } + let nifi = nifi .0 .as_ref() @@ -131,3 +137,135 @@ pub fn error_policy( _ => Action::requeue(*Duration::from_secs(10)), } } + +#[cfg(test)] +mod tests { + use std::{str::FromStr, sync::Arc}; + + use stackable_operator::{ + cli::OperatorEnvironmentOptions, + client::Client, + commons::networking::DomainName, + kube::{Client as KubeClient, Config, core::DeserializeGuard, runtime::controller::Action}, + utils::cluster_info::KubernetesClusterInfo, + }; + + use crate::{ + crd::v1alpha1, + nifi_controller::{Ctx, Error, reconcile_nifi}, + }; + + /// A [`Ctx`] whose client points at a closed port. Any API call made through it fails the + /// reconciliation, so an `Ok` result proves the reconciler returned before touching the + /// Kubernetes API. + fn unreachable_ctx() -> Arc { + let config = Config::new( + "http://127.0.0.1:1" + .parse::() + .expect("valid static URI"), + ); + let kube_client = KubeClient::try_from(config).expect("client from static config"); + + Arc::new(Ctx { + client: Client::new( + kube_client.clone(), + None, + "default".to_owned(), + KubernetesClusterInfo { + cluster_domain: DomainName::from_str("cluster.local") + .expect("valid cluster domain"), + }, + ), + operator_environment: OperatorEnvironmentOptions { + operator_namespace: "stackable-operators".to_owned(), + operator_service_name: "nifi-operator".to_owned(), + image_repository: "oci.stackable.tech/sdp".to_owned(), + }, + }) + } + + fn reconcile(nifi: DeserializeGuard) -> Result { + tokio::runtime::Builder::new_current_thread() + .enable_all() + .build() + .expect("current-thread tokio runtime") + .block_on(async { reconcile_nifi(Arc::new(nifi), unreachable_ctx()).await }) + } + + #[test] + fn reconcile_exits_early_for_deleted_cluster() { + let nifi = serde_yaml::from_str( + r#" +apiVersion: kafka.stackable.tech/v1alpha1 +kind: NifiCluster +metadata: + name: nifi + namespace: default + deletionTimestamp: "2026-08-14T12:00:00Z" +spec: + image: + productVersion: 2.9.0 +"#, + ) + .expect("valid cluster YAML"); + + let action = reconcile(nifi).expect("a deleted cluster reconciles without any API call"); + + assert_eq!(action, Action::await_change()); + } + + #[test] + fn reconcile_exits_early_for_deleted_cluster_with_invalid_spec() { + let nifi = serde_yaml::from_str( + r#" +apiVersion: nifi.stackable.tech/v1alpha1 +kind: NifiCluster +metadata: + name: nifi + namespace: default + deletionTimestamp: "2026-08-14T12:00:00Z" +spec: {} +"#, + ) + .expect("YAML parses; the invalid spec is captured inside the DeserializeGuard"); + + let action = + reconcile(nifi).expect("a deleted cluster reconciles even when its spec is invalid"); + + assert_eq!(action, Action::await_change()); + } + + #[test] + fn reconcile_proceeds_for_live_cluster() { + let nifi = serde_yaml::from_str( + r#" +apiVersion: kafka.stackable.tech/v1alpha1 +kind: NifiCluster +metadata: + name: nifi + namespace: default +spec: + image: + productVersion: 4.1.0 + clusterConfig: + zookeeperConfigMapName: nifi-znode + authentication: + - authenticationClass: nifi-users + sensitiveProperties: + keySecret: nifi-sensitive-property-key + nodes: + roleGroups: + default: + replicas: 1 +"#, + ) + .expect("valid cluster YAML"); + + let result = reconcile(nifi); + + assert!( + matches!(result, Err(Error::Dereference { .. })), + "a live cluster must reach the API but when dereferencing against the unreachable test server: {result:?}" + ); + } +} From e1f260664ed732499e2c9f60fa45f3e88a992326 Mon Sep 17 00:00:00 2001 From: Andrew Kenworthy Date: Mon, 24 Aug 2026 17:18:11 +0200 Subject: [PATCH 2/4] improve tests, consolidate rbac sections --- CHANGELOG.md | 3 + Cargo.lock | 1 - Cargo.nix | 4 - Cargo.toml | 1 - .../templates/clusterrole-operator.yaml | 19 +-- rust/operator-binary/Cargo.toml | 1 - rust/operator-binary/src/nifi_controller.rs | 133 +++++------------- .../kuttl/cluster_operation/60-assert.yaml | 94 +++++++++++++ .../60-delete-owned-resources.yaml | 65 +++++++++ 9 files changed, 199 insertions(+), 122 deletions(-) create mode 100644 tests/templates/kuttl/cluster_operation/60-assert.yaml create mode 100644 tests/templates/kuttl/cluster_operation/60-delete-owned-resources.yaml diff --git a/CHANGELOG.md b/CHANGELOG.md index bcde6e95..d6d40a3e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -39,6 +39,8 @@ All notable changes to this project will be documented in this file. - Fix a longstanding problem of including empty `categories`, `shortNames` and `additionalPrinterColumns` in the CRDs, which could cause problems with GitOps tools (e.g. ArgoCD) reporting a diff in the custom resources. See [our internal issue](https://github.com/stackabletech/hdfs-operator/issues/626) and [the fix](https://github.com/kube-rs/kube/pull/2042) for details ([#975]). +- The operator now watches all resources that it creates and early-exits the reconcile action when the + cluster is marked for deletion ([#985]). [#961]: https://github.com/stackabletech/nifi-operator/pull/961 [#966]: https://github.com/stackabletech/nifi-operator/pull/966 @@ -48,6 +50,7 @@ All notable changes to this project will be documented in this file. [#976]: https://github.com/stackabletech/nifi-operator/pull/976 [#982]: https://github.com/stackabletech/nifi-operator/pull/982 [#984]: https://github.com/stackabletech/nifi-operator/pull/984 +[#985]: https://github.com/stackabletech/nifi-operator/pull/985 ## [26.7.0] - 2026-07-21 diff --git a/Cargo.lock b/Cargo.lock index e4aadf5a..dd430d7c 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3203,7 +3203,6 @@ dependencies = [ "const_format", "fnv", "futures 0.3.34", - "http", "indoc", "pin-project", "pretty_assertions", diff --git a/Cargo.nix b/Cargo.nix index 2de85109..47f64a76 100644 --- a/Cargo.nix +++ b/Cargo.nix @@ -10564,10 +10564,6 @@ rec { } ]; devDependencies = [ - { - name = "http"; - packageId = "http"; - } { name = "pretty_assertions"; packageId = "pretty_assertions"; diff --git a/Cargo.toml b/Cargo.toml index 022f321b..cac97bdd 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -18,7 +18,6 @@ clap = "4.6" const_format = "0.2" fnv = "1.0" futures = { version = "0.3", features = ["compat"] } -http = "1.3" indoc = "2.0" pin-project = "1.1" pretty_assertions = "1.4" diff --git a/deploy/helm/nifi-operator/templates/clusterrole-operator.yaml b/deploy/helm/nifi-operator/templates/clusterrole-operator.yaml index 4fd82ea6..f9339117 100644 --- a/deploy/helm/nifi-operator/templates/clusterrole-operator.yaml +++ b/deploy/helm/nifi-operator/templates/clusterrole-operator.yaml @@ -13,26 +13,15 @@ rules: - nodes/proxy verbs: - get - # Manage core workload resources created per NifiCluster. - # Applied via SSA and tracked for orphan cleanup. + # Manage core workload resources created per NifiCluster (the ServiceAccount + # provides workload pod identity). All are applied via SSA, tracked for orphan + # cleanup and owned by the controller. - apiGroups: - "" resources: - configmaps - - services - verbs: - - create - - delete - - get - - list - - patch - - watch - # ServiceAccount created per NifiCluster for workload pod identity. - # Applied via SSA and tracked for orphan cleanup, and owned by the controller. - - apiGroups: - - "" - resources: - serviceaccounts + - services verbs: - create - delete diff --git a/rust/operator-binary/Cargo.toml b/rust/operator-binary/Cargo.toml index ee47fc91..555e0a47 100644 --- a/rust/operator-binary/Cargo.toml +++ b/rust/operator-binary/Cargo.toml @@ -29,7 +29,6 @@ tracing.workspace = true url.workspace = true [dev-dependencies] -http.workspace = true pretty_assertions.workspace = true rstest.workspace = true serde_yaml.workspace = true diff --git a/rust/operator-binary/src/nifi_controller.rs b/rust/operator-binary/src/nifi_controller.rs index 8580aaa9..d7b6bff4 100644 --- a/rust/operator-binary/src/nifi_controller.rs +++ b/rust/operator-binary/src/nifi_controller.rs @@ -146,78 +146,19 @@ mod tests { cli::OperatorEnvironmentOptions, client::Client, commons::networking::DomainName, - kube::{Client as KubeClient, Config, core::DeserializeGuard, runtime::controller::Action}, + kube::{Client as KubeClient, Config, runtime::controller::Action}, utils::cluster_info::KubernetesClusterInfo, }; - use crate::{ - crd::v1alpha1, - nifi_controller::{Ctx, Error, reconcile_nifi}, - }; - - /// A [`Ctx`] whose client points at a closed port. Any API call made through it fails the - /// reconciliation, so an `Ok` result proves the reconciler returned before touching the - /// Kubernetes API. - fn unreachable_ctx() -> Arc { - let config = Config::new( - "http://127.0.0.1:1" - .parse::() - .expect("valid static URI"), - ); - let kube_client = KubeClient::try_from(config).expect("client from static config"); - - Arc::new(Ctx { - client: Client::new( - kube_client.clone(), - None, - "default".to_owned(), - KubernetesClusterInfo { - cluster_domain: DomainName::from_str("cluster.local") - .expect("valid cluster domain"), - }, - ), - operator_environment: OperatorEnvironmentOptions { - operator_namespace: "stackable-operators".to_owned(), - operator_service_name: "nifi-operator".to_owned(), - image_repository: "oci.stackable.tech/sdp".to_owned(), - }, - }) - } - - fn reconcile(nifi: DeserializeGuard) -> Result { - tokio::runtime::Builder::new_current_thread() - .enable_all() - .build() - .expect("current-thread tokio runtime") - .block_on(async { reconcile_nifi(Arc::new(nifi), unreachable_ctx()).await }) - } + use crate::nifi_controller::{Ctx, reconcile_nifi}; + /// The client points at a closed port, so any API call would fail the reconciliation: an `Ok` + /// proves that a cluster being deleted returns before the reconciler touches the Kubernetes + /// API, and because the spec is invalid, before the `DeserializeGuard` is unwrapped. #[test] fn reconcile_exits_early_for_deleted_cluster() { let nifi = serde_yaml::from_str( r#" -apiVersion: kafka.stackable.tech/v1alpha1 -kind: NifiCluster -metadata: - name: nifi - namespace: default - deletionTimestamp: "2026-08-14T12:00:00Z" -spec: - image: - productVersion: 2.9.0 -"#, - ) - .expect("valid cluster YAML"); - - let action = reconcile(nifi).expect("a deleted cluster reconciles without any API call"); - - assert_eq!(action, Action::await_change()); - } - - #[test] - fn reconcile_exits_early_for_deleted_cluster_with_invalid_spec() { - let nifi = serde_yaml::from_str( - r#" apiVersion: nifi.stackable.tech/v1alpha1 kind: NifiCluster metadata: @@ -229,43 +170,35 @@ spec: {} ) .expect("YAML parses; the invalid spec is captured inside the DeserializeGuard"); - let action = - reconcile(nifi).expect("a deleted cluster reconciles even when its spec is invalid"); + let action = tokio::runtime::Builder::new_current_thread() + .enable_all() + .build() + .expect("current-thread tokio runtime") + .block_on(async { + let ctx = Arc::new(Ctx { + client: Client::new( + KubeClient::try_from(Config::new( + "http://127.0.0.1:1".parse().expect("valid static URI"), + )) + .expect("client from static config"), + None, + "default".to_owned(), + KubernetesClusterInfo { + cluster_domain: DomainName::from_str("cluster.local") + .expect("valid cluster domain"), + }, + ), + operator_environment: OperatorEnvironmentOptions { + operator_namespace: "stackable-operators".to_owned(), + operator_service_name: "nifi-operator".to_owned(), + image_repository: "oci.stackable.tech/sdp".to_owned(), + }, + }); + + reconcile_nifi(Arc::new(nifi), ctx).await + }) + .expect("a deleted cluster reconciles without any API call"); assert_eq!(action, Action::await_change()); } - - #[test] - fn reconcile_proceeds_for_live_cluster() { - let nifi = serde_yaml::from_str( - r#" -apiVersion: kafka.stackable.tech/v1alpha1 -kind: NifiCluster -metadata: - name: nifi - namespace: default -spec: - image: - productVersion: 4.1.0 - clusterConfig: - zookeeperConfigMapName: nifi-znode - authentication: - - authenticationClass: nifi-users - sensitiveProperties: - keySecret: nifi-sensitive-property-key - nodes: - roleGroups: - default: - replicas: 1 -"#, - ) - .expect("valid cluster YAML"); - - let result = reconcile(nifi); - - assert!( - matches!(result, Err(Error::Dereference { .. })), - "a live cluster must reach the API but when dereferencing against the unreachable test server: {result:?}" - ); - } } diff --git a/tests/templates/kuttl/cluster_operation/60-assert.yaml b/tests/templates/kuttl/cluster_operation/60-assert.yaml new file mode 100644 index 00000000..7934bc22 --- /dev/null +++ b/tests/templates/kuttl/cluster_operation/60-assert.yaml @@ -0,0 +1,94 @@ +--- +# The recreated StatefulSet must bring the cluster back to ready, and the recreated +# objects must carry an owner reference back to the NifiCluster so that garbage +# collection still works for them. +apiVersion: kuttl.dev/v1beta1 +kind: TestAssert +metadata: + name: recreate-owned-resources +timeout: 600 +commands: + - script: kubectl -n $NAMESPACE wait --for=condition=available nificlusters.nifi.stackable.tech/test-nifi --timeout 601s +--- +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: test-nifi-node-default + ownerReferences: + - apiVersion: nifi.stackable.tech/v1alpha1 + controller: true + kind: NifiCluster + name: test-nifi +status: + readyReplicas: 2 + replicas: 2 +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: test-nifi-serviceaccount + ownerReferences: + - apiVersion: nifi.stackable.tech/v1alpha1 + controller: true + kind: NifiCluster + name: test-nifi +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: test-nifi-rolebinding + ownerReferences: + - apiVersion: nifi.stackable.tech/v1alpha1 + controller: true + kind: NifiCluster + name: test-nifi +--- +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: test-nifi-node + ownerReferences: + - apiVersion: nifi.stackable.tech/v1alpha1 + controller: true + kind: NifiCluster + name: test-nifi +--- +apiVersion: listeners.stackable.tech/v1alpha1 +kind: Listener +metadata: + name: test-nifi-node + ownerReferences: + - apiVersion: nifi.stackable.tech/v1alpha1 + controller: true + kind: NifiCluster + name: test-nifi +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: test-nifi-node-default + ownerReferences: + - apiVersion: nifi.stackable.tech/v1alpha1 + controller: true + kind: NifiCluster + name: test-nifi +--- +apiVersion: v1 +kind: Service +metadata: + name: test-nifi-node-default-headless + ownerReferences: + - apiVersion: nifi.stackable.tech/v1alpha1 + controller: true + kind: NifiCluster + name: test-nifi +--- +apiVersion: v1 +kind: Service +metadata: + name: test-nifi-node-default-metrics + ownerReferences: + - apiVersion: nifi.stackable.tech/v1alpha1 + controller: true + kind: NifiCluster + name: test-nifi diff --git a/tests/templates/kuttl/cluster_operation/60-delete-owned-resources.yaml b/tests/templates/kuttl/cluster_operation/60-delete-owned-resources.yaml new file mode 100644 index 00000000..e4f37a62 --- /dev/null +++ b/tests/templates/kuttl/cluster_operation/60-delete-owned-resources.yaml @@ -0,0 +1,65 @@ +# Every resource the operator applies carries an ownerReference and a `.owns()` watch +# (main.rs): deleting it must trigger a reconcile of the NifiCluster that re-applies it, +# proving the `.owns()` routing and the ClusterRole `watch` verbs end to end. +# `.watches()` registrations can't be tested this way: the operator never recreates +# what it didn't apply. +# +# Resources are discovered by label (ClusterResources::add enforces the labels on +# everything the operator applies), so new resources and kinds are covered +# automatically. Labels over-match on derived objects, so each match must also carry +# a controller ownerReference pointing at the NifiCluster; kinds that can never pass that +# gate are excluded up front. Recreation is proven by UID change, and a floor guard +# catches a selector that silently matches nothing. +# +# Secrets are excluded: the generated Secrets are generate-once values, deliberately +# unwatched (no `list`/`watch` RBAC). NiFi has no discovery ConfigMap, so the +# role-group ConfigMap carries the `.owns(ConfigMap)` coverage. +--- +apiVersion: kuttl.dev/v1beta1 +kind: TestStep +metadata: + name: delete-owned-resources +timeout: 300 +commands: + - script: | + set -eu + + delete_and_await_recreation() { + resource=$1 + old_uid=$(kubectl get -n "$NAMESPACE" "$resource" -o jsonpath='{.metadata.uid}') + kubectl delete -n "$NAMESPACE" "$resource" --wait=false + # Recreation is a single reconcile away, so this normally succeeds on the + # first iteration; 30s is a generous upper bound well below the step timeout. + for _ in $(seq 1 30); do + new_uid=$(kubectl get -n "$NAMESPACE" "$resource" -o jsonpath='{.metadata.uid}' 2>/dev/null || true) + if [ -n "$new_uid" ] && [ "$new_uid" != "$old_uid" ]; then + return 0 + fi + sleep 1 + done + echo "$resource was not recreated (old uid: $old_uid, current: '${new_uid:-}')" >&2 + return 1 + } + + selector="app.kubernetes.io/instance=test-nifi,app.kubernetes.io/managed-by=nifi.stackable.tech_nificluster" + excluded="^(pods|persistentvolumeclaims|endpoints|events|secrets)$|^endpointslices\.|^controllerrevisions\.|^events\." + + deleted=0 + for kind in $(kubectl api-resources --verbs=list --namespaced -o name | grep -Ev "$excluded" | sort); do + for resource in $(kubectl get -n "$NAMESPACE" "$kind" -l "$selector" -o name 2>/dev/null); do + owner=$(kubectl get -n "$NAMESPACE" "$resource" -o jsonpath='{.metadata.ownerReferences[?(@.controller==true)].kind}/{.metadata.ownerReferences[?(@.controller==true)].name}' 2>/dev/null || true) + if [ "$owner" != "NifiCluster/test-nifi" ]; then + echo "skipping $resource: controller owner is '${owner:-none}', not the NifiCluster" + continue + fi + delete_and_await_recreation "$resource" + deleted=$((deleted + 1)) + done + done + + # Guard against the sweep silently matching nothing (wrong selector, renamed + # labels): the fixture is known to produce well over this many owned resources. + if [ "$deleted" -lt 6 ]; then + echo "only $deleted labelled resources were swept - the label selector is broken" >&2 + exit 1 + fi From 5e86af5436bebf813f106a64044c4b26a7eff26f Mon Sep 17 00:00:00 2001 From: Andrew Kenworthy Date: Mon, 24 Aug 2026 17:59:23 +0200 Subject: [PATCH 3/4] fixed broken assert --- tests/templates/kuttl/cluster_operation/20-assert.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/templates/kuttl/cluster_operation/20-assert.yaml b/tests/templates/kuttl/cluster_operation/20-assert.yaml index ed248438..9dbca00b 100644 --- a/tests/templates/kuttl/cluster_operation/20-assert.yaml +++ b/tests/templates/kuttl/cluster_operation/20-assert.yaml @@ -32,11 +32,11 @@ spec: - -c - curl --fail --silent --show-error --output /dev/null http://127.0.0.1:52020/health readinessProbe: - failureThreshold: 3 + failureThreshold: 30 exec: command: - /bin/bash - -euo - pipefail - -c - - curl --fail --silent --show-error --output /dev/null http://127.0.0.1:52020/health/cluster + - "curl --fail --silent --show-error http://127.0.0.1:52020/health/cluster | grep -q 'Cluster Status: CONNECTED'" From f9b1755353620a6c1bc53f25bc051c12a98526b5 Mon Sep 17 00:00:00 2001 From: Andrew Kenworthy Date: Tue, 25 Aug 2026 11:15:02 +0200 Subject: [PATCH 4/4] use DeserializeGuard consistently --- rust/operator-binary/src/main.rs | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/rust/operator-binary/src/main.rs b/rust/operator-binary/src/main.rs index c174723c..d15e85b0 100644 --- a/rust/operator-binary/src/main.rs +++ b/rust/operator-binary/src/main.rs @@ -133,31 +133,32 @@ async fn main() -> anyhow::Result<()> { let nifi_controller = nifi_controller .owns( - watch_namespace.get_api::(&client), + watch_namespace.get_api::>(&client), watcher::Config::default(), ) .owns( - watch_namespace.get_api::(&client), + watch_namespace + .get_api::>(&client), watcher::Config::default(), ) .owns( - watch_namespace.get_api::(&client), + watch_namespace.get_api::>(&client), watcher::Config::default(), ) .owns( - watch_namespace.get_api::(&client), + watch_namespace.get_api::>(&client), watcher::Config::default(), ) .owns( - watch_namespace.get_api::(&client), + watch_namespace.get_api::>(&client), watcher::Config::default(), ) .owns( - watch_namespace.get_api::(&client), + watch_namespace.get_api::>(&client), watcher::Config::default(), ) .owns( - watch_namespace.get_api::(&client), + watch_namespace.get_api::>(&client), watcher::Config::default(), ) .watches(