Merge branch 'main' into update-release-branch

Author: siegfriedweber

CHANGELOG.md

@@ -29,6 +29,9 @@ All notable changes to this project will be documented in this file.
   certificates used by Kafka. This allows you to access Kafka brokers secured using TLS via the global bootstrap
   service ([#741]).
 - An invalid `KafkaCluster` doesn't cause the operator to stop functioning ([#773]).
+- BREAKING: Use distinct ServiceAccounts for the Stacklets, so that multiple Stacklets can be
+  deployed in one namespace. Existing Stacklets will use the newly created ServiceAccounts after
+  restart ([#793]).
 
 ### Removed
 
@@ -41,6 +44,7 @@ All notable changes to this project will be documented in this file.
 [#762]: https://github.com/stackabletech/kafka-operator/pull/762
 [#771]: https://github.com/stackabletech/kafka-operator/pull/771
 [#773]: https://github.com/stackabletech/kafka-operator/pull/773
+[#793]: https://github.com/stackabletech/kafka-operator/pull/793
 
 ## [24.7.0] - 2024-07-24
 

Cargo.lock

@@ -22,7 +22,7 @@ serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 serde_yaml = "0.9"
 snafu = "0.8"
-stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", tag = "stackable-operator-0.80.0" }
+stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", tag = "stackable-operator-0.82.0" }
 strum = { version = "0.26", features = ["derive"] }
 tokio = { version = "1.40", features = ["full"] }
 tracing = "0.1"

Cargo.nix

@@ -29,6 +29,9 @@ SHELL=/usr/bin/env bash -euo pipefail
 render-readme:
 	scripts/render_readme.sh
 
+render-docs:
+	scripts/docs_templating.sh
+
 ## Docker related targets
 docker-build:
 	docker build --force-rm --build-arg VERSION=${VERSION} -t "${DOCKER_REPO}/${ORGANIZATION}/${OPERATOR_NAME}:${VERSION}-${ARCH}" -f docker/Dockerfile .

Cargo.toml

@@ -2,18 +2,7 @@
 set -euo pipefail
 
 # DO NOT EDIT THE SCRIPT
-# Instead, update the j2 template, and regenerate it for dev:
-# cat <<EOF | jinja2 --format yaml getting_started.sh.j2 -o getting_started.sh
-# helm:
-#   repo_name: stackable-dev
-#   repo_url: https://repo.stackable.tech/repository/helm-dev/
-# versions:
-#   commons: 0.0.0-dev
-#   kafka: 0.0.0-dev
-#   listener: 0.0.0-dev
-#   secret: 0.0.0-dev
-#   zookeeper: 0.0.0-dev
-# EOF
+# Instead, update the j2 template, and regenerate it for dev with `make render-docs`.
 
 # The getting started guide script
 # It uses tagged regions which are included in the documentation

Makefile

@@ -2,18 +2,7 @@
 set -euo pipefail
 
 # DO NOT EDIT THE SCRIPT
-# Instead, update the j2 template, and regenerate it for dev:
-# cat <<EOF | jinja2 --format yaml getting_started.sh.j2 -o getting_started.sh
-# helm:
-#   repo_name: stackable-dev
-#   repo_url: https://repo.stackable.tech/repository/helm-dev/
-# versions:
-#   commons: 0.0.0-dev
-#   kafka: 0.0.0-dev
-#   listener: 0.0.0-dev
-#   secret: 0.0.0-dev
-#   zookeeper: 0.0.0-dev
-# EOF
+# Instead, update the j2 template, and regenerate it for dev with `make render-docs`.
 
 # The getting started guide script
 # It uses tagged regions which are included in the documentation

crate-hashes.json

@@ -48,7 +48,7 @@ use stackable_operator::{
             core::v1::{
                 ConfigMap, ConfigMapKeySelector, ConfigMapVolumeSource, ContainerPort, EnvVar,
                 EnvVarSource, ExecAction, ObjectFieldSelector, PodSpec, Probe, Service,
-                ServiceSpec, Volume,
+                ServiceAccount, ServiceSpec, Volume,
             },
         },
         apimachinery::pkg::apis::meta::v1::LabelSelector,
@@ -524,7 +524,7 @@ pub async fn reconcile_kafka(
     .context(BuildRbacResourcesSnafu)?;
 
     let rbac_sa = cluster_resources
-        .add(client, rbac_sa)
+        .add(client, rbac_sa.clone())
         .await
         .context(ApplyServiceAccountSnafu)?;
     cluster_resources
@@ -561,7 +561,7 @@ pub async fn reconcile_kafka(
             opa_connect.as_deref(),
             &kafka_security,
             &merged_config,
-            &rbac_sa.name_any(),
+            &rbac_sa,
             &client.kubernetes_cluster_info,
         )?;
         let rg_bootstrap_listener = build_broker_rolegroup_bootstrap_listener(
@@ -824,7 +824,7 @@ fn build_broker_rolegroup_statefulset(
     opa_connect_string: Option<&str>,
     kafka_security: &KafkaTlsSecurity,
     merged_config: &KafkaConfig,
-    sa_name: &str,
+    service_account: &ServiceAccount,
     cluster_info: &KubernetesClusterInfo,
 ) -> Result<StatefulSet> {
     let role = kafka.role(kafka_role).context(InternalOperatorSnafu)?;
@@ -1096,7 +1096,7 @@ fn build_broker_rolegroup_statefulset(
             )),
         )
         .context(AddVolumeSnafu)?
-        .service_account_name(sa_name)
+        .service_account_name(service_account.name_any())
         .security_context(
             PodSecurityContextBuilder::new()
                 .run_as_user(KAFKA_UID)