diff --git a/CHANGELOG.md b/CHANGELOG.md index 48cdd34c..beb963b9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -18,6 +18,7 @@ All notable changes to this project will be documented in this file. Previously, arbitrary file names were silently accepted and ignored ([#960]). - Bump `stackable-operator` to 0.111.1 and snafu to 0.9 ([#960], [#961]). - Internal operator refactoring: introduce dereference() and validate() steps in the reconciler ([#968]). +- BREAKING: Extend the subject DNs of TLS certificates with the FQDNs of the Kafka pods ([#972]). - test: Bump vector-aggregator to 0.55.0, replace /graphql call with gRPC call ([#971]). - BREAKING: Removed product-config machinery which is a breaking change in terms of configuration.  Users relying on the product-config `properties.yaml` file have to set these properties via the CRD. @@ -30,6 +31,7 @@ All notable changes to this project will be documented in this file. [#961]: https://github.com/stackabletech/kafka-operator/pull/961 [#968]: https://github.com/stackabletech/kafka-operator/pull/968 [#971]: https://github.com/stackabletech/kafka-operator/pull/971 +[#972]: https://github.com/stackabletech/kafka-operator/pull/972 [#973]: https://github.com/stackabletech/kafka-operator/pull/973 [#976]: https://github.com/stackabletech/kafka-operator/pull/976 diff --git a/Cargo.lock b/Cargo.lock index 3e677952..5ffaedfa 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -45,6 +45,17 @@ dependencies = [ "libc", ] +[[package]] +name = "annotate-snippets" +version = "0.12.16" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f211a51805bc641f3ad5b7664c77d2547af685cc33b4cd8d31964027a46f13f1" +dependencies = [ + "anstyle", + "memchr", + "unicode-width", +] + [[package]] name = "anstream" version = "1.0.0" @@ -110,6 +121,12 @@ dependencies = [ "rustversion", ] +[[package]] +name = "arraydeque" +version = "0.5.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7d902e3d592a523def97af8f317b08ce16b7ab854c1985a0c671e6f15cebc236" + [[package]] name = "async-broadcast" version = "0.7.2" @@ -744,6 +761,15 @@ dependencies = [ "cfg-if", ] +[[package]] +name = "encoding_rs_io" +version = "0.1.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1cc3c5651fb62ab8aa3103998dade57efdd028544bd300516baa31840c252a83" +dependencies = [ + "encoding_rs", +] + [[package]] name = "enquote" version = "1.1.0" @@ -1003,9 +1029,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd" dependencies = [ "cfg-if", + "js-sys", "libc", "r-efi", "wasip2", + "wasm-bindgen", ] [[package]] @@ -1038,6 +1066,16 @@ dependencies = [ "wasm-bindgen", ] +[[package]] +name = "granit-parser" +version = "0.0.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f50ba32164f9e098d5da618776a32afbb32270adcbe3d3d006107dae11e37c91" +dependencies = [ + "arraydeque", + "smallvec", +] + [[package]] name = "group" version = "0.13.0" @@ -1410,6 +1448,15 @@ dependencies = [ "either", ] +[[package]] +name = "itertools" +version = "0.15.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8b4baf93f58d4425749ca49a51c50ebab072c5df6994d08fed93541c331481dc" +dependencies = [ + "either", +] + [[package]] name = "itoa" version = "1.0.18" @@ -1528,9 +1575,9 @@ dependencies = [ [[package]] name = "k8s-openapi" -version = "0.27.1" +version = "0.28.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "51b326f5219dd55872a72c1b6ddd1b830b8334996c667449c29391d657d78d5e" +checksum = "d9c6922f6afe80418dd6019818af5d0d34584c371780ff09b9752370c25b4abb" dependencies = [ "base64", "jiff", @@ -1542,7 +1589,7 @@ dependencies = [ [[package]] name = "k8s-version" version = "0.1.3" -source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.112.0#cef9e663f86846d175049cc1e2406efc4b542040" +source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.1#a609ce81f038b79c7cf2da19118bddc813a5c82e" dependencies = [ "darling", "regex", @@ -1566,9 +1613,9 @@ checksum = "a4933f3f57a8e9d9da04db23fb153356ecaf00cbd14aee46279c33dc80925c37" [[package]] name = "kube" -version = "3.1.0" +version = "4.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "acc5a6a69da2975ed9925d56b5dcfc9cc739b66f37add06785b7c9f6d1e88741" +checksum = "4bb9108095346a7096d11feeaff419c75dddcac1b2f59acb38d7bf3d13c3e146" dependencies = [ "k8s-openapi", "kube-client", @@ -1579,9 +1626,9 @@ dependencies = [ [[package]] name = "kube-client" -version = "3.1.0" +version = "4.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0fcaf2d1f1a91e1805d4cd82e8333c022767ae8ffd65909bbef6802733a7dd40" +checksum = "d0f628e05bc2264c21fe10d3d675117dc9b43ea3bf4fb07262a222679757537b" dependencies = [ "base64", "bytes", @@ -1602,21 +1649,21 @@ dependencies = [ "rustls", "secrecy", "serde", + "serde-saphyr", "serde_json", - "serde_yaml", "thiserror 2.0.18", "tokio", "tokio-util", "tower", - "tower-http", + "tower-http 0.6.11", "tracing", ] [[package]] name = "kube-core" -version = "3.1.0" +version = "4.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f126d2db7a8b532ec1d839ece2a71e2485dc3bbca6cc3c3f929becaa810e719e" +checksum = "c1b02f5933ba06140d58c7d6727f6c319f0962ec6a344aa5e21e475e891deaa8" dependencies = [ "derive_more", "form_urlencoded", @@ -1633,9 +1680,9 @@ dependencies = [ [[package]] name = "kube-derive" -version = "3.1.0" +version = "4.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d6b9b97e121fce957f9cafc6da534abc4276983ab03190b76c09361e2df849fa" +checksum = "fe171898707dadf1818ef94e81ef57f6beb7edf9ba87b9e814c045dad356c7aa" dependencies = [ "darling", "proc-macro2", @@ -1647,9 +1694,9 @@ dependencies = [ [[package]] name = "kube-runtime" -version = "3.1.0" +version = "4.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c072737075826ee74d3e615e80334e41e617ca3d14fb46ef7cdfda822d6f15f2" +checksum = "99ddec66c540c7cf29a5b41fe4a657a53687f95c346e03bdf00585b70a1bab21" dependencies = [ "ahash", "async-broadcast", @@ -1786,6 +1833,12 @@ dependencies = [ "windows-sys 0.61.2", ] +[[package]] +name = "nohash-hasher" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2bf50223579dc7cdcfb3bfcacf7069ff68243f8c363f62ffa99cf000a6b9c451" + [[package]] name = "nu-ansi-term" version = "0.50.3" @@ -2252,7 +2305,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b570b25f7617e43d59005d0990ccb79e950a423952cea19671b7a876da390adf" dependencies = [ "anyhow", - "itertools", + "itertools 0.14.0", "proc-macro2", "quote", "syn 2.0.118", @@ -2427,7 +2480,7 @@ dependencies = [ "sync_wrapper", "tokio", "tower", - "tower-http", + "tower-http 0.6.11", "tower-service", "url", "wasm-bindgen", @@ -2680,6 +2733,25 @@ dependencies = [ "serde_derive", ] +[[package]] +name = "serde-saphyr" +version = "0.0.27" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5897b4c3faadadd35fdb6689f015641f3bc481d5adaaac56231ea15aeb243db3" +dependencies = [ + "ahash", + "annotate-snippets", + "base64", + "encoding_rs_io", + "getrandom 0.3.4", + "granit-parser", + "nohash-hasher", + "num-traits", + "serde", + "smallvec", + "zmij", +] + [[package]] name = "serde-value" version = "0.7.0" @@ -2942,8 +3014,8 @@ checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596" [[package]] name = "stackable-certs" -version = "0.4.0" -source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.112.0#cef9e663f86846d175049cc1e2406efc4b542040" +version = "0.4.1" +source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.1#a609ce81f038b79c7cf2da19118bddc813a5c82e" dependencies = [ "const-oid", "ecdsa", @@ -2987,8 +3059,8 @@ dependencies = [ [[package]] name = "stackable-operator" -version = "0.112.0" -source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.112.0#cef9e663f86846d175049cc1e2406efc4b542040" +version = "0.113.1" +source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.1#a609ce81f038b79c7cf2da19118bddc813a5c82e" dependencies = [ "base64", "clap", @@ -3033,7 +3105,7 @@ dependencies = [ [[package]] name = "stackable-operator-derive" version = "0.3.1" -source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.112.0#cef9e663f86846d175049cc1e2406efc4b542040" +source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.1#a609ce81f038b79c7cf2da19118bddc813a5c82e" dependencies = [ "darling", "proc-macro2", @@ -3043,8 +3115,8 @@ dependencies = [ [[package]] name = "stackable-shared" -version = "0.1.1" -source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.112.0#cef9e663f86846d175049cc1e2406efc4b542040" +version = "0.1.2" +source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.1#a609ce81f038b79c7cf2da19118bddc813a5c82e" dependencies = [ "jiff", "k8s-openapi", @@ -3060,8 +3132,8 @@ dependencies = [ [[package]] name = "stackable-telemetry" -version = "0.6.4" -source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.112.0#cef9e663f86846d175049cc1e2406efc4b542040" +version = "0.6.5" +source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.1#a609ce81f038b79c7cf2da19118bddc813a5c82e" dependencies = [ "axum", "clap", @@ -3084,8 +3156,8 @@ dependencies = [ [[package]] name = "stackable-versioned" -version = "0.10.0" -source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.112.0#cef9e663f86846d175049cc1e2406efc4b542040" +version = "0.11.1" +source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.1#a609ce81f038b79c7cf2da19118bddc813a5c82e" dependencies = [ "kube", "schemars", @@ -3098,14 +3170,14 @@ dependencies = [ [[package]] name = "stackable-versioned-macros" -version = "0.10.0" -source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.112.0#cef9e663f86846d175049cc1e2406efc4b542040" +version = "0.11.1" +source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.1#a609ce81f038b79c7cf2da19118bddc813a5c82e" dependencies = [ "convert_case", "convert_case_extras", "darling", "indoc", - "itertools", + "itertools 0.15.0", "k8s-openapi", "k8s-version", "kube", @@ -3116,8 +3188,8 @@ dependencies = [ [[package]] name = "stackable-webhook" -version = "0.9.1" -source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.112.0#cef9e663f86846d175049cc1e2406efc4b542040" +version = "0.9.2" +source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.1#a609ce81f038b79c7cf2da19118bddc813a5c82e" dependencies = [ "arc-swap", "async-trait", @@ -3140,7 +3212,7 @@ dependencies = [ "tokio", "tokio-rustls", "tower", - "tower-http", + "tower-http 0.7.0", "tracing", "tracing-opentelemetry", "x509-cert", @@ -3519,6 +3591,23 @@ dependencies = [ "url", ] +[[package]] +name = "tower-http" +version = "0.7.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b11f75e912b0c2be01b63d8cf8057b8c3f97cf34abb3d431a3a4c8675498e233" +dependencies = [ + "bitflags 2.13.0", + "bytes", + "http", + "http-body", + "percent-encoding", + "pin-project-lite", + "tower-layer", + "tower-service", + "tracing", +] + [[package]] name = "tower-layer" version = "0.3.3" @@ -3665,6 +3754,12 @@ version = "1.13.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8" +[[package]] +name = "unicode-width" +version = "0.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254" + [[package]] name = "unicode-xid" version = "0.2.6" diff --git a/Cargo.nix b/Cargo.nix index 7714ea8a..3acfd0cd 100644 --- a/Cargo.nix +++ b/Cargo.nix @@ -214,6 +214,36 @@ rec { ]; }; + "annotate-snippets" = rec { + crateName = "annotate-snippets"; + version = "0.12.16"; + edition = "2024"; + sha256 = "1w8kdyj2fh4n666wvd1krj2zcyjls9vlqrmpslx1yr5w0lcaa4gj"; + libName = "annotate_snippets"; + dependencies = [ + { + name = "anstyle"; + packageId = "anstyle"; + usesDefaultFeatures = false; + } + { + name = "memchr"; + packageId = "memchr"; + optional = true; + usesDefaultFeatures = false; + } + { + name = "unicode-width"; + packageId = "unicode-width"; + } + ]; + features = { + "default" = [ "std" ]; + "simd" = [ "dep:memchr" ]; + "std" = [ "anstyle/std" "memchr?/std" ]; + }; + resolvedDefaultFeatures = [ "default" "std" ]; + }; "anstream" = rec { crateName = "anstream"; version = "1.0.0"; @@ -362,6 +392,18 @@ rec { "serde" = [ "dep:serde" ]; }; }; + "arraydeque" = rec { + crateName = "arraydeque"; + version = "0.5.1"; + edition = "2021"; + sha256 = "0dn2xdfg3rkiqsh8a6achnmvf5nf11xk33xgjzpksliab4yjx43x"; + authors = [ + "andylokandy" + ]; + features = { + "default" = [ "std" ]; + }; + }; "async-broadcast" = rec { crateName = "async-broadcast"; version = "0.7.2"; @@ -2325,6 +2367,22 @@ rec { }; resolvedDefaultFeatures = [ "alloc" "default" ]; }; + "encoding_rs_io" = rec { + crateName = "encoding_rs_io"; + version = "0.1.7"; + edition = "2015"; + sha256 = "10ra4l688cdadd8h1lsbahld1zbywnnqv68366mbhamn3xjwbhqw"; + authors = [ + "Andrew Gallant " + ]; + dependencies = [ + { + name = "encoding_rs"; + packageId = "encoding_rs"; + } + ]; + + }; "enquote" = rec { crateName = "enquote"; version = "1.1.0"; @@ -3081,6 +3139,13 @@ rec { name = "cfg-if"; packageId = "cfg-if"; } + { + name = "js-sys"; + packageId = "js-sys"; + optional = true; + usesDefaultFeatures = false; + target = { target, features }: (("wasm32" == target."arch" or null) && (("unknown" == target."os" or null) || ("none" == target."os" or null)) && (builtins.elem "atomics" targetFeatures)); + } { name = "libc"; packageId = "libc"; @@ -3141,11 +3206,18 @@ rec { usesDefaultFeatures = false; target = { target, features }: (("wasm32" == target."arch" or null) && ("wasi" == target."os" or null) && ("p2" == target."env" or null)); } + { + name = "wasm-bindgen"; + packageId = "wasm-bindgen"; + optional = true; + usesDefaultFeatures = false; + target = { target, features }: (("wasm32" == target."arch" or null) && (("unknown" == target."os" or null) || ("none" == target."os" or null))); + } ]; features = { "wasm_js" = [ "dep:wasm-bindgen" "dep:js-sys" ]; }; - resolvedDefaultFeatures = [ "std" ]; + resolvedDefaultFeatures = [ "std" "wasm_js" ]; }; "git2" = rec { crateName = "git2"; @@ -3232,6 +3304,33 @@ rec { }; resolvedDefaultFeatures = [ "default" "futures" "futures-channel" "futures-core" ]; }; + "granit-parser" = rec { + crateName = "granit-parser"; + version = "0.0.3"; + edition = "2021"; + crateBin = []; + sha256 = "14bwwc8swz8h0v8d7qybmmq25czv5aipd1v1vbariq7rchhs62zm"; + libName = "granit_parser"; + authors = [ + "Ethiraric " + "David Aguilar " + "Yuheng Chen " + "Bourumir Wyngs " + ]; + dependencies = [ + { + name = "arraydeque"; + packageId = "arraydeque"; + usesDefaultFeatures = false; + } + { + name = "smallvec"; + packageId = "smallvec"; + } + ]; + features = { + }; + }; "group" = rec { crateName = "group"; version = "0.13.0"; @@ -3947,7 +4046,7 @@ rec { "tokio" = [ "dep:tokio" "tokio/rt" "tokio/time" ]; "tracing" = [ "dep:tracing" ]; }; - resolvedDefaultFeatures = [ "client" "client-legacy" "client-proxy" "default" "http1" "http2" "server" "service" "tokio" "tracing" ]; + resolvedDefaultFeatures = [ "client" "client-legacy" "client-proxy" "default" "http1" "http2" "server" "service" "tokio" ]; }; "iana-time-zone" = rec { crateName = "iana-time-zone"; @@ -4457,7 +4556,7 @@ rec { }; resolvedDefaultFeatures = [ "default" ]; }; - "itertools" = rec { + "itertools 0.14.0" = rec { crateName = "itertools"; version = "0.14.0"; edition = "2018"; @@ -4478,6 +4577,27 @@ rec { }; resolvedDefaultFeatures = [ "default" "use_alloc" "use_std" ]; }; + "itertools 0.15.0" = rec { + crateName = "itertools"; + version = "0.15.0"; + edition = "2018"; + sha256 = "1p412hriqm4kxn7x1539vz2p5c5s1v2m36m4kis2ai4dyn9syjwb"; + authors = [ + "bluss" + ]; + dependencies = [ + { + name = "either"; + packageId = "either"; + usesDefaultFeatures = false; + } + ]; + features = { + "default" = [ "use_std" ]; + "use_std" = [ "use_alloc" "either/use_std" ]; + }; + resolvedDefaultFeatures = [ "default" "use_alloc" "use_std" ]; + }; "itoa" = rec { crateName = "itoa"; version = "1.0.18"; @@ -4839,10 +4959,10 @@ rec { }; "k8s-openapi" = rec { crateName = "k8s-openapi"; - version = "0.27.1"; + version = "0.28.0"; edition = "2021"; - links = "k8s-openapi-0.27.1"; - sha256 = "0pldsxbxd4ckq94p8rkck4s862w33gfns6rclxr5imcx47sjdcsi"; + links = "k8s-openapi-0.28.0"; + sha256 = "1fsabg1708vmp44zz00p6x65hd0dbnpii601ss6l307yd8pr5inr"; libName = "k8s_openapi"; authors = [ "Arnav Singh " @@ -4880,11 +5000,12 @@ rec { ]; features = { "default" = [ "std" ]; - "earliest" = [ "v1_31" ]; - "latest" = [ "v1_35" ]; + "earliest" = [ "v1_32" ]; + "latest" = [ "v1_36" ]; "schemars" = [ "dep:schemars" ]; + "schemars08" = [ "dep:schemars08" ]; }; - resolvedDefaultFeatures = [ "schemars" "v1_35" ]; + resolvedDefaultFeatures = [ "schemars" "v1_36" ]; }; "k8s-version" = rec { crateName = "k8s-version"; @@ -4893,8 +5014,8 @@ rec { workspace_member = null; src = pkgs.fetchgit { url = "https://github.com/stackabletech/operator-rs.git"; - rev = "cef9e663f86846d175049cc1e2406efc4b542040"; - sha256 = "054p2mcinq3x4iykmc72nhga7kapc8ihkx9mnzqq3qdm2bk2qcps"; + rev = "a609ce81f038b79c7cf2da19118bddc813a5c82e"; + sha256 = "1qq2z64gzx4sd1csh35cxcfshvhgrm0c9b13rq0sqv0046lmhh33"; }; libName = "k8s_version"; authors = [ @@ -4970,9 +5091,9 @@ rec { }; "kube" = rec { crateName = "kube"; - version = "3.1.0"; + version = "4.0.0"; edition = "2024"; - sha256 = "0hc7x38zdjdphmkx1b9pdyv3kiwwzkfbamjxjbcmx5x2knkadidc"; + sha256 = "0ip1qc9kvgyp735rmxdjq75dspf737sazvhzs6b70siljn011fab"; authors = [ "clux " "Natalie Klestrup Röijezon " @@ -5016,12 +5137,14 @@ rec { features = { "admission" = [ "kube-core/admission" ]; "aws-lc-rs" = [ "kube-client?/aws-lc-rs" ]; + "cel" = [ "kube-core/cel" ]; "client" = [ "kube-client/client" "config" ]; "config" = [ "kube-client/config" ]; "default" = [ "client" "rustls-tls" "ring" ]; "derive" = [ "kube-derive" "kube-core/schema" ]; "gzip" = [ "kube-client/gzip" "client" ]; "http-proxy" = [ "kube-client/http-proxy" "client" ]; + "hyper-util-tracing" = [ "kube-client/hyper-util-tracing" "client" ]; "jsonpatch" = [ "kube-core/jsonpatch" ]; "kube-client" = [ "dep:kube-client" ]; "kube-derive" = [ "dep:kube-derive" ]; @@ -5043,9 +5166,9 @@ rec { }; "kube-client" = rec { crateName = "kube-client"; - version = "3.1.0"; + version = "4.0.0"; edition = "2024"; - sha256 = "0h6xlwrjg07npsdr0rgxiyp6f9q27hryi0ndsh2ih7m9y78z5jhg"; + sha256 = "0yskaybnf8m2c9rb0kxzlczb9jbx25sxdlqhzqhlq9n2bgh2ixnh"; libName = "kube_client"; authors = [ "clux " @@ -5111,7 +5234,7 @@ rec { name = "hyper-util"; packageId = "hyper-util"; optional = true; - features = [ "client" "client-legacy" "http1" "tokio" "tracing" ]; + features = [ "client" "client-legacy" "http1" "tokio" ]; } { name = "jiff"; @@ -5155,13 +5278,13 @@ rec { features = [ "derive" ]; } { - name = "serde_json"; - packageId = "serde_json"; + name = "serde-saphyr"; + packageId = "serde-saphyr"; + optional = true; } { - name = "serde_yaml"; - packageId = "serde_yaml"; - optional = true; + name = "serde_json"; + packageId = "serde_json"; } { name = "thiserror"; @@ -5187,7 +5310,7 @@ rec { } { name = "tower-http"; - packageId = "tower-http"; + packageId = "tower-http 0.6.11"; optional = true; features = [ "auth" "map-response-body" "trace" "util" ]; } @@ -5223,7 +5346,7 @@ rec { } ]; features = { - "__non_core" = [ "tracing" "serde_yaml" "base64" ]; + "__non_core" = [ "tracing" "serde-saphyr" "base64" ]; "admission" = [ "kube-core/admission" ]; "aws-lc-rs" = [ "hyper-rustls?/aws-lc-rs" ]; "base64" = [ "dep:base64" ]; @@ -5243,6 +5366,7 @@ rec { "hyper-rustls" = [ "dep:hyper-rustls" ]; "hyper-timeout" = [ "dep:hyper-timeout" ]; "hyper-util" = [ "dep:hyper-util" ]; + "hyper-util-tracing" = [ "hyper-util/tracing" ]; "jiff" = [ "dep:jiff" ]; "jsonpatch" = [ "kube-core/jsonpatch" ]; "jsonpath-rust" = [ "dep:jsonpath-rust" ]; @@ -5255,7 +5379,7 @@ rec { "ring" = [ "hyper-rustls?/ring" ]; "rustls" = [ "dep:rustls" ]; "rustls-tls" = [ "rustls" "hyper-rustls" ]; - "serde_yaml" = [ "dep:serde_yaml" ]; + "serde-saphyr" = [ "dep:serde-saphyr" ]; "socks5" = [ "hyper-util/client-proxy" ]; "tame-oauth" = [ "dep:tame-oauth" ]; "tokio" = [ "dep:tokio" ]; @@ -5267,13 +5391,13 @@ rec { "webpki-roots" = [ "hyper-rustls/webpki-roots" ]; "ws" = [ "client" "tokio-tungstenite" "kube-core/ws" "tokio/macros" ]; }; - resolvedDefaultFeatures = [ "__non_core" "base64" "bytes" "client" "config" "either" "futures" "http-body" "http-body-util" "hyper" "hyper-rustls" "hyper-timeout" "hyper-util" "jiff" "jsonpatch" "jsonpath-rust" "pem" "ring" "rustls" "rustls-tls" "serde_yaml" "tokio" "tokio-util" "tower" "tower-http" "tracing" ]; + resolvedDefaultFeatures = [ "__non_core" "base64" "bytes" "client" "config" "either" "futures" "http-body" "http-body-util" "hyper" "hyper-rustls" "hyper-timeout" "hyper-util" "jiff" "jsonpatch" "jsonpath-rust" "pem" "ring" "rustls" "rustls-tls" "serde-saphyr" "tokio" "tokio-util" "tower" "tower-http" "tracing" ]; }; "kube-core" = rec { crateName = "kube-core"; - version = "3.1.0"; + version = "4.0.0"; edition = "2024"; - sha256 = "17ki1s0smv4vj8zkrk56phxxr1943sky5v1rv30jwlwbgbdx49pi"; + sha256 = "1a7a3n4mwiqywajlld3axii0k7ridizp5mn7b06i81ms6dcjzc61"; libName = "kube_core"; authors = [ "clux " @@ -5343,6 +5467,7 @@ rec { ]; features = { "admission" = [ "json-patch" ]; + "cel" = [ "dep:kube-cel" ]; "json-patch" = [ "dep:json-patch" ]; "jsonpatch" = [ "json-patch" ]; "kubelet-debug" = [ "ws" ]; @@ -5353,9 +5478,9 @@ rec { }; "kube-derive" = rec { crateName = "kube-derive"; - version = "3.1.0"; + version = "4.0.0"; edition = "2024"; - sha256 = "1yj9z0niwdh9djvr0cdh7ac7chmw999xmimgkizrbkhz29zbkffn"; + sha256 = "1an7av9xlif02klbk1xsz7nvggpnazpq2kpris0z3bbxf2c1h5zy"; procMacro = true; libName = "kube_derive"; authors = [ @@ -5402,9 +5527,9 @@ rec { }; "kube-runtime" = rec { crateName = "kube-runtime"; - version = "3.1.0"; + version = "4.0.0"; edition = "2024"; - sha256 = "1whmdwnq5nnzgkpldyql7p51grj19qrq0pk17r6yfvl2fmq76wn0"; + sha256 = "08db3c5bg185y2yh6vilbkwqfdm5aykf87xllllwzis0qmkfrpcr"; libName = "kube_runtime"; authors = [ "clux " @@ -5853,6 +5978,20 @@ rec { }; resolvedDefaultFeatures = [ "net" "os-ext" "os-poll" ]; }; + "nohash-hasher" = rec { + crateName = "nohash-hasher"; + version = "0.2.0"; + edition = "2018"; + sha256 = "0lf4p6k01w4wm7zn4grnihzj8s7zd5qczjmzng7wviwxawih5x9b"; + libName = "nohash_hasher"; + authors = [ + "Parity Technologies " + ]; + features = { + "default" = [ "std" ]; + }; + resolvedDefaultFeatures = [ "default" "std" ]; + }; "nu-ansi-term" = rec { crateName = "nu-ansi-term"; version = "0.50.3"; @@ -6050,7 +6189,7 @@ rec { "default" = [ "std" ]; "libm" = [ "dep:libm" ]; }; - resolvedDefaultFeatures = [ "i128" "libm" "std" ]; + resolvedDefaultFeatures = [ "default" "i128" "libm" "std" ]; }; "once_cell" = rec { crateName = "once_cell"; @@ -7371,7 +7510,7 @@ rec { } { name = "itertools"; - packageId = "itertools"; + packageId = "itertools 0.14.0"; } { name = "proc-macro2"; @@ -7945,7 +8084,7 @@ rec { } { name = "tower-http"; - packageId = "tower-http"; + packageId = "tower-http 0.6.11"; usesDefaultFeatures = false; target = { target, features }: (!(("wasm32" == target."arch" or null) && (("unknown" == target."os" or null) || ("none" == target."os" or null)))); features = [ "follow-redirect" ]; @@ -8879,6 +9018,94 @@ rec { }; resolvedDefaultFeatures = [ "alloc" "default" "derive" "serde_derive" "std" ]; }; + "serde-saphyr" = rec { + crateName = "serde-saphyr"; + version = "0.0.27"; + edition = "2024"; + crateBin = []; + sha256 = "1crx4kmmm88y4dbaramdsn0w8fqzchaz12b6vdgx7bddzb1v95sq"; + libName = "serde_saphyr"; + dependencies = [ + { + name = "ahash"; + packageId = "ahash"; + optional = true; + } + { + name = "annotate-snippets"; + packageId = "annotate-snippets"; + optional = true; + } + { + name = "base64"; + packageId = "base64"; + optional = true; + } + { + name = "encoding_rs_io"; + packageId = "encoding_rs_io"; + optional = true; + } + { + name = "getrandom"; + packageId = "getrandom 0.3.4"; + target = { target, features }: ("wasm32" == target."arch" or null); + features = [ "wasm_js" ]; + } + { + name = "granit-parser"; + packageId = "granit-parser"; + optional = true; + } + { + name = "nohash-hasher"; + packageId = "nohash-hasher"; + optional = true; + } + { + name = "num-traits"; + packageId = "num-traits"; + optional = true; + } + { + name = "serde"; + packageId = "serde"; + features = [ "derive" ]; + } + { + name = "smallvec"; + packageId = "smallvec"; + optional = true; + } + { + name = "zmij"; + packageId = "zmij"; + optional = true; + } + ]; + devDependencies = [ + { + name = "serde"; + packageId = "serde"; + features = [ "derive" "rc" ]; + } + ]; + features = { + "default" = [ "serialize" "deserialize" ]; + "deserialize" = [ "dep:base64" "dep:num-traits" "dep:annotate-snippets" "dep:granit-parser" "dep:smallvec" "dep:encoding_rs_io" "dep:ahash" ]; + "figment" = [ "dep:figment" "deserialize" ]; + "figment2" = [ "dep:figment2" "deserialize" ]; + "garde" = [ "dep:garde" "deserialize" ]; + "include" = [ "deserialize" ]; + "include_fs" = [ "include" ]; + "miette" = [ "dep:miette" "deserialize" ]; + "properties" = [ "deserialize" ]; + "robotics" = [ "deserialize" ]; + "serialize" = [ "dep:base64" "dep:num-traits" "dep:zmij" "dep:nohash-hasher" ]; + "validator" = [ "dep:validator" "deserialize" ]; + }; + resolvedDefaultFeatures = [ "default" "deserialize" "serialize" ]; + }; "serde-value" = rec { crateName = "serde-value"; version = "0.7.0"; @@ -9637,13 +9864,13 @@ rec { }; "stackable-certs" = rec { crateName = "stackable-certs"; - version = "0.4.0"; + version = "0.4.1"; edition = "2024"; workspace_member = null; src = pkgs.fetchgit { url = "https://github.com/stackabletech/operator-rs.git"; - rev = "cef9e663f86846d175049cc1e2406efc4b542040"; - sha256 = "054p2mcinq3x4iykmc72nhga7kapc8ihkx9mnzqq3qdm2bk2qcps"; + rev = "a609ce81f038b79c7cf2da19118bddc813a5c82e"; + sha256 = "1qq2z64gzx4sd1csh35cxcfshvhgrm0c9b13rq0sqv0046lmhh33"; }; libName = "stackable_certs"; authors = [ @@ -9664,7 +9891,7 @@ rec { name = "k8s-openapi"; packageId = "k8s-openapi"; usesDefaultFeatures = false; - features = [ "schemars" "v1_35" ]; + features = [ "schemars" "v1_36" ]; } { name = "kube"; @@ -9828,13 +10055,13 @@ rec { }; "stackable-operator" = rec { crateName = "stackable-operator"; - version = "0.112.0"; + version = "0.113.1"; edition = "2024"; workspace_member = null; src = pkgs.fetchgit { url = "https://github.com/stackabletech/operator-rs.git"; - rev = "cef9e663f86846d175049cc1e2406efc4b542040"; - sha256 = "054p2mcinq3x4iykmc72nhga7kapc8ihkx9mnzqq3qdm2bk2qcps"; + rev = "a609ce81f038b79c7cf2da19118bddc813a5c82e"; + sha256 = "1qq2z64gzx4sd1csh35cxcfshvhgrm0c9b13rq0sqv0046lmhh33"; }; libName = "stackable_operator"; authors = [ @@ -9901,7 +10128,7 @@ rec { name = "k8s-openapi"; packageId = "k8s-openapi"; usesDefaultFeatures = false; - features = [ "schemars" "v1_35" ]; + features = [ "schemars" "v1_36" ]; } { name = "kube"; @@ -10032,8 +10259,8 @@ rec { workspace_member = null; src = pkgs.fetchgit { url = "https://github.com/stackabletech/operator-rs.git"; - rev = "cef9e663f86846d175049cc1e2406efc4b542040"; - sha256 = "054p2mcinq3x4iykmc72nhga7kapc8ihkx9mnzqq3qdm2bk2qcps"; + rev = "a609ce81f038b79c7cf2da19118bddc813a5c82e"; + sha256 = "1qq2z64gzx4sd1csh35cxcfshvhgrm0c9b13rq0sqv0046lmhh33"; }; procMacro = true; libName = "stackable_operator_derive"; @@ -10062,13 +10289,13 @@ rec { }; "stackable-shared" = rec { crateName = "stackable-shared"; - version = "0.1.1"; + version = "0.1.2"; edition = "2024"; workspace_member = null; src = pkgs.fetchgit { url = "https://github.com/stackabletech/operator-rs.git"; - rev = "cef9e663f86846d175049cc1e2406efc4b542040"; - sha256 = "054p2mcinq3x4iykmc72nhga7kapc8ihkx9mnzqq3qdm2bk2qcps"; + rev = "a609ce81f038b79c7cf2da19118bddc813a5c82e"; + sha256 = "1qq2z64gzx4sd1csh35cxcfshvhgrm0c9b13rq0sqv0046lmhh33"; }; libName = "stackable_shared"; authors = [ @@ -10084,7 +10311,7 @@ rec { name = "k8s-openapi"; packageId = "k8s-openapi"; usesDefaultFeatures = false; - features = [ "schemars" "v1_35" ]; + features = [ "schemars" "v1_36" ]; } { name = "kube"; @@ -10130,7 +10357,7 @@ rec { name = "k8s-openapi"; packageId = "k8s-openapi"; usesDefaultFeatures = false; - features = [ "schemars" "v1_35" ]; + features = [ "schemars" "v1_36" ]; } ]; features = { @@ -10143,13 +10370,13 @@ rec { }; "stackable-telemetry" = rec { crateName = "stackable-telemetry"; - version = "0.6.4"; + version = "0.6.5"; edition = "2024"; workspace_member = null; src = pkgs.fetchgit { url = "https://github.com/stackabletech/operator-rs.git"; - rev = "cef9e663f86846d175049cc1e2406efc4b542040"; - sha256 = "054p2mcinq3x4iykmc72nhga7kapc8ihkx9mnzqq3qdm2bk2qcps"; + rev = "a609ce81f038b79c7cf2da19118bddc813a5c82e"; + sha256 = "1qq2z64gzx4sd1csh35cxcfshvhgrm0c9b13rq0sqv0046lmhh33"; }; libName = "stackable_telemetry"; authors = [ @@ -10253,13 +10480,13 @@ rec { }; "stackable-versioned" = rec { crateName = "stackable-versioned"; - version = "0.10.0"; + version = "0.11.1"; edition = "2024"; workspace_member = null; src = pkgs.fetchgit { url = "https://github.com/stackabletech/operator-rs.git"; - rev = "cef9e663f86846d175049cc1e2406efc4b542040"; - sha256 = "054p2mcinq3x4iykmc72nhga7kapc8ihkx9mnzqq3qdm2bk2qcps"; + rev = "a609ce81f038b79c7cf2da19118bddc813a5c82e"; + sha256 = "1qq2z64gzx4sd1csh35cxcfshvhgrm0c9b13rq0sqv0046lmhh33"; }; libName = "stackable_versioned"; authors = [ @@ -10303,13 +10530,13 @@ rec { }; "stackable-versioned-macros" = rec { crateName = "stackable-versioned-macros"; - version = "0.10.0"; + version = "0.11.1"; edition = "2024"; workspace_member = null; src = pkgs.fetchgit { url = "https://github.com/stackabletech/operator-rs.git"; - rev = "cef9e663f86846d175049cc1e2406efc4b542040"; - sha256 = "054p2mcinq3x4iykmc72nhga7kapc8ihkx9mnzqq3qdm2bk2qcps"; + rev = "a609ce81f038b79c7cf2da19118bddc813a5c82e"; + sha256 = "1qq2z64gzx4sd1csh35cxcfshvhgrm0c9b13rq0sqv0046lmhh33"; }; procMacro = true; libName = "stackable_versioned_macros"; @@ -10335,13 +10562,13 @@ rec { } { name = "itertools"; - packageId = "itertools"; + packageId = "itertools 0.15.0"; } { name = "k8s-openapi"; packageId = "k8s-openapi"; usesDefaultFeatures = false; - features = [ "schemars" "v1_35" ]; + features = [ "schemars" "v1_36" ]; } { name = "k8s-version"; @@ -10371,13 +10598,13 @@ rec { }; "stackable-webhook" = rec { crateName = "stackable-webhook"; - version = "0.9.1"; + version = "0.9.2"; edition = "2024"; workspace_member = null; src = pkgs.fetchgit { url = "https://github.com/stackabletech/operator-rs.git"; - rev = "cef9e663f86846d175049cc1e2406efc4b542040"; - sha256 = "054p2mcinq3x4iykmc72nhga7kapc8ihkx9mnzqq3qdm2bk2qcps"; + rev = "a609ce81f038b79c7cf2da19118bddc813a5c82e"; + sha256 = "1qq2z64gzx4sd1csh35cxcfshvhgrm0c9b13rq0sqv0046lmhh33"; }; libName = "stackable_webhook"; authors = [ @@ -10418,7 +10645,7 @@ rec { name = "k8s-openapi"; packageId = "k8s-openapi"; usesDefaultFeatures = false; - features = [ "schemars" "v1_35" ]; + features = [ "schemars" "v1_36" ]; } { name = "kube"; @@ -10482,7 +10709,7 @@ rec { } { name = "tower-http"; - packageId = "tower-http"; + packageId = "tower-http 0.7.0"; features = [ "trace" ]; } { @@ -11681,7 +11908,7 @@ rec { }; resolvedDefaultFeatures = [ "balance" "buffer" "discover" "filter" "futures-core" "futures-util" "indexmap" "limit" "load" "load-shed" "log" "make" "pin-project-lite" "ready-cache" "retry" "slab" "sync_wrapper" "timeout" "tokio" "tokio-util" "tracing" "util" ]; }; - "tower-http" = rec { + "tower-http 0.6.11" = rec { crateName = "tower-http"; version = "0.6.11"; edition = "2018"; @@ -11811,6 +12038,103 @@ rec { }; resolvedDefaultFeatures = [ "auth" "base64" "default" "follow-redirect" "futures-util" "map-response-body" "mime" "tower" "trace" "tracing" "util" "validate-request" ]; }; + "tower-http 0.7.0" = rec { + crateName = "tower-http"; + version = "0.7.0"; + edition = "2018"; + sha256 = "0cz2k1a6gj54lcqx9cxb6k7rfgwcgc2zi31xnq0vxhmh2blpa7xi"; + libName = "tower_http"; + authors = [ + "Tower Maintainers " + ]; + dependencies = [ + { + name = "bitflags"; + packageId = "bitflags 2.13.0"; + } + { + name = "bytes"; + packageId = "bytes"; + } + { + name = "http"; + packageId = "http"; + } + { + name = "http-body"; + packageId = "http-body"; + optional = true; + } + { + name = "percent-encoding"; + packageId = "percent-encoding"; + } + { + name = "pin-project-lite"; + packageId = "pin-project-lite"; + } + { + name = "tower-layer"; + packageId = "tower-layer"; + } + { + name = "tower-service"; + packageId = "tower-service"; + } + { + name = "tracing"; + packageId = "tracing"; + optional = true; + usesDefaultFeatures = false; + } + ]; + devDependencies = [ + { + name = "bytes"; + packageId = "bytes"; + } + { + name = "http-body"; + packageId = "http-body"; + } + ]; + features = { + "auth" = [ "base64" "validate-request" ]; + "base64" = [ "dep:base64" ]; + "catch-panic" = [ "tracing" "futures-util/std" "dep:http-body" "dep:http-body-util" ]; + "compression-br" = [ "dep:async-compression" "async-compression?/brotli" "futures-core" "dep:http-body" "tokio-util" "dep:tokio" ]; + "compression-deflate" = [ "dep:async-compression" "async-compression?/zlib" "futures-core" "dep:http-body" "tokio-util" "dep:tokio" ]; + "compression-full" = [ "compression-br" "compression-deflate" "compression-gzip" "compression-zstd" ]; + "compression-gzip" = [ "dep:async-compression" "async-compression?/gzip" "futures-core" "dep:http-body" "tokio-util" "dep:tokio" ]; + "compression-zstd" = [ "dep:async-compression" "async-compression?/zstd" "futures-core" "dep:http-body" "tokio-util" "dep:tokio" ]; + "decompression-br" = [ "dep:async-compression" "async-compression?/brotli" "futures-core" "dep:http-body" "dep:http-body-util" "tokio-util" "dep:tokio" ]; + "decompression-deflate" = [ "dep:async-compression" "async-compression?/zlib" "futures-core" "dep:http-body" "dep:http-body-util" "tokio-util" "dep:tokio" ]; + "decompression-full" = [ "decompression-br" "decompression-deflate" "decompression-gzip" "decompression-zstd" ]; + "decompression-gzip" = [ "dep:async-compression" "async-compression?/gzip" "futures-core" "dep:http-body" "dep:http-body-util" "tokio-util" "dep:tokio" ]; + "decompression-zstd" = [ "dep:async-compression" "async-compression?/zstd" "futures-core" "dep:http-body" "dep:http-body-util" "tokio-util" "dep:tokio" ]; + "follow-redirect" = [ "futures-util" "dep:http-body" "dep:url" "tower/util" ]; + "fs" = [ "dep:tokio" "tokio?/fs" "tokio?/io-util" "futures-core" "futures-util" "dep:http-body" "dep:http-body-util" "tokio-util/io" "dep:http-range-header" "mime_guess" "mime" "httpdate" "set-status" "futures-util/alloc" ]; + "full" = [ "add-extension" "auth" "catch-panic" "compression-full" "cors" "csrf" "decompression-full" "follow-redirect" "fs" "limit" "map-request-body" "map-response-body" "metrics" "normalize-path" "on-early-drop" "propagate-header" "redirect" "request-id" "sensitive-headers" "set-header" "set-status" "timeout" "trace" "util" "validate-request" ]; + "futures-core" = [ "dep:futures-core" ]; + "futures-util" = [ "dep:futures-util" ]; + "httpdate" = [ "dep:httpdate" ]; + "limit" = [ "dep:http-body" "dep:http-body-util" ]; + "metrics" = [ "dep:http-body" "dep:tokio" "tokio?/time" ]; + "mime" = [ "dep:mime" ]; + "mime_guess" = [ "dep:mime_guess" ]; + "on-early-drop" = [ "dep:http-body" ]; + "request-id" = [ "uuid" ]; + "timeout" = [ "dep:http-body" "dep:tokio" "tokio?/time" ]; + "tokio-util" = [ "dep:tokio-util" ]; + "tower" = [ "dep:tower" ]; + "trace" = [ "dep:http-body" "tracing" ]; + "tracing" = [ "dep:tracing" ]; + "util" = [ "tower" ]; + "uuid" = [ "dep:uuid" ]; + "validate-request" = [ "mime" ]; + }; + resolvedDefaultFeatures = [ "default" "trace" "tracing" ]; + }; "tower-layer" = rec { crateName = "tower-layer"; version = "0.3.3"; @@ -12299,6 +12623,24 @@ rec { features = { }; }; + "unicode-width" = rec { + crateName = "unicode-width"; + version = "0.2.2"; + edition = "2021"; + sha256 = "0m7jjzlcccw716dy9423xxh0clys8pfpllc5smvfxrzdf66h9b5l"; + libName = "unicode_width"; + authors = [ + "kwantam " + "Manish Goregaokar " + ]; + features = { + "core" = [ "dep:core" ]; + "default" = [ "cjk" ]; + "rustc-dep-of-std" = [ "std" "core" ]; + "std" = [ "dep:std" ]; + }; + resolvedDefaultFeatures = [ "cjk" "default" ]; + }; "unicode-xid" = rec { crateName = "unicode-xid"; version = "0.2.6"; diff --git a/Cargo.toml b/Cargo.toml index 854e0143..867826de 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -10,7 +10,7 @@ edition = "2024" repository = "https://github.com/stackabletech/kafka-operator" [workspace.dependencies] -stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", tag = "stackable-operator-0.112.0", features = ["crds", "webhook"] } +stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", tag = "stackable-operator-0.113.1", features = ["crds", "webhook"] } anyhow = "1.0.103" built = { version = "0.8", features = ["chrono", "git2"] } diff --git a/crate-hashes.json b/crate-hashes.json index 667a9fc4..f660b5eb 100644 --- a/crate-hashes.json +++ b/crate-hashes.json @@ -1,12 +1,12 @@ { - "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.112.0#k8s-version@0.1.3": "054p2mcinq3x4iykmc72nhga7kapc8ihkx9mnzqq3qdm2bk2qcps", - "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.112.0#stackable-certs@0.4.0": "054p2mcinq3x4iykmc72nhga7kapc8ihkx9mnzqq3qdm2bk2qcps", - "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.112.0#stackable-operator-derive@0.3.1": "054p2mcinq3x4iykmc72nhga7kapc8ihkx9mnzqq3qdm2bk2qcps", - "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.112.0#stackable-operator@0.112.0": "054p2mcinq3x4iykmc72nhga7kapc8ihkx9mnzqq3qdm2bk2qcps", - "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.112.0#stackable-shared@0.1.1": "054p2mcinq3x4iykmc72nhga7kapc8ihkx9mnzqq3qdm2bk2qcps", - "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.112.0#stackable-telemetry@0.6.4": "054p2mcinq3x4iykmc72nhga7kapc8ihkx9mnzqq3qdm2bk2qcps", - "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.112.0#stackable-versioned-macros@0.10.0": "054p2mcinq3x4iykmc72nhga7kapc8ihkx9mnzqq3qdm2bk2qcps", - "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.112.0#stackable-versioned@0.10.0": "054p2mcinq3x4iykmc72nhga7kapc8ihkx9mnzqq3qdm2bk2qcps", - "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.112.0#stackable-webhook@0.9.1": "054p2mcinq3x4iykmc72nhga7kapc8ihkx9mnzqq3qdm2bk2qcps", + "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.1#k8s-version@0.1.3": "1qq2z64gzx4sd1csh35cxcfshvhgrm0c9b13rq0sqv0046lmhh33", + "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.1#stackable-certs@0.4.1": "1qq2z64gzx4sd1csh35cxcfshvhgrm0c9b13rq0sqv0046lmhh33", + "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.1#stackable-operator-derive@0.3.1": "1qq2z64gzx4sd1csh35cxcfshvhgrm0c9b13rq0sqv0046lmhh33", + "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.1#stackable-operator@0.113.1": "1qq2z64gzx4sd1csh35cxcfshvhgrm0c9b13rq0sqv0046lmhh33", + "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.1#stackable-shared@0.1.2": "1qq2z64gzx4sd1csh35cxcfshvhgrm0c9b13rq0sqv0046lmhh33", + "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.1#stackable-telemetry@0.6.5": "1qq2z64gzx4sd1csh35cxcfshvhgrm0c9b13rq0sqv0046lmhh33", + "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.1#stackable-versioned-macros@0.11.1": "1qq2z64gzx4sd1csh35cxcfshvhgrm0c9b13rq0sqv0046lmhh33", + "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.1#stackable-versioned@0.11.1": "1qq2z64gzx4sd1csh35cxcfshvhgrm0c9b13rq0sqv0046lmhh33", + "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.1#stackable-webhook@0.9.2": "1qq2z64gzx4sd1csh35cxcfshvhgrm0c9b13rq0sqv0046lmhh33", "git+https://github.com/stackabletech/product-config.git?tag=0.8.0#product-config@0.8.0": "1dz70kapm2wdqcr7ndyjji0lhsl98bsq95gnb2lw487wf6yr7987" } \ No newline at end of file diff --git a/docs/modules/kafka/examples/security/01-setup.yaml b/docs/modules/kafka/examples/security/01-setup.yaml new file mode 100644 index 00000000..58a24bd8 --- /dev/null +++ b/docs/modules/kafka/examples/security/01-setup.yaml @@ -0,0 +1,20 @@ +--- +apiVersion: zookeeper.stackable.tech/v1alpha1 +kind: ZookeeperCluster +metadata: + name: simple-zk +spec: + image: + productVersion: 3.9.5 + servers: + roleGroups: + default: + replicas: 1 +--- +apiVersion: zookeeper.stackable.tech/v1alpha1 +kind: ZookeeperZnode +metadata: + name: simple-kafka-znode +spec: + clusterRef: + name: simple-zk diff --git a/docs/modules/kafka/examples/security/02-authorization-opa.yaml b/docs/modules/kafka/examples/security/02-authorization-opa.yaml new file mode 100644 index 00000000..c10612df --- /dev/null +++ b/docs/modules/kafka/examples/security/02-authorization-opa.yaml @@ -0,0 +1,63 @@ +--- +apiVersion: opa.stackable.tech/v1alpha1 +kind: OpaCluster +metadata: + name: simple-opa +spec: + image: + productVersion: 1.16.2 + servers: + config: + logging: + containers: + opa: + loggers: + decision: + level: INFO + roleGroups: + default: {} +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: kafka-rego-rules + labels: + opa.stackable.tech/bundle: "true" +data: + kafka.rego: | + package kafka + + is_internal_request if input.requestContext.listenerName == "INTERNAL" + is_external_request if not is_internal_request + + # FQDNs of the brokers as regular expressions + brokers_fqdn := [ + `local`, # cluster domain + `cluster`, # cluster domain + `svc`, + `default`, # namespace + `simple-kafka-broker-default-headless`, # Pod subdomain + `simple-kafka-broker-default-[0-9]+`, # Pod name + ] + + domain_components = [concat("", [`DC=`, dc]) | some dc in brokers_fqdn] + common_name = `CN=generated certificate for pod` + subject_dn_fields = array.concat(domain_components, [common_name]) + brokers_subject_dn_pattern := concat("", ["^", concat(",", subject_dn_fields), "$"]) + + default allow := false + + allow if { + is_internal_request + + regex.match( + brokers_subject_dn_pattern, + input.requestContext.principal.name, + ) + } + + allow if { + is_external_request + + # TODO Add your own rules + } diff --git a/docs/modules/kafka/examples/security/03a-authorization-kafkacluster.yaml b/docs/modules/kafka/examples/security/03a-authorization-kafkacluster.yaml new file mode 100644 index 00000000..21b7caab --- /dev/null +++ b/docs/modules/kafka/examples/security/03a-authorization-kafkacluster.yaml @@ -0,0 +1,18 @@ +--- +apiVersion: kafka.stackable.tech/v1alpha1 +kind: KafkaCluster +metadata: + name: simple-kafka +spec: + image: + productVersion: 3.9.2 + clusterConfig: + authorization: + opa: + configMapName: simple-opa + package: kafka + zookeeperConfigMapName: simple-kafka-znode + brokers: + roleGroups: + default: + replicas: 1 diff --git a/docs/modules/kafka/examples/security/03b-authorization-kafkacluster-custom-properties.yaml b/docs/modules/kafka/examples/security/03b-authorization-kafkacluster-custom-properties.yaml new file mode 100644 index 00000000..c3c33032 --- /dev/null +++ b/docs/modules/kafka/examples/security/03b-authorization-kafkacluster-custom-properties.yaml @@ -0,0 +1,23 @@ +--- +apiVersion: kafka.stackable.tech/v1alpha1 +kind: KafkaCluster +metadata: + name: simple-kafka +spec: + image: + productVersion: 3.9.2 + clusterConfig: + authorization: + opa: + configMapName: simple-opa + package: kafka + zookeeperConfigMapName: simple-kafka-znode + brokers: + configOverrides: + broker.properties: + opa.authorizer.cache.initial.capacity: "100" + opa.authorizer.cache.maximum.size: "100" + opa.authorizer.cache.expire.after.seconds: "10" + roleGroups: + default: + replicas: 1 diff --git a/docs/modules/kafka/pages/usage-guide/security.adoc b/docs/modules/kafka/pages/usage-guide/security.adoc index 601f2660..598bc96c 100644 --- a/docs/modules/kafka/pages/usage-guide/security.adoc +++ b/docs/modules/kafka/pages/usage-guide/security.adoc @@ -177,53 +177,24 @@ The package is optional and defaults to the `metadata.name` field: [source,yaml] ---- ---- -apiVersion: kafka.stackable.tech/v1alpha1 -kind: KafkaCluster -metadata: - name: simple-kafka -spec: - image: - productVersion: 3.9.2 - clusterConfig: - authorization: - opa: - configMapName: simple-opa - package: kafka - zookeeperConfigMapName: simple-kafka-znode - brokers: - roleGroups: - default: - replicas: 1 +include::example$security/03a-authorization-kafkacluster.yaml[] ---- You can change some opa cache properties by overriding: [source,yaml] ---- ---- -apiVersion: kafka.stackable.tech/v1alpha1 -kind: KafkaCluster -metadata: - name: simple-kafka -spec: - image: - productVersion: 3.9.2 - clusterConfig: - authorization: - opa: - configMapName: simple-opa - package: kafka - zookeeperConfigMapName: simple-kafka-znode - brokers: - configOverrides: - broker.properties: - opa.authorizer.cache.initial.capacity: "100" - opa.authorizer.cache.maximum.size: "100" - opa.authorizer.cache.expire.after.seconds: "10" - roleGroups: - default: - replicas: 1 +include::example$security/03b-authorization-kafkacluster-custom-properties.yaml[] ---- A full list of settings and their respective defaults can be found https://github.com/anderseknert/opa-kafka-plugin[here]. + +The OPA Rego rules can authorize both external and internal communication. +For internal communication, the principal name is the subject DN of the broker's certificate. +The subject DN contains the FQDN of the pod and a generic common name, e.g. `DC=local,DC=cluster,DC=svc,DC=default,DC=simple-kafka-broker-default-headless,DC=simple-kafka-broker-default-0,CN=generated certificate for pod`. +An OpaCluster and the Rego rules that verify the subject DNs could look as follows: + +[source,yaml] +---- +include::example$security/02-authorization-opa.yaml[] +---- diff --git a/extra/crds.yaml b/extra/crds.yaml index 1b684308..97b6e0a5 100644 --- a/extra/crds.yaml +++ b/extra/crds.yaml @@ -18,7 +18,7 @@ spec: name: v1alpha1 schema: openAPIV3Schema: - description: Auto-generated derived type for KafkaClusterSpec via `CustomResource` + description: A Kafka cluster stacklet. This resource is managed by the Stackable operator for Apache Kafka. properties: spec: description: |- @@ -1072,6 +1072,21 @@ spec: nullable: true type: integer type: object + description: |- + The set of role groups for this role, keyed by their name. + + A role group is a subset of the replicas of a role that share the same configuration, + allowing finer-grained control than the role level. This is useful to e.g. schedule groups + onto different classes of nodes or into different regions, or to run them with different + settings. Configuration set on a role group is merged on top of the role-level `config`, + with the more specific role group values taking precedence. + + Every role needs at least one role group. A role with a single role group conventionally + names it `default`. + + Read the + [roles and role groups concept documentation](https://docs.stackable.tech/home/nightly/concepts/roles-and-role-groups) + for more details. type: object required: - roleGroups @@ -2148,6 +2163,21 @@ spec: nullable: true type: integer type: object + description: |- + The set of role groups for this role, keyed by their name. + + A role group is a subset of the replicas of a role that share the same configuration, + allowing finer-grained control than the role level. This is useful to e.g. schedule groups + onto different classes of nodes or into different regions, or to run them with different + settings. Configuration set on a role group is merged on top of the role-level `config`, + with the more specific role group values taking precedence. + + Every role needs at least one role group. A role with a single role group conventionally + names it `default`. + + Read the + [roles and role groups concept documentation](https://docs.stackable.tech/home/nightly/concepts/roles-and-role-groups) + for more details. type: object required: - roleGroups diff --git a/rust/operator-binary/src/controller/build/resource/rbac.rs b/rust/operator-binary/src/controller/build/resource/rbac.rs index cfa9f472..dfe0e057 100644 --- a/rust/operator-binary/src/controller/build/resource/rbac.rs +++ b/rust/operator-binary/src/controller/build/resource/rbac.rs @@ -67,7 +67,7 @@ pub fn build_rbac_role_binding( .with_labels(labels) .build(), role_ref: RoleRef { - api_group: "rbac.authorization.k8s.io".to_string(), + api_group: Some("rbac.authorization.k8s.io".to_owned()), kind: "ClusterRole".to_string(), name: resource_names.cluster_role_name().to_string(), }, diff --git a/rust/operator-binary/src/controller/build/security.rs b/rust/operator-binary/src/controller/build/security.rs index 27d030b2..e36191c1 100644 --- a/rust/operator-binary/src/controller/build/security.rs +++ b/rust/operator-binary/src/controller/build/security.rs @@ -319,6 +319,7 @@ pub fn add_controller_volume_and_volume_mounts( .with_pod_scope() .with_format(SecretFormat::TlsPkcs12) .with_auto_tls_cert_lifetime(*requested_secret_lifetime) + .with_auto_tls_cert_domain_components_in_subject_dn(true) .build() .context(SecretVolumeBuildSnafu)?, ) @@ -576,6 +577,7 @@ fn create_kcat_tls_volume( .with_pod_scope() .with_format(SecretFormat::TlsPem) .with_auto_tls_cert_lifetime(*requested_secret_lifetime) + .with_auto_tls_cert_domain_components_in_subject_dn(true) .build() .context(SecretVolumeBuildSnafu)?, ) @@ -600,6 +602,7 @@ fn create_tls_keystore_volume( .with_listener_volume_scope(LISTENER_BOOTSTRAP_VOLUME_NAME) .with_format(SecretFormat::TlsPkcs12) .with_auto_tls_cert_lifetime(*requested_secret_lifetime) + .with_auto_tls_cert_domain_components_in_subject_dn(true) .build() .context(SecretVolumeBuildSnafu)?, ) diff --git a/rust/operator-binary/src/crd/mod.rs b/rust/operator-binary/src/crd/mod.rs index 5bbbe91f..503ff159 100644 --- a/rust/operator-binary/src/crd/mod.rs +++ b/rust/operator-binary/src/crd/mod.rs @@ -116,6 +116,7 @@ pub mod versioned { /// Find more information on how to use it and the resources that the operator generates in the /// [operator documentation](DOCS_BASE_URL_PLACEHOLDER/kafka/). #[versioned(crd( + doc = "A Kafka cluster stacklet. This resource is managed by the Stackable operator for Apache Kafka.", group = "kafka.stackable.tech", plural = "kafkaclusters", status = "KafkaClusterStatus", diff --git a/tests/templates/kuttl/opa/20-install-opa.yaml b/tests/templates/kuttl/opa/20-install-opa.yaml new file mode 100644 index 00000000..8adb9177 --- /dev/null +++ b/tests/templates/kuttl/opa/20-install-opa.yaml @@ -0,0 +1,7 @@ +--- +apiVersion: kuttl.dev/v1beta1 +kind: TestStep +commands: + - script: > + envsubst '$NAMESPACE' < 20_opa.yaml | + kubectl apply -n $NAMESPACE -f - diff --git a/tests/templates/kuttl/opa/20-install-opa.yaml.j2 b/tests/templates/kuttl/opa/20-install-opa.yaml.j2 deleted file mode 100644 index dcc10746..00000000 --- a/tests/templates/kuttl/opa/20-install-opa.yaml.j2 +++ /dev/null @@ -1,83 +0,0 @@ ---- -apiVersion: kuttl.dev/v1beta1 -kind: TestStep -commands: - - script: | - kubectl apply -n $NAMESPACE -f - < 0 %} - custom: "{{ test_scenario['values']['opa-latest'].split(',')[1] }}" - productVersion: "{{ test_scenario['values']['opa-latest'].split(',')[0] }}" -{% else %} - productVersion: "{{ test_scenario['values']['opa-latest'] }}" -{% endif %} - pullPolicy: IfNotPresent - clusterConfig: -{% if test_scenario['values']['use-opa-tls'] == "true" %} - tls: - serverSecretClass: opa-tls-$NAMESPACE -{% endif %} - vectorAggregatorConfigMapName: vector-aggregator-discovery - servers: - config: - logging: - enableVectorAgent: true - containers: - opa: - console: - level: INFO - file: - level: INFO - loggers: - decision: - level: INFO - roleGroups: - default: {} - EOF diff --git a/tests/templates/kuttl/opa/20_opa.yaml.j2 b/tests/templates/kuttl/opa/20_opa.yaml.j2 new file mode 100644 index 00000000..51c6f411 --- /dev/null +++ b/tests/templates/kuttl/opa/20_opa.yaml.j2 @@ -0,0 +1,101 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: test-rego-kafka + labels: + opa.stackable.tech/bundle: "true" +data: + kafka.rego: | + package authz + + # FQDN of the brokers as regular expressions + brokers_fqdn := [ + `local`, + `cluster`, + `svc`, + `$NAMESPACE`, + `test-kafka-broker-default-headless`, + `test-kafka-broker-default-[0-9]+`, + ] + + domain_components = [concat("", [`DC=`, dc]) | some dc in brokers_fqdn] + common_name = `CN=generated certificate for pod` + subject_dn_fields = array.concat(domain_components, [common_name]) + brokers_subject_dn_pattern := concat("", ["^", concat(",", subject_dn_fields), "$"]) + + default allow := false + + allow if { + is_internal_request + + regex.match( + brokers_subject_dn_pattern, + input.requestContext.principal.name, + ) + } + + allow if { + is_external_request + input.requestContext.principal.name == "kafka" + } + + allow if { + is_external_request + input.requestContext.principal.name == "developer" + resource_is_allowed + } + + is_internal_request if input.requestContext.listenerName == "INTERNAL" + is_external_request if not is_internal_request + + # only allow access to a specific topic + resource_is_allowed if { + input.action.resourcePattern.resourceType == "TOPIC" + input.action.resourcePattern.name == "test-topic" + action_is_allowed + } + + resource_is_allowed if { + input.action.resourcePattern.resourceType == "GROUP" + input.action.operation in ["DESCRIBE", "READ"] + } + + action_is_allowed if { + input.action.operation in ["CREATE", "DESCRIBE", "READ", "WRITE"] + } +--- +apiVersion: opa.stackable.tech/v1alpha1 +kind: OpaCluster +metadata: + name: test-opa +spec: + image: +{% if test_scenario['values']['opa-latest'].find(",") > 0 %} + custom: "{{ test_scenario['values']['opa-latest'].split(',')[1] }}" + productVersion: "{{ test_scenario['values']['opa-latest'].split(',')[0] }}" +{% else %} + productVersion: "{{ test_scenario['values']['opa-latest'] }}" +{% endif %} + pullPolicy: IfNotPresent + clusterConfig: +{% if test_scenario['values']['use-opa-tls'] == "true" %} + tls: + serverSecretClass: opa-tls-$NAMESPACE +{% endif %} + vectorAggregatorConfigMapName: vector-aggregator-discovery + servers: + config: + logging: + enableVectorAgent: true + containers: + opa: + console: + level: INFO + file: + level: INFO + loggers: + decision: + level: INFO + roleGroups: + default: {} diff --git a/tests/templates/kuttl/opa/30-install-kafka.yaml.j2 b/tests/templates/kuttl/opa/30-install-kafka.yaml.j2 index ad31671d..8fdd8bb9 100644 --- a/tests/templates/kuttl/opa/30-install-kafka.yaml.j2 +++ b/tests/templates/kuttl/opa/30-install-kafka.yaml.j2 @@ -45,3 +45,4 @@ commands: roleGroups: default: replicas: 3 + EOF diff --git a/tests/templates/kuttl/smoke/34-assert.yaml.j2 b/tests/templates/kuttl/smoke/34-assert.yaml.j2 index a1c4133e..dff06328 100644 --- a/tests/templates/kuttl/smoke/34-assert.yaml.j2 +++ b/tests/templates/kuttl/smoke/34-assert.yaml.j2 @@ -339,11 +339,17 @@ commands: } . |= parse_regex!(.file, r'^${LOG_DIR}/(?P.*?)/(?P.*?)$') + # Filters the logs of the Vector agent according to the defined log level filtered_logs_vector: inputs: - vector type: filter - condition: '!includes(["TRACE", "DEBUG"], .metadata.level)' + condition: > + (.metadata.level == "TRACE" && "${VECTOR_FILE_LOG_LEVEL}" == "trace") || + (.metadata.level == "DEBUG" && includes(["trace", "debug"], "${VECTOR_FILE_LOG_LEVEL}")) || + (.metadata.level == "INFO" && includes(["trace", "debug", "info"], "${VECTOR_FILE_LOG_LEVEL}")) || + (.metadata.level == "WARN" && includes(["trace", "debug", "info", "warn"], "${VECTOR_FILE_LOG_LEVEL}")) || + (.metadata.level == "ERROR" && includes(["trace", "debug", "info", "warn", "error"], "${VECTOR_FILE_LOG_LEVEL}")) extended_logs_vector: inputs: