From c8d83050887739905183d34df53b77e73f21d303 Mon Sep 17 00:00:00 2001 From: Stacky McStackface Date: Tue, 4 Aug 2026 08:14:16 +0000 Subject: [PATCH] chore: Generated commit to update templated files since the last template run up to stackabletech/operator-templating@b1c6faac33a20410da088bd01ec1b6393d93b6f1 Reference-to: stackabletech/operator-templating@b1c6faa (chore: operator-templating updates) --- Makefile | 7 ++--- default.nix | 34 ++++++++++++++++++++++ deploy/helm/opa-operator/Chart.yaml | 15 +++++++++- deploy/helm/opa-operator/README.md | 44 +++++++++++++++++++++-------- docker/Dockerfile | 1 + nix/meta.json | 2 +- 6 files changed, 84 insertions(+), 19 deletions(-) diff --git a/Makefile b/Makefile index 167ba8fb..208aab44 100644 --- a/Makefile +++ b/Makefile @@ -30,9 +30,6 @@ docker-build: ## Chart related targets compile-chart: version crds -chart-clean: - rm -rf "deploy/helm/${OPERATOR_NAME}/crds" - version: cat "deploy/helm/${OPERATOR_NAME}/Chart.yaml" | yq ".version = \"${VERSION}\" | .appVersion = \"${VERSION}\"" > "deploy/helm/${OPERATOR_NAME}/Chart.yaml.new" mv "deploy/helm/${OPERATOR_NAME}/Chart.yaml.new" "deploy/helm/${OPERATOR_NAME}/Chart.yaml" @@ -46,11 +43,11 @@ crds: chart-lint: compile-chart docker run -it -v $(shell pwd):/build/helm-charts -w /build/helm-charts quay.io/helmpack/chart-testing:v3.5.0 ct lint --config deploy/helm/ct.yaml -clean: chart-clean +clean: cargo clean docker rmi --force '${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}:${VERSION}' -regenerate-charts: chart-clean compile-chart +regenerate-charts: compile-chart regenerate-nix: nix run --extra-experimental-features "nix-command flakes" -f . regenerateNixLockfiles diff --git a/default.nix b/default.nix index 20cc7944..6feb190a 100644 --- a/default.nix +++ b/default.nix @@ -133,6 +133,12 @@ rec { ${entrypoint} crd > $out ''; + # The unprivileged user that the operator runs as. + # These values must be kept in sync with docker/Dockerfile! + stackableUserName = "stackable"; + stackableUserUid = 782252253; + stackableUserGid = 574654813; + # We're building the docker image *for* Linux, but we need to # build it in the local environment so that the generated load-image # can run locally. @@ -150,9 +156,37 @@ rec { pkgsTarget.coreutils pkgsTarget.util-linuxMinimal ]; + + # Nix images don't contain a user database, so create a minimal one containing the same user + # that docker/Dockerfile creates via groupadd/useradd. Without it the UID cannot be resolved to + # a name and a home directory, which breaks tools such as `whoami` and makes for a confusing + # shell prompt when using `kubectl exec`. + extraCommands = '' + mkdir -p etc stackable + cat > etc/passwd < etc/group < # Helm Chart for Stackable Operator for OpenPolicyAgent -This Helm Chart can be used to install Custom Resource Definitions and the Operator for OpenPolicyAgent provided by Stackable. +Kubernetes operator for the Open Policy Agent (OPA). Deploy and run OPA for authorization with the Stackable Data Platform (SDP). ## Requirements -- Create a [Kubernetes Cluster](../Readme.md) -- Install [Helm](https://helm.sh/docs/intro/install/) +- A running Kubernetes cluster +- [Helm](https://helm.sh/docs/intro/install/) 3.8 or newer, for OCI support -## Install the Stackable Operator for OpenPolicyAgent +## Install ```bash -# From the root of the operator repository -make compile-chart - -helm install opa-operator deploy/helm/opa-operator +helm install opa-operator oci://oci.stackable.tech/sdp-charts/opa-operator ``` -## Usage of the CRDs +Add `--version` to pin a release, for example `--version 26.7.0`. +Released versions are listed in the [SDP release notes](https://docs.stackable.tech/home/stable/release-notes/) and on the [Stackable Hub](https://hub.stackable.tech/releases). + +Since SDP 26.7 the chart is published to two registries: + +- `oci://oci.stackable.tech/sdp-charts/opa-operator` +- `oci://quay.io/stackable/sdp-charts/opa-operator` + +Both hold the same chart, but the registry you install from also decides where the operator pulls product images from. +Install from quay.io and the operator is configured to use product images from quay.io as well. -The usage of this operator and its CRDs is described in the [documentation](https://docs.stackable.tech/opa/index.html) +Operators are not usually installed on their own. +Most of them need the commons, secret and listener operators alongside them, and `stackablectl` installs a matching set in one step. +See the [documentation](https://docs.stackable.tech/home/stable/opa/) for the full picture. -The operator has example requests included in the [`/examples`](https://github.com/stackabletech/opa-operator/tree/main/examples) directory. +## Custom resources + +This operator installs and manages its own CustomResourceDefinitions, so they are not part of this chart. +The resources it reconciles, and the configuration they accept, are described in the [documentation](https://docs.stackable.tech/home/stable/opa/). +Each CRD is also browsable on the [Stackable Hub](https://hub.stackable.tech/components/opa), with its schema and the API versions served per SDP release. ## Links - +- [Documentation](https://docs.stackable.tech/home/stable/opa/) +- [Stackable Hub](https://hub.stackable.tech/) +- [Source](https://github.com/stackabletech/opa-operator) +- [Report an issue](https://github.com/stackabletech/opa-operator/issues) +- [Stackable Data Platform](https://stackable.tech/) + +## License + +[Open Software License version 3.0](https://github.com/stackabletech/opa-operator/blob/main/LICENSE) diff --git a/docker/Dockerfile b/docker/Dockerfile index 74733ed0..98040d1e 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -26,6 +26,7 @@ ARG VERSION ARG RELEASE="1" # These are chosen at random and are this high on purpose to have very little chance to clash with an existing user or group on the host system +# NOTE: Please also update default.nix accordingly! ARG STACKABLE_USER_GID="574654813" ARG STACKABLE_USER_UID="782252253" ARG STACKABLE_USER_NAME="stackable" diff --git a/nix/meta.json b/nix/meta.json index fc67b4d1..6ada8974 100644 --- a/nix/meta.json +++ b/nix/meta.json @@ -1 +1 @@ -{"operator": {"name": "opa-operator", "pretty_string": "OpenPolicyAgent", "product_string": "opa", "url": "stackabletech/opa-operator.git", "config": {"extra_crates": ["stackable-opa-bundle-builder"]}}} +{"operator": {"name": "opa-operator", "pretty_string": "OpenPolicyAgent", "product_string": "opa", "url": "stackabletech/opa-operator.git", "chart_description": "Kubernetes operator for the Open Policy Agent (OPA). Deploy and run OPA for authorization with the Stackable Data Platform (SDP).", "keywords": ["open-policy-agent", "opa", "authorization", "policy", "rego", "kubernetes", "operator"], "config": {"extra_crates": ["stackable-opa-bundle-builder"]}}}