chore: Update templated files (b1c6faa)

Makefile

@@ -30,9 +30,6 @@ docker-build:
 ## Chart related targets
 compile-chart: version crds
 
-chart-clean:
-	rm -rf "deploy/helm/${OPERATOR_NAME}/crds"
-
 version:
 	cat "deploy/helm/${OPERATOR_NAME}/Chart.yaml" | yq ".version = \"${VERSION}\" | .appVersion = \"${VERSION}\"" > "deploy/helm/${OPERATOR_NAME}/Chart.yaml.new"
 	mv "deploy/helm/${OPERATOR_NAME}/Chart.yaml.new" "deploy/helm/${OPERATOR_NAME}/Chart.yaml"
@@ -46,11 +43,11 @@ crds:
 chart-lint: compile-chart
 	docker run -it -v $(shell pwd):/build/helm-charts -w /build/helm-charts quay.io/helmpack/chart-testing:v3.5.0  ct lint --config deploy/helm/ct.yaml
 
-clean: chart-clean
+clean:
 	cargo clean
 	docker rmi --force '${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}:${VERSION}'
 
-regenerate-charts: chart-clean compile-chart
+regenerate-charts: compile-chart
 
 regenerate-nix:
 	nix run --extra-experimental-features "nix-command flakes" -f . regenerateNixLockfiles

default.nix

@@ -133,6 +133,12 @@ rec {
     ${entrypoint} crd > $out
   '';
 
+  # The unprivileged user that the operator runs as.
+  # These values must be kept in sync with docker/Dockerfile!
+  stackableUserName = "stackable";
+  stackableUserUid = 782252253;
+  stackableUserGid = 574654813;
+
   # We're building the docker image *for* Linux, but we need to
   # build it in the local environment so that the generated load-image
   # can run locally.
@@ -150,9 +156,37 @@ rec {
       pkgsTarget.coreutils
       pkgsTarget.util-linuxMinimal
     ];
+
+    # Nix images don't contain a user database, so create a minimal one containing the same user
+    # that docker/Dockerfile creates via groupadd/useradd. Without it the UID cannot be resolved to
+    # a name and a home directory, which breaks tools such as `whoami` and makes for a confusing
+    # shell prompt when using `kubectl exec`.
+    extraCommands = ''
+      mkdir -p etc stackable
+      cat > etc/passwd <<EOF
+      root:x:0:0:root:/root:/bin/bash
+      ${stackableUserName}:x:${toString stackableUserUid}:${toString stackableUserGid}:${stackableUserName}:/stackable:/bin/bash
+      EOF
+      cat > etc/group <<EOF
+      root:x:0:
+      ${stackableUserName}:x:${toString stackableUserGid}:
+      EOF
+    '';
+    # All files and folders are owned by the root group to support running as arbitrary users.
+    # This is best practice as all container users will belong to the root group (0).
+    # Same as in docker/Dockerfile.
+    fakeRootCommands = ''
+      chown -R ${toString stackableUserUid}:0 stackable
+      chmod -R g=u stackable
+    '';
+
     config = {
       Entrypoint = [ entrypoint ];
       Cmd = [ "run" ];
+      # Mirrors the `USER` instruction in docker/Dockerfile. Besides not running as root, this is
+      # also required for Pods that set `runAsNonRoot: true` without an explicit `runAsUser`,
+      # because the kubelet refuses to start containers whose image would run as root.
+      User = toString stackableUserUid;
     };
   };
   docker = pkgsLocal.linkFarm "${dockerImage.name}-docker" [

deploy/helm/opa-operator/Chart.yaml

@@ -3,8 +3,21 @@ apiVersion: v2
 name: opa-operator
 version: "0.0.0-dev"
 appVersion: "0.0.0-dev"
-description: The Stackable Operator for OpenPolicyAgent
+description: "Kubernetes operator for the Open Policy Agent (OPA). Deploy and run OPA for authorization with the Stackable Data Platform (SDP)."
 home: https://github.com/stackabletech/opa-operator
+sources:
+  - https://github.com/stackabletech/opa-operator
+keywords: ["open-policy-agent", "opa", "authorization", "policy", "rego", "kubernetes", "operator"]
 maintainers:
   - name: Stackable
     url: https://www.stackable.tech
+# Consumed by Artifact Hub, see https://artifacthub.io/docs/topics/annotations/helm/
+annotations:
+  # The chart package ships no LICENSE file, so Artifact Hub cannot detect this itself.
+  artifacthub.io/license: OSL-3.0
+  # A link named "support" is rendered highlighted by Artifact Hub. Keep it lowercase.
+  artifacthub.io/links: |
+    - name: Documentation
+      url: https://docs.stackable.tech/home/stable/opa/
+    - name: support
+      url: https://github.com/stackabletech/opa-operator/issues

deploy/helm/opa-operator/README.md

@@ -1,28 +1,48 @@
 <!-- markdownlint-disable MD034 -->
 # Helm Chart for Stackable Operator for OpenPolicyAgent
 
-This Helm Chart can be used to install Custom Resource Definitions and the Operator for OpenPolicyAgent provided by Stackable.
+Kubernetes operator for the Open Policy Agent (OPA). Deploy and run OPA for authorization with the Stackable Data Platform (SDP).
 
 ## Requirements
 
-- Create a [Kubernetes Cluster](../Readme.md)
-- Install [Helm](https://helm.sh/docs/intro/install/)
+- A running Kubernetes cluster
+- [Helm](https://helm.sh/docs/intro/install/) 3.8 or newer, for OCI support
 
-## Install the Stackable Operator for OpenPolicyAgent
+## Install
 
 ```bash
-# From the root of the operator repository
-make compile-chart
-
-helm install opa-operator deploy/helm/opa-operator
+helm install opa-operator oci://oci.stackable.tech/sdp-charts/opa-operator
 ```
 
-## Usage of the CRDs
+Add `--version` to pin a release, for example `--version 26.7.0`.
+Released versions are listed in the [SDP release notes](https://docs.stackable.tech/home/stable/release-notes/) and on the [Stackable Hub](https://hub.stackable.tech/releases).
+
+Since SDP 26.7 the chart is published to two registries:
+
+- `oci://oci.stackable.tech/sdp-charts/opa-operator`
+- `oci://quay.io/stackable/sdp-charts/opa-operator`
+
+Both hold the same chart, but the registry you install from also decides where the operator pulls product images from.
+Install from quay.io and the operator is configured to use product images from quay.io as well.
 
-The usage of this operator and its CRDs is described in the [documentation](https://docs.stackable.tech/opa/index.html)
+Operators are not usually installed on their own.
+Most of them need the commons, secret and listener operators alongside them, and `stackablectl` installs a matching set in one step.
+See the [documentation](https://docs.stackable.tech/home/stable/opa/) for the full picture.
 
-The operator has example requests included in the [`/examples`](https://github.com/stackabletech/opa-operator/tree/main/examples) directory.
+## Custom resources
+
+This operator installs and manages its own CustomResourceDefinitions, so they are not part of this chart.
+The resources it reconciles, and the configuration they accept, are described in the [documentation](https://docs.stackable.tech/home/stable/opa/).
+Each CRD is also browsable on the [Stackable Hub](https://hub.stackable.tech/components/opa), with its schema and the API versions served per SDP release.
 
 ## Links
 
-<https://github.com/stackabletech/opa-operator>
+- [Documentation](https://docs.stackable.tech/home/stable/opa/)
+- [Stackable Hub](https://hub.stackable.tech/)
+- [Source](https://github.com/stackabletech/opa-operator)
+- [Report an issue](https://github.com/stackabletech/opa-operator/issues)
+- [Stackable Data Platform](https://stackable.tech/)
+
+## License
+
+[Open Software License version 3.0](https://github.com/stackabletech/opa-operator/blob/main/LICENSE)

docker/Dockerfile

@@ -26,6 +26,7 @@ ARG VERSION
 ARG RELEASE="1"
 
 # These are chosen at random and are this high on purpose to have very little chance to clash with an existing user or group on the host system
+# NOTE: Please also update default.nix accordingly!
 ARG STACKABLE_USER_GID="574654813"
 ARG STACKABLE_USER_UID="782252253"
 ARG STACKABLE_USER_NAME="stackable"