Skip to content

Feature: Allow workloadKind: Deployment - #873

Draft
Maleware wants to merge 11 commits into
spike/riffrom
feat/opa-as-deployment
Draft

Feature: Allow workloadKind: Deployment#873
Maleware wants to merge 11 commits into
spike/riffrom
feat/opa-as-deployment

Conversation

@Maleware

@Maleware Maleware commented Aug 11, 2026

Copy link
Copy Markdown
Member

Description

HINT: Takes spike/rif as base as changes overlap. Please merge #863 first.

Allow opa being deployed as workload deployment.

Definition of Done Checklist

  • Not all of these items are applicable to all PRs, the author should update this template to only leave the boxes in that are relevant
  • Please make sure all these things are done and tick the boxes

Author

  • Changes are OpenShift compatible
  • CRD changes approved
  • CRD documentation for all fields, following the style guide.
  • Helm chart can be installed and deployed operator works
  • Integration tests passed (for non trivial changes)
  • Changes need to be "offline" compatible
  • Links to generated (nightly) docs added
  • Release note snippet added

Reviewer

  • Code contains useful comments
  • Code contains useful logging statements
  • (Integration-)Test cases added
  • Documentation added or updated. Follows the style guide.
  • Changelog updated
  • Cargo.toml only contains references to git tags (not specific commits or branches)

Acceptance

  • Feature Tracker has been updated
  • Proper release label has been added
  • Links to generated (nightly) docs added
  • Release note snippet added
  • Add type/deprecation label & add to the deprecation schedule
  • Add type/experimental label & add to the experimental features tracker

Maleware and others added 6 commits August 11, 2026 10:26
…rs.roleConfig

Replaces the EmptyRoleConfig parameter of OpaRoleType with a product-specific
OpaRoleConfig, as the extension point for deploying the servers role as either a
DaemonSet or a Deployment (#525).

The CRD half only - no builder, PDB or orphan-cleanup changes.

Both internalTrafficPolicy and podDisruptionBudget.enabled are Options with a
null default, because their effective default depends on workloadKind and an
OpenAPI default cannot express that. The operator derives them instead:

  workloadKind | internalTrafficPolicy | podDisruptionBudget.enabled
  DaemonSet    | Local                 | false
  Deployment   | Cluster               | true

A hard-coded schema default would let the apiserver stamp a value in before the
operator sees the object, so "user chose Local" and "user said nothing" would be
indistinguishable. It would also create a PodDisruptionBudget on every existing
DaemonSet installation at upgrade time, protecting nothing.

Decision: stackabletech/decisions#91

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@Maleware
Maleware changed the base branch from main to spike/rif August 11, 2026 09:20
@Maleware Maleware self-assigned this Aug 11, 2026
@Maleware Maleware moved this to Development: In Progress in Stackable Engineering Aug 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Development: In Progress

Development

Successfully merging this pull request may close these issues.

1 participant