Skip to content

Feature: Allow workloadKind: Deployment - #873

Draft
Maleware wants to merge 9 commits into
spike/riffrom
feat/opa-as-deployment
Draft

Feature: Allow workloadKind: Deployment#873
Maleware wants to merge 9 commits into
spike/riffrom
feat/opa-as-deployment

Conversation

@Maleware

@Maleware Maleware commented Aug 11, 2026

Copy link
Copy Markdown
Member

Description

HINT: Takes spike/rif as base as changes overlap. Please merge #863 first.

Allow opa being deployed as workload deployment.

Definition of Done Checklist

  • Not all of these items are applicable to all PRs, the author should update this template to only leave the boxes in that are relevant
  • Please make sure all these things are done and tick the boxes

Author

  • Changes are OpenShift compatible
  • CRD changes approved
  • CRD documentation for all fields, following the style guide.
  • Helm chart can be installed and deployed operator works
  • Integration tests passed (for non trivial changes)
  • Changes need to be "offline" compatible
  • Links to generated (nightly) docs added
  • Release note snippet added

Reviewer

  • Code contains useful comments
  • Code contains useful logging statements
  • (Integration-)Test cases added
  • Documentation added or updated. Follows the style guide.
  • Changelog updated
  • Cargo.toml only contains references to git tags (not specific commits or branches)

Acceptance

  • Feature Tracker has been updated
  • Proper release label has been added
  • Links to generated (nightly) docs added
  • Release note snippet added
  • Add type/deprecation label & add to the deprecation schedule
  • Add type/experimental label & add to the experimental features tracker

Maleware and others added 6 commits August 11, 2026 10:26
…rs.roleConfig

Replaces the EmptyRoleConfig parameter of OpaRoleType with a product-specific
OpaRoleConfig, as the extension point for deploying the servers role as either a
DaemonSet or a Deployment (#525).

The CRD half only - no builder, PDB or orphan-cleanup changes.

Both internalTrafficPolicy and podDisruptionBudget.enabled are Options with a
null default, because their effective default depends on workloadKind and an
OpenAPI default cannot express that. The operator derives them instead:

  workloadKind | internalTrafficPolicy | podDisruptionBudget.enabled
  DaemonSet    | Local                 | false
  Deployment   | Cluster               | true

A hard-coded schema default would let the apiserver stamp a value in before the
operator sees the object, so "user chose Local" and "user said nothing" would be
indistinguishable. It would also create a PodDisruptionBudget on every existing
DaemonSet installation at upgrade time, protecting nothing.

Decision: stackabletech/decisions#91

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@Maleware
Maleware changed the base branch from main to spike/rif August 11, 2026 09:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant