feat: Add graceful shutdown (#396)

* feat: Add graceful shutdown

* chore: Bump bytes crate to 1.11.1

Fixes RUSTSEC-2026-0007.

* chore: Bump git2 crate to 0.20.4

Fixes RUSTSEC-2026-0008.

* chore: Add changelog entry

Author: Techassi

CHANGELOG.md

@@ -4,6 +4,10 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+### Changed
+
+- Gracefully shutdown all concurrent tasks by forwarding the SIGTERM signal ([#396]).
+
 ### Fixed
 
 - BREAKING: Prevent Pod 0 restart by utilizing a mutating webhook.
@@ -13,6 +17,7 @@ All notable changes to this project will be documented in this file.
   env variable ([#387]).
 
 [#387]: https://github.com/stackabletech/commons-operator/pull/387
+[#396]: https://github.com/stackabletech/commons-operator/pull/396
 
 ## [25.11.0] - 2025-11-07
 

Cargo.lock

@@ -10,7 +10,7 @@ edition = "2021"
 repository = "https://github.com/stackabletech/commons-operator"
 
 [workspace.dependencies]
-stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", tag = "stackable-operator-0.101.1", features = ["telemetry", "webhook"] }
+stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", tag = "stackable-operator-0.105.0", features = ["telemetry", "webhook"] }
 
 anyhow = "1.0"
 built = { version = "0.8", features = ["chrono", "git2"] }

Cargo.nix

@@ -16,6 +16,7 @@ use stackable_operator::{
     eos::EndOfSupportChecker,
     shared::yaml::SerializeOptions,
     telemetry::Tracing,
+    utils::signal::SignalWatcher,
 };
 use webhook::create_webhook_server;
 
@@ -90,9 +91,13 @@ async fn main() -> anyhow::Result<()> {
                 description = built_info::PKG_DESCRIPTION
             );
 
+            // Watches for the SIGTERM signal and sends a signal to all receivers, which gracefully
+            // shuts down all concurrent tasks below (EoS checker, controller).
+            let sigterm_watcher = SignalWatcher::sigterm()?;
+
             let eos_checker =
                 EndOfSupportChecker::new(built_info::BUILT_TIME_UTC, maintenance.end_of_support)?
-                    .run()
+                    .run(sigterm_watcher.handle())
                     .map(anyhow::Ok);
 
             let client = stackable_operator::client::initialize_operator(
@@ -107,10 +112,13 @@ async fn main() -> anyhow::Result<()> {
                 cm_store_tx,
                 secret_store_tx,
                 &watch_namespace,
+                sigterm_watcher.handle(),
             )
             .map(anyhow::Ok);
+
             let pod_restart_controller =
-                restart_controller::pod::start(&client, &watch_namespace).map(anyhow::Ok);
+                restart_controller::pod::start(&client, &watch_namespace, sigterm_watcher.handle())
+                    .map(anyhow::Ok);
 
             let webhook_server = create_webhook_server(
                 ctx,
@@ -119,8 +127,9 @@ async fn main() -> anyhow::Result<()> {
                 client.as_kube_client(),
             )
             .await?;
+
             let webhook_server = webhook_server
-                .run()
+                .run(sigterm_watcher.handle())
                 .map_err(|err| anyhow!(err).context("failed to run webhook"));
 
             futures::try_join!(

Cargo.toml

@@ -1,4 +1,4 @@
-use std::{sync::Arc, time::Duration};
+use std::{future::Future, sync::Arc, time::Duration};
 
 use futures::StreamExt;
 use http::StatusCode;
@@ -70,7 +70,10 @@ impl ReconcilerError for Error {
     }
 }
 
-pub async fn start(client: &Client, watch_namespace: &WatchNamespace) {
+pub async fn start<F>(client: &Client, watch_namespace: &WatchNamespace, shutdown_signal: F)
+where
+    F: Future<Output = ()> + Send + Sync + 'static,
+{
     let controller = Controller::new(
         watch_namespace.get_api::<PartialObjectMeta<Pod>>(client),
         // TODO: Can we only watch a subset of Pods with a specify label, e.g.
@@ -85,6 +88,7 @@ pub async fn start(client: &Client, watch_namespace: &WatchNamespace) {
         },
     ));
     controller
+        .graceful_shutdown_on(shutdown_signal)
         .run(
             reconcile,
             error_policy,