Patch op-rs version to use one that fixes SUP-148. (#656)

* Patch op-rs version to use one that fixes SUP-148.

* Updated changelog

Use released op-rs version.

* Regenerate Nix files

* Run pre-commit

---------

Co-authored-by: Sönke Liebau <soenke.liebau@stackable.tech>
Co-authored-by: Siegfried Weber <mail@siegfriedweber.net>

Author: 3 people

CHANGELOG.md

@@ -25,6 +25,7 @@ All notable changes to this project will be documented in this file.
 
 - Bundle builder should no longer keep serving deleted rules until it is restarted ([#578]).
 - Failing to parse one `OpaCluster` should no longer cause the whole operator to stop functioning ([#638]).
+- BREAKING: Use distinct ServiceAccounts for the Stacklets, so that multiple Stacklets can be deployed in one namespace. Existing Stacklets will use the newly created ServiceAccounts after restart ([#656]).
 
 ### Removed
 
@@ -37,6 +38,7 @@ All notable changes to this project will be documented in this file.
 [#622]: https://github.com/stackabletech/opa-operator/pull/622
 [#637]: https://github.com/stackabletech/opa-operator/pull/637
 [#638]: https://github.com/stackabletech/opa-operator/pull/638
+[#656]: https://github.com/stackabletech/opa-operator/pull/656
 
 ## [24.7.0] - 2024-07-24
 

Cargo.lock

@@ -33,7 +33,7 @@ semver = "1.0"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 snafu = "0.8"
-stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", tag = "stackable-operator-0.80.0" }
+stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", tag = "stackable-operator-0.82.0" }
 strum = { version = "0.26", features = ["derive"] }
 tar = "0.4"
 tokio = { version = "1.40", features = ["full"] }

Cargo.nix

@@ -4,7 +4,7 @@ metadata:
   name: {{ .Release.Name }}-opa-bundle-builder-clusterrole
 # This role is used for the OPA bundle builder.
 # It needs to read ConfigMaps and watch ConfigMaps for changes,
-# because the Rego rules that are used to build the bundles are 
+# because the Rego rules that are used to build the bundles are
 # stored in the ConfigMaps.
 rules:
   - apiGroups:

Cargo.toml

@@ -38,7 +38,7 @@ use stackable_operator::{
             apps::v1::{DaemonSet, DaemonSetSpec},
             core::v1::{
                 ConfigMap, EmptyDirVolumeSource, EnvVar, HTTPGetAction, Probe, SecretVolumeSource,
-                Service, ServicePort, ServiceSpec,
+                Service, ServiceAccount, ServicePort, ServiceSpec,
             },
         },
         apimachinery::pkg::{apis::meta::v1::LabelSelector, util::intstr::IntOrString},
@@ -457,7 +457,7 @@ pub async fn reconcile_opa(
         build_rbac_resources(opa, APP_NAME, required_labels).context(BuildRbacResourcesSnafu)?;
 
     let rbac_sa = cluster_resources
-        .add(client, rbac_sa)
+        .add(client, rbac_sa.clone())
         .await
         .context(ApplyServiceAccountSnafu)?;
     cluster_resources
@@ -495,7 +495,7 @@ pub async fn reconcile_opa(
             &merged_config,
             &ctx.opa_bundle_builder_image,
             &ctx.user_info_fetcher_image,
-            &rbac_sa.name_any(),
+            &rbac_sa,
         )?;
 
         cluster_resources
@@ -740,7 +740,7 @@ fn build_server_rolegroup_daemonset(
     merged_config: &OpaConfig,
     opa_bundle_builder_image: &str,
     user_info_fetcher_image: &str,
-    sa_name: &str,
+    service_account: &ServiceAccount,
 ) -> Result<DaemonSet> {
     let role = opa.role(opa_role);
     let role_group = opa
@@ -932,7 +932,7 @@ fn build_server_rolegroup_daemonset(
                 .build(),
         )
         .context(AddVolumeSnafu)?
-        .service_account_name(sa_name)
+        .service_account_name(service_account.name_any())
         .security_context(
             PodSecurityContextBuilder::new()
                 .run_as_user(1000)

crate-hashes.json

@@ -8,4 +8,4 @@ then
     exit 1;
 fi
 
-echo "Test successful!";
+echo "Test successful!";