feat: install openlineage crd

CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+## Added
+
+- Install and manage the OpenLineageConnection custom resource definition ([#435]).
+
+[#435]: https://github.com/stackabletech/commons-operator/pull/435
+
 ## [26.7.0] - 2026-07-21
 
 ## [26.7.0-rc1] - 2026-07-16

Cargo.toml

@@ -10,7 +10,10 @@ edition = "2024"
 repository = "https://github.com/stackabletech/commons-operator"
 
 [workspace.dependencies]
-stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", tag = "stackable-operator-0.113.3", features = ["crds", "webhook"] }
+# TODO: Temporary branch reference to pull in the OpenLineageConnection CRD from the
+# unmerged draft PR https://github.com/stackabletech/operator-rs/pull/1250. Revert to a
+# version tag once the PR is merged and a new stackable-operator release is tagged.
+stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", branch = "feat/openlineage-crd", features = ["crds", "webhook"] }
 
 anyhow = "1.0"
 built = { version = "0.8", features = ["chrono", "git2"] }

extra/crds.yaml

@@ -709,3 +709,102 @@ spec:
     served: true
     storage: true
     subresources: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: openlineageconnections.openlineage.stackable.tech
+spec:
+  group: openlineage.stackable.tech
+  names:
+    categories: []
+    kind: OpenLineageConnection
+    plural: openlineageconnections
+    shortNames: []
+    singular: openlineageconnection
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns: []
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: A reusable definition of a connection to an OpenLineage backend.
+        properties:
+          spec:
+            description: |-
+              OpenLineage connection definition as a resource.
+              Learn more about [OpenLineage](https://openlineage.io/).
+            properties:
+              credentialsSecretName:
+                description: |-
+                  Name of a Secret containing the API key used to authenticate against the OpenLineage
+                  backend. The API key must be stored under the key `apiKey`. The Secret must be located in
+                  the same namespace as the workload using this connection. If not specified, no
+                  authentication is used.
+                nullable: true
+                type: string
+              host:
+                description: 'Host of the OpenLineage backend without any protocol or port. For example: `marquez`.'
+                type: string
+              port:
+                description: 'Port the OpenLineage backend listens on. For example: `5000`.'
+                format: uint16
+                maximum: 65535.0
+                minimum: 0.0
+                type: integer
+              tls:
+                description: Use a TLS connection. If not specified no TLS will be used.
+                nullable: true
+                properties:
+                  verification:
+                    description: The verification method used to verify the certificates of the server and/or the client.
+                    oneOf:
+                    - required:
+                      - none
+                    - required:
+                      - server
+                    properties:
+                      none:
+                        description: Use TLS but don't verify certificates.
+                        type: object
+                      server:
+                        description: Use TLS and a CA certificate to verify the server.
+                        properties:
+                          caCert:
+                            description: CA cert to verify the server.
+                            oneOf:
+                            - required:
+                              - webPki
+                            - required:
+                              - secretClass
+                            properties:
+                              secretClass:
+                                description: |-
+                                  Name of the [SecretClass](https://docs.stackable.tech/home/nightly/secret-operator/secretclass) which will provide the CA certificate.
+                                  Note that a SecretClass does not need to have a key but can also work with just a CA certificate,
+                                  so if you got provided with a CA cert but don't have access to the key you can still use this method.
+                                type: string
+                              webPki:
+                                description: |-
+                                  Use TLS and the CA certificates trusted by the common web browsers to verify the server.
+                                  This can be useful when you e.g. use public AWS S3 or other public available services.
+                                type: object
+                            type: object
+                        required:
+                        - caCert
+                        type: object
+                    type: object
+                required:
+                - verification
+                type: object
+            required:
+            - host
+            - port
+            type: object
+        required:
+        - spec
+        title: OpenLineageConnection
+        type: object
+    served: true
+    storage: true
+    subresources: {}

rust/operator-binary/src/main.rs

@@ -11,6 +11,7 @@ use stackable_operator::{
     cli::{Command, RunArguments},
     crd::{
         authentication::core::{AuthenticationClass, AuthenticationClassVersion},
+        openlineage::{OpenLineageConnection, OpenLineageConnectionVersion},
         s3::{S3Bucket, S3BucketVersion, S3Connection, S3ConnectionVersion},
     },
     eos::EndOfSupportChecker,
@@ -62,6 +63,8 @@ async fn main() -> anyhow::Result<()> {
                 .print_yaml_schema(built_info::PKG_VERSION, &SerializeOptions::default())?;
             S3Bucket::merged_crd(S3BucketVersion::V1Alpha1)?
                 .print_yaml_schema(built_info::PKG_VERSION, &SerializeOptions::default())?;
+            OpenLineageConnection::merged_crd(OpenLineageConnectionVersion::V1Alpha1)?
+                .print_yaml_schema(built_info::PKG_VERSION, &SerializeOptions::default())?;
         }
         Command::Run(CommonsOperatorRunArguments {
             common:

rust/operator-binary/src/webhooks/conversion.rs

@@ -1,6 +1,7 @@
 use stackable_operator::{
     crd::{
         authentication::core::{AuthenticationClass, AuthenticationClassVersion},
+        openlineage::{OpenLineageConnection, OpenLineageConnectionVersion},
         s3::{S3Bucket, S3BucketVersion, S3Connection, S3ConnectionVersion},
     },
     kube::Client,
@@ -23,6 +24,10 @@ pub fn create_webhook(disable_crd_maintenance: bool, client: Client) -> Box<impl
             S3Bucket::merged_crd(S3BucketVersion::V1Alpha1).unwrap(),
             S3Bucket::try_convert as fn(_) -> _,
         ),
+        (
+            OpenLineageConnection::merged_crd(OpenLineageConnectionVersion::V1Alpha1).unwrap(),
+            OpenLineageConnection::try_convert as fn(_) -> _,
+        ),
     ];
 
     let conversion_webhook_options = ConversionWebhookOptions {