fix: Add missing owns/watches and test early-exit reconcile

CHANGELOG.md

@@ -18,12 +18,17 @@
 - Fix a longstanding problem of including empty `categories`, `shortNames` and `additionalPrinterColumns` in the CRDs,
   which could cause problems with GitOps tools (e.g. ArgoCD) reporting a diff in the custom resources.
   See [our internal issue](https://github.com/stackabletech/hdfs-operator/issues/626) and [the fix](https://github.com/kube-rs/kube/pull/2042) for details ([#792]).
+- BREAKING: The app.kubernetes.io/managed-by label value changed from hbase.stackable.com_hbasecluster to
+  hbase.stackable.tech_hbasecluster, aligning with all other operators ([#795]).
+- BREAKING: The rest-server listener PVC template now carries only the unversioned selector labels.
+  Existing rest-server StatefulSets must be deleted once before the new operator can reconcile them ([#795]).
 
 [#776]: https://github.com/stackabletech/hbase-operator/pull/776
 [#782]: https://github.com/stackabletech/hbase-operator/pull/782
 [#786]: https://github.com/stackabletech/hbase-operator/pull/786
 [#787]: https://github.com/stackabletech/hbase-operator/pull/787
 [#792]: https://github.com/stackabletech/hbase-operator/pull/792
+[#795]: https://github.com/stackabletech/hbase-operator/pull/795
 
 ## [26.7.0] - 2026-07-21
 

Cargo.toml

@@ -18,6 +18,7 @@ clap = "4.6"
 const_format = "0.2"
 fnv = "1.0"
 futures = { version = "0.3", features = ["compat"] }
+http = "1.3"
 indoc = "2.0"
 rstest = "0.26"
 serde = { version = "1.0", features = ["derive"] }

deploy/helm/hbase-operator/templates/clusterrole-operator.yaml

@@ -31,7 +31,7 @@ rules:
       - patch
       - watch
   # ServiceAccount created per HbaseCluster for workload pod identity.
-  # Applied via SSA and tracked for orphan cleanup.
+  # Applied via SSA, tracked for orphan cleanup and watched by the controller.
   - apiGroups:
       - ""
     resources:
@@ -42,8 +42,9 @@ rules:
       - get
       - list
       - patch
+      - watch
   # RoleBinding created per HbaseCluster to bind the product ClusterRole to the workload
-  # ServiceAccount. Applied via SSA and tracked for orphan cleanup.
+  # ServiceAccount. Applied via SSA, tracked for orphan cleanup and watched by the controller.
   - apiGroups:
       - rbac.authorization.k8s.io
     resources:
@@ -54,6 +55,7 @@ rules:
       - get
       - list
       - patch
+      - watch
   # Required to bind the product ClusterRole to the per-cluster ServiceAccount.
   - apiGroups:
       - rbac.authorization.k8s.io
@@ -75,7 +77,8 @@ rules:
       - list
       - patch
       - watch
-  # PodDisruptionBudget created per role. Applied via SSA and tracked for orphan cleanup.
+  # PodDisruptionBudget created per role. Applied via SSA, tracked for orphan cleanup and
+  # watched by the controller.
   - apiGroups:
       - policy
     resources:
@@ -86,6 +89,7 @@ rules:
       - get
       - list
       - patch
+      - watch
   # Required for maintaining the CRDs within the operator (including the conversion webhook info).
   # Also for the startup condition check before the controller can run.
   - apiGroups:

rust/operator-binary/Cargo.toml

@@ -29,5 +29,6 @@ tracing.workspace = true
 built.workspace = true
 
 [dev-dependencies]
+http.workspace = true
 rstest.workspace = true
 serde_yaml.workspace = true

rust/operator-binary/src/controller/build/mod.rs

@@ -245,7 +245,7 @@ mod tests {
                 ("app.kubernetes.io/instance", "my-hbase".to_string()),
                 (
                     "app.kubernetes.io/managed-by",
-                    "hbase.stackable.com_hbasecluster".to_string(),
+                    "hbase.stackable.tech_hbasecluster".to_string(),
                 ),
                 ("app.kubernetes.io/name", "hbase".to_string()),
                 ("app.kubernetes.io/role-group", "none".to_string()),

rust/operator-binary/src/controller/build/resource/statefulset.rs

@@ -19,6 +19,7 @@ use stackable_operator::{
         },
         apimachinery::pkg::{apis::meta::v1::LabelSelector, util::intstr::IntOrString},
     },
+    kvp::Label,
     product_logging,
     v2::{
         builder::pod::container::{EnvVarName, EnvVarSet, new_container_builder},
@@ -299,8 +300,15 @@ pub fn build_rolegroup_statefulset(
         ));
     }
 
+    // Listener PVC labels should stay stable across upgrades and so should not
+    // include the version field (see HDFS for a similar pattern).
+    let mut unversioned_labels = cluster.role_group_selector(hbase_role, role_group_name);
+    // Neither vendor nor managed-by are included in role_group_selector
+    // labels: vendor is a required and so add it back.
+    unversioned_labels.insert(Label::stackable_vendor());
+
     let listener_pvc =
-        super::listener::build_listener_pvc(hbase_role, merged_config, &recommended_labels);
+        super::listener::build_listener_pvc(hbase_role, merged_config, &unversioned_labels);
 
     if let Some(listener_volume) =
         super::listener::build_listener_volume(hbase_role, merged_config, &recommended_labels)

rust/operator-binary/src/crd/mod.rs

@@ -44,7 +44,7 @@ pub mod security;
 
 pub const APP_NAME: &str = "hbase";
 pub const FIELD_MANAGER: &str = "hbase-operator";
-pub const OPERATOR_NAME: &str = "hbase.stackable.com";
+pub const OPERATOR_NAME: &str = "hbase.stackable.tech";
 
 // This constant is hard coded in hbase-entrypoint.sh
 // You need to change it there too.

rust/operator-binary/src/hbase_controller.rs

@@ -12,6 +12,7 @@ use stackable_operator::{
     cli::OperatorEnvironmentOptions,
     cluster_resources::ClusterResourceApplyStrategy,
     kube::{
+        Resource,
         core::{DeserializeGuard, error_boundary},
         runtime::controller::Action,
     },
@@ -76,6 +77,10 @@ pub async fn reconcile_hbase(
 ) -> Result<Action> {
     tracing::info!("Starting reconcile");
 
+    if hbase.meta().deletion_timestamp.is_some() {
+        return Ok(Action::await_change());
+    }
+
     let hbase = hbase
         .0
         .as_ref()
@@ -126,3 +131,130 @@ pub fn error_policy(
         _ => Action::requeue(*Duration::from_secs(5)),
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use stackable_operator::{
+        client::Client,
+        kube::{Client as KubeClient, Config},
+    };
+
+    use super::*;
+    use crate::test_utils;
+
+    /// A [`Ctx`] whose client points at a closed port. Any API call made through it fails the
+    /// reconciliation, so an `Ok` result proves the reconciler returned before touching the
+    /// Kubernetes API.
+    fn unreachable_ctx() -> Arc<Ctx> {
+        let config = Config::new(
+            "http://127.0.0.1:1"
+                .parse::<http::Uri>()
+                .expect("valid static URI"),
+        );
+        let kube_client = KubeClient::try_from(config).expect("client from static config");
+
+        Arc::new(Ctx {
+            client: Client::new(
+                kube_client,
+                None,
+                "default".to_owned(),
+                test_utils::cluster_info(),
+            ),
+            operator_environment: OperatorEnvironmentOptions {
+                operator_namespace: "stackable-operators".to_owned(),
+                operator_service_name: "hbase-operator".to_owned(),
+                image_repository: "oci.stackable.tech/sdp".to_owned(),
+            },
+        })
+    }
+
+    /// Drives the async reconciler from the synchronous tests used in this repo.
+    /// The [`Ctx`] is built inside `block_on` because the kube client needs a running reactor
+    /// already at construction time.
+    fn reconcile(hbase: DeserializeGuard<v1alpha1::HbaseCluster>) -> Result<Action> {
+        tokio::runtime::Builder::new_current_thread()
+            .enable_all()
+            .build()
+            .expect("current-thread tokio runtime")
+            .block_on(async { reconcile_hbase(Arc::new(hbase), unreachable_ctx()).await })
+    }
+
+    #[test]
+    fn reconcile_exits_early_for_deleted_cluster() {
+        let hbase = serde_yaml::from_str(
+            r#"
+apiVersion: hbase.stackable.tech/v1alpha1
+kind: HbaseCluster
+metadata:
+  name: hbase
+  namespace: default
+  deletionTimestamp: "2026-08-14T12:00:00Z"
+spec:
+  image:
+    productVersion: 2.6.3
+  clusterConfig:
+    hdfsConfigMapName: simple-hdfs
+    zookeeperConfigMapName: simple-znode
+"#,
+        )
+        .expect("valid HbaseCluster YAML");
+
+        let action = reconcile(hbase).expect("a deleted cluster reconciles without any API call");
+
+        assert_eq!(action, Action::await_change());
+    }
+
+    #[test]
+    fn reconcile_exits_early_for_deleted_cluster_with_invalid_spec() {
+        // The spec is missing all required fields, so the DeserializeGuard captures a
+        // deserialization error. During deletion the spec is irrelevant and the reconciler must
+        // still exit quietly instead of erroring through the whole teardown.
+        let hbase = serde_yaml::from_str(
+            r#"
+apiVersion: hbase.stackable.tech/v1alpha1
+kind: HbaseCluster
+metadata:
+  name: hbase
+  namespace: default
+  deletionTimestamp: "2026-08-14T12:00:00Z"
+spec: {}
+"#,
+        )
+        .expect("YAML parses; the invalid spec is captured inside the DeserializeGuard");
+
+        let action =
+            reconcile(hbase).expect("a deleted cluster reconciles even when its spec is invalid");
+
+        assert_eq!(action, Action::await_change());
+    }
+
+    #[test]
+    fn reconcile_proceeds_for_live_cluster() {
+        // Without a deletion timestamp the reconciler must not exit early: it proceeds to
+        // dereference, which fails against the unreachable test API server.
+        let hbase = serde_yaml::from_str(
+            r#"
+apiVersion: hbase.stackable.tech/v1alpha1
+kind: HbaseCluster
+metadata:
+  name: hbase
+  namespace: default
+spec:
+  image:
+    productVersion: 2.6.3
+  clusterConfig:
+    hdfsConfigMapName: simple-hdfs
+    zookeeperConfigMapName: simple-znode
+"#,
+        )
+        .expect("valid HbaseCluster YAML");
+
+        let result = reconcile(hbase);
+
+        assert!(
+            matches!(result, Err(Error::Dereference { .. })),
+            "a live cluster must reach the API (and fail dereferencing against the unreachable \
+             test server), not exit early: {result:?}"
+        );
+    }
+}

rust/operator-binary/src/main.rs

@@ -14,7 +14,9 @@ use stackable_operator::{
     eos::EndOfSupportChecker,
     k8s_openapi::api::{
         apps::v1::StatefulSet,
-        core::v1::{ConfigMap, Service},
+        core::v1::{ConfigMap, Service, ServiceAccount},
+        policy::v1::PodDisruptionBudget,
+        rbac::v1::RoleBinding,
     },
     kube::{
         CustomResourceExt, ResourceExt,
@@ -134,6 +136,22 @@ async fn main() -> anyhow::Result<()> {
                     watch_namespace.get_api::<StatefulSet>(&client),
                     watcher::Config::default(),
                 )
+                .owns(
+                    watch_namespace.get_api::<ServiceAccount>(&client),
+                    watcher::Config::default(),
+                )
+                .owns(
+                    watch_namespace.get_api::<RoleBinding>(&client),
+                    watcher::Config::default(),
+                )
+                .owns(
+                    watch_namespace.get_api::<PodDisruptionBudget>(&client),
+                    watcher::Config::default(),
+                )
+                .owns(
+                    watch_namespace.get_api::<ConfigMap>(&client),
+                    watcher::Config::default(),
+                )
                 .watches(
                     watch_namespace.get_api::<DeserializeGuard<ConfigMap>>(&client),
                     watcher::Config::default(),