Add main pod overrides and improve cronjob naming

Modified the service code to include main pod overrides directly from the stack's spec. This new feature allows users to override extra annotations in the main pod.
Additionally, changed CronJob name formatting, now the CronJobs will be prefixed with 'pulumi-', improving clarity in the naming of these jobs.
Also expanded the list of allowed verbs in the rules, to allow the CronJob more freedom, matching the level of freedom given to the initial containers.

pulumi-operator-kubernetes/src/stack/crd.rs

@@ -2,6 +2,7 @@ use k8s_openapi::api::core::v1::{Container, EnvVar, Volume, VolumeMount};
 use k8s_openapi::schemars::JsonSchema;
 use kube::CustomResource;
 use serde::{Deserialize, Serialize};
+use std::collections::BTreeMap;
 
 use super::status::StackStatus;
 
@@ -23,6 +24,7 @@ pub struct StackSpec {
   pub init_containers: Option<Vec<Container>>,
   pub extra_volumes: Option<Vec<Volume>>,
   pub main_container: Option<MainContainerOverride>,
+  pub main_pod: Option<MainPodOverride>,
 }
 
 #[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
@@ -32,6 +34,12 @@ pub struct MainContainerOverride {
   pub extra_env: Option<Vec<EnvVar>>,
 }
 
+#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct MainPodOverride {
+  pub extra_annotations: Option<BTreeMap<String, String>>,
+}
+
 #[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
 #[serde(rename_all = "camelCase")]
 pub struct StackAuthRef {

pulumi-operator-kubernetes/src/stack/service.rs

@@ -50,6 +50,7 @@ impl KubernetesPulumiStackService {
     let init_containers = stack.spec.init_containers;
     let extra_volumes = stack.spec.extra_volumes;
     let container_override = stack.spec.main_container;
+    let pod_override = stack.spec.main_pod;
 
     let operator_namespace = self
       .config_provider
@@ -58,7 +59,7 @@ impl KubernetesPulumiStackService {
 
     let mut main_container: Container = serde_json::from_value(json!({
         "name": "pulumi",
-        "image": "ghcr.io/stromee/pulumi-operator/pulumi-operator-kubernetes-job:1.0.22",
+        "image": "ghcr.io/stromee/pulumi-operator/pulumi-operator-kubernetes-job:1.0.23",
         "env": [{
             "name": "PULUMI_STACK",
             "value": name
@@ -95,11 +96,15 @@ impl KubernetesPulumiStackService {
       }
     }
 
+    let pod_annotations = pod_override
+      .as_ref()
+      .and_then(|pod| pod.extra_annotations.clone());
+
     let job = serde_json::from_value(json!({
         "apiVersion": "batch/v1",
         "kind": "CronJob",
         "metadata": {
-            "name": name,
+            "name": format!("pulumi-{}", name),
             "namespace": namespace.clone()
         },
         "spec": {
@@ -109,7 +114,8 @@ impl KubernetesPulumiStackService {
                 "spec": {
                     "template": {
                         "metadata": {
-                            "name": "pulumi"
+                            "name": "pulumi",
+                            "annotations": pod_annotations
                         },
                         "spec": {
                             "initContainers": init_containers,
@@ -198,7 +204,7 @@ impl KubernetesPulumiStackService {
         "rules": [{
             "apiGroups": ["*"],
             "resources": ["*"],
-            "verbs": ["get", "list", "watch"]
+            "verbs": ["*"]
         }]
     }))
     .unwrap();
@@ -282,12 +288,15 @@ impl KubernetesPulumiStackService {
       .all_in_namespace_api::<CronJob>(namespace.clone())
       .await;
 
-    if api.get(&name).await.is_err() {
+    if api.get(&format!("pulumi-{}", &name)).await.is_err() {
       return Ok(());
     };
 
     api
-      .delete(&name, &DeleteParams::foreground().grace_period(15))
+      .delete(
+        &format!("pulumi-{}", &name),
+        &DeleteParams::foreground().grace_period(15),
+      )
       .await
       .expect("todo");
 
@@ -305,7 +314,8 @@ impl KubernetesPulumiStackService {
       {
         match status {
           WatchEvent::Deleted(job)
-            if job.metadata.name == Some(name.clone().to_string()) =>
+            if job.metadata.name
+              == Some(format!("pulumi-{}", &name).clone().to_string()) =>
           {
             break;
           }