feat: Add affinity to OPA Pods (#1002)

* feat: Add affinity to OPA Pods

* Updating Changelog

Author: Maleware

CHANGELOG.md

@@ -10,6 +10,7 @@ All notable changes to this project will be documented in this file.
   ([#994]).
 - Add support for 2.12.0 ([#997]).
 - Add `/ready` endpoint to the operator Deployment, which reports the CRD installation status ([#999]).
+- Nodes now have a default affinity to the OPA Pods when OPA authorization is configured ([#1002]).
 
 ### Changed
 
@@ -73,6 +74,7 @@ All notable changes to this project will be documented in this file.
 [#994]: https://github.com/stackabletech/nifi-operator/pull/994
 [#997]: https://github.com/stackabletech/nifi-operator/pull/997
 [#999]: https://github.com/stackabletech/nifi-operator/pull/999
+[#1002]: https://github.com/stackabletech/nifi-operator/pull/1002
 
 ## [26.7.0] - 2026-07-21
 

docs/modules/nifi/pages/usage_guide/operations/pod-placement.adoc

@@ -5,3 +5,4 @@ You can configure the Pod placement of the NiFi pods as described in xref:concep
 The default affinities created by the operator are:
 
 1. Distribute all the NiFi Pods (weight 70)
+2. If OPA authorization is configured: co-locate the NiFi Pods with the OPA Pods (weight 50)

rust/operator-binary/src/controller/validate.rs

@@ -298,7 +298,11 @@ pub(crate) fn build_role_group_configs(
     vector_aggregator_config_map_name: &Option<ConfigMapName>,
 ) -> Result<BTreeMap<NifiRole, BTreeMap<RoleGroupName, NifiRoleGroupConfig>>> {
     let role = &nifi.spec.nodes;
-    let default_config = NifiConfig::default_config(&nifi.name_any(), &NifiRole::Node);
+    let default_config = NifiConfig::default_config(
+        &nifi.name_any(),
+        &NifiRole::Node,
+        nifi.spec.cluster_config.authorization.opa_config(),
+    );
 
     let mut groups: BTreeMap<RoleGroupName, NifiRoleGroupConfig> = BTreeMap::new();
     for (rg_name, rg) in &role.role_groups {

rust/operator-binary/src/crd/affinity.rs

@@ -1,13 +1,34 @@
 use stackable_operator::{
-    commons::affinity::{StackableAffinityFragment, affinity_between_role_pods},
-    k8s_openapi::api::core::v1::PodAntiAffinity,
+    commons::{
+        affinity::{StackableAffinityFragment, affinity_between_role_pods},
+        opa::OpaConfig,
+    },
+    k8s_openapi::api::core::v1::{PodAffinity, PodAntiAffinity},
 };
 
 use crate::crd::{APP_NAME, NifiRole};
 
-pub fn get_affinity(cluster_name: &str, role: &NifiRole) -> StackableAffinityFragment {
+pub fn get_affinity(
+    cluster_name: &str,
+    role: &NifiRole,
+    opa_config: Option<&OpaConfig>,
+) -> StackableAffinityFragment {
+    // With OPA authorization configured, NiFi sends its authorization requests to OPA, so prefer
+    // to place it next to the OPA Pods.
+    let pod_affinity = opa_config.map(|opa_config| PodAffinity {
+        preferred_during_scheduling_ignored_during_execution: Some(vec![
+            affinity_between_role_pods(
+                "opa",
+                &opa_config.config_map_name, // The discovery cm has the same name as the OpaCluster itself
+                "server",
+                50,
+            ),
+        ]),
+        required_during_scheduling_ignored_during_execution: None,
+    });
+
     StackableAffinityFragment {
-        pod_affinity: None,
+        pod_affinity,
         pod_anti_affinity: Some(PodAntiAffinity {
             preferred_during_scheduling_ignored_during_execution: Some(vec![
                 affinity_between_role_pods(APP_NAME, cluster_name, &role.to_string(), 70),
@@ -26,7 +47,9 @@ mod tests {
     use stackable_operator::{
         commons::affinity::StackableAffinity,
         k8s_openapi::{
-            api::core::v1::{PodAffinityTerm, PodAntiAffinity, WeightedPodAffinityTerm},
+            api::core::v1::{
+                PodAffinity, PodAffinityTerm, PodAntiAffinity, WeightedPodAffinityTerm,
+            },
             apimachinery::pkg::apis::meta::v1::LabelSelector,
         },
         v2::types::operator::RoleGroupName,
@@ -54,6 +77,10 @@ mod tests {
             sensitiveProperties:
               keySecret: simple-nifi-sensitive-property-key
               autoGenerate: true
+            authorization:
+              opa:
+                configMapName: simple-opa
+                package: nifi
           nodes:
             roleGroups:
               default:
@@ -80,7 +107,32 @@ mod tests {
         assert_eq!(
             merged_config.affinity,
             StackableAffinity {
-                pod_affinity: None,
+                pod_affinity: Some(PodAffinity {
+                    preferred_during_scheduling_ignored_during_execution: Some(vec![
+                        WeightedPodAffinityTerm {
+                            pod_affinity_term: PodAffinityTerm {
+                                label_selector: Some(LabelSelector {
+                                    match_expressions: None,
+                                    match_labels: Some(BTreeMap::from([
+                                        ("app.kubernetes.io/name".to_string(), "opa".to_string()),
+                                        (
+                                            "app.kubernetes.io/instance".to_string(),
+                                            "simple-opa".to_string(),
+                                        ),
+                                        (
+                                            "app.kubernetes.io/component".to_string(),
+                                            "server".to_string(),
+                                        ),
+                                    ])),
+                                }),
+                                topology_key: "kubernetes.io/hostname".to_string(),
+                                ..Default::default()
+                            },
+                            weight: 50,
+                        }
+                    ]),
+                    required_during_scheduling_ignored_during_execution: None,
+                }),
                 pod_anti_affinity: Some(PodAntiAffinity {
                     preferred_during_scheduling_ignored_during_execution: Some(vec![
                         WeightedPodAffinityTerm {

rust/operator-binary/src/crd/authorization.rs

@@ -24,6 +24,16 @@ impl Default for NifiAuthorization {
     }
 }
 
+impl NifiAuthorization {
+    /// The OPA config, if OPA is the configured authorizer.
+    pub fn opa_config(&self) -> Option<&OpaConfig> {
+        match self {
+            Self::Opa { opa } => Some(&opa.opa),
+            Self::SingleUser {} | Self::Standard { .. } => None,
+        }
+    }
+}
+
 #[derive(Clone, Debug, Deserialize, Eq, JsonSchema, PartialEq, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct NifiOpaConfig {

rust/operator-binary/src/crd/mod.rs

@@ -14,6 +14,7 @@ use stackable_operator::{
     commons::{
         affinity::StackableAffinity,
         cluster_operation::ClusterOperation,
+        opa::OpaConfig,
         product_image_selection::ProductImage,
         resources::{
             CpuLimitsFragment, MemoryLimitsFragment, NoRuntimeLimits, NoRuntimeLimitsFragment,
@@ -311,7 +312,11 @@ impl NifiConfig {
     // Auto TLS certificate lifetime
     const DEFAULT_NODE_SECRET_LIFETIME: Duration = Duration::from_days_unchecked(1);
 
-    pub fn default_config(cluster_name: &str, role: &NifiRole) -> NifiConfigFragment {
+    pub fn default_config(
+        cluster_name: &str,
+        role: &NifiRole,
+        opa_config: Option<&OpaConfig>,
+    ) -> NifiConfigFragment {
         NifiConfigFragment {
             logging: product_logging::spec::default_logging(),
             resources: ResourcesFragment {
@@ -356,7 +361,7 @@ impl NifiConfig {
                     },
                 },
             },
-            affinity: get_affinity(cluster_name, role),
+            affinity: get_affinity(cluster_name, role, opa_config),
             graceful_shutdown_timeout: Some(DEFAULT_NODE_GRACEFUL_SHUTDOWN_TIMEOUT),
             requested_secret_lifetime: Some(Self::DEFAULT_NODE_SECRET_LIFETIME),
         }