Skip to content

feat(core): support resource dependency ordering during reconciliation#752

Merged
fhussonnois merged 1 commit intomainfrom
feat/resource-reconciliation-ordering
Apr 8, 2026
Merged

feat(core): support resource dependency ordering during reconciliation#752
fhussonnois merged 1 commit intomainfrom
feat/resource-reconciliation-ordering

Conversation

@fhussonnois
Copy link
Copy Markdown
Member

Summary

  • Add @ReconciliationOrder annotation for declaring within-provider resource type ordering (lower values = reconciled first)
  • Sort resource types by order in DefaultApi.applyPatchesAndGetResults() before processing, with alphabetical tiebreaker for determinism
  • Reverse ordering for delete-only operations (delete dependents first)
  • Cross-provider ordering is handled by the existing Provider Groups feature — list order in config = execution order

Within-provider ordering applied to:

Provider Resource Order
Kafka KafkaUser 50
Kafka KafkaTopic 100
Kafka KafkaClientQuota 150
Kafka KafkaPrincipalAuthorization 200
Kafka KafkaConsumerGroup 250
Kafka KafkaTableRecord 300
Schema Registry SchemaRegistrySubject 100
Kafka Connect KafkaConnector 100
Iceberg IcebergNamespace 100
Iceberg IcebergTable 200
Iceberg IcebergView 300

Design decisions

  • No @DependsOn / DAG — avoids Terraform-style complexity (cycles, state, implicit references)
  • No cross-provider coupling — providers never reference each other's types
  • Two-layer ordering: users control cross-provider via Provider Groups config, provider authors control within-provider via annotations/registration
  • Generated models use programmatic setReconciliationOrder() during registration (annotations get wiped by jsonschema2pojo); hand-written models use @ReconciliationOrder annotation

Closes #744

Test plan

  • ReconciliationOrderTest — annotation extraction, defaults, setter
  • ReconciliationOrderingTest — ascending sort for create, descending for delete, alphabetical tiebreaker
  • Core module: 377 tests pass
  • Kafka provider tests pass
  • Iceberg provider tests pass
  • Manual: jikkou apply with mixed Iceberg resources, verify Namespace created before Table before View in logs

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 8, 2026

Security Scan Results

Vulnerabilities detected:


Report Summary

┌───────────────────────────────────────────────────┬───────┬─────────────────┬─────────┐
│                      Target                       │ Type  │ Vulnerabilities │ Secrets │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ cli/pom.xml                                       │  pom  │        2        │    -    │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ core/pom.xml                                      │  pom  │        0        │    -    │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ docs/go.mod                                       │ gomod │        0        │    -    │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ extension-rest-client/pom.xml                     │  pom  │        0        │    -    │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ pom.xml                                           │  pom  │        4        │    -    │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ processor/pom.xml                                 │  pom  │        0        │    -    │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ providers/jikkou-provider-aiven/pom.xml           │  pom  │        0        │    -    │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ providers/jikkou-provider-aws/pom.xml             │  pom  │        0        │    -    │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ providers/jikkou-provider-confluent/pom.xml       │  pom  │        0        │    -    │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ providers/jikkou-provider-core/pom.xml            │  pom  │        0        │    -    │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ providers/jikkou-provider-iceberg/pom.xml         │  pom  │        0        │    -    │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ providers/jikkou-provider-kafka-connect/pom.xml   │  pom  │        0        │    -    │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ providers/jikkou-provider-kafka/pom.xml           │  pom  │        0        │    -    │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ providers/jikkou-provider-schema-registry/pom.xml │  pom  │        0        │    -    │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ resource-generator/pom.xml                        │  pom  │        0        │    -    │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ server/jikkou-api-client/pom.xml                  │  pom  │        0        │    -    │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ server/jikkou-api-data/pom.xml                    │  pom  │        0        │    -    │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ server/jikkou-api-server/pom.xml                  │  pom  │        2        │    -    │
├───────────────────────────────────────────────────┼───────┼─────────────────┼─────────┤
│ template-jinja/pom.xml                            │  pom  │        0        │    -    │
└───────────────────────────────────────────────────┴───────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.69/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


cli/pom.xml (pom)
=================
Total: 2 (HIGH: 2, CRITICAL: 0)

┌────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────────────┬────────────────────────────────────────────────────────────┐
│          Library           │ Vulnerability  │ Severity │ Status │ Installed Version │        Fixed Version        │                           Title                            │
├────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────────────┼────────────────────────────────────────────────────────────┤
│ io.netty:netty-codec-http  │ CVE-2026-33870 │ HIGH     │ fixed  │ 4.2.9.Final       │ 4.1.132.Final, 4.2.10.Final │ io.netty/netty-codec-http: Netty: Request smuggling via    │
│                            │                │          │        │                   │                             │ incorrect parsing of HTTP/1.1 chunked transfer encoding... │
│                            │                │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2026-33870                 │
├────────────────────────────┼────────────────┤          │        │                   ├─────────────────────────────┼────────────────────────────────────────────────────────────┤
│ io.netty:netty-codec-http2 │ CVE-2026-33871 │          │        │                   │ 4.1.132.Final, 4.2.11.Final │ netty: Netty: Denial of Service via HTTP/2 CONTINUATION    │
│                            │                │          │        │                   │                             │ frame flood                                                │
│                            │                │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2026-33871                 │
└────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────────────┴────────────────────────────────────────────────────────────┘

pom.xml (pom)
=============
Total: 4 (HIGH: 4, CRITICAL: 0)

┌────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────────────┬────────────────────────────────────────────────────────────┐
│          Library           │ Vulnerability  │ Severity │ Status │ Installed Version │        Fixed Version        │                           Title                            │
├────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────────────┼────────────────────────────────────────────────────────────┤
│ io.netty:netty-codec-http  │ CVE-2026-33870 │ HIGH     │ fixed  │ 4.2.9.Final       │ 4.1.132.Final, 4.2.10.Final │ io.netty/netty-codec-http: Netty: Request smuggling via    │
│                            │                │          │        │                   │                             │ incorrect parsing of HTTP/1.1 chunked transfer encoding... │
│                            │                │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2026-33870                 │
│                            │                │          │        │                   │                             │                                                            │
│                            │                │          │        │                   │                             │                                                            │
│                            │                │          │        │                   │                             │                                                            │
│                            │                │          │        │                   │                             │                                                            │
├────────────────────────────┼────────────────┤          │        │                   ├─────────────────────────────┼────────────────────────────────────────────────────────────┤
│ io.netty:netty-codec-http2 │ CVE-2026-33871 │          │        │                   │ 4.1.132.Final, 4.2.11.Final │ netty: Netty: Denial of Service via HTTP/2 CONTINUATION    │
│                            │                │          │        │                   │                             │ frame flood                                                │
│                            │                │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2026-33871                 │
│                            │                │          │        │                   │                             │                                                            │
│                            │                │          │        │                   │                             │                                                            │
│                            │                │          │        │                   │                             │                                                            │
│                            │                │          │        │                   │                             │                                                            │
└────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────────────┴────────────────────────────────────────────────────────────┘

server/jikkou-api-server/pom.xml (pom)
======================================
Total: 2 (HIGH: 2, CRITICAL: 0)

┌────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────────────┬────────────────────────────────────────────────────────────┐
│          Library           │ Vulnerability  │ Severity │ Status │ Installed Version │        Fixed Version        │                           Title                            │
├────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────────────┼────────────────────────────────────────────────────────────┤
│ io.netty:netty-codec-http  │ CVE-2026-33870 │ HIGH     │ fixed  │ 4.2.9.Final       │ 4.1.132.Final, 4.2.10.Final │ io.netty/netty-codec-http: Netty: Request smuggling via    │
│                            │                │          │        │                   │                             │ incorrect parsing of HTTP/1.1 chunked transfer encoding... │
│                            │                │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2026-33870                 │
├────────────────────────────┼────────────────┤          │        │                   ├─────────────────────────────┼────────────────────────────────────────────────────────────┤
│ io.netty:netty-codec-http2 │ CVE-2026-33871 │          │        │                   │ 4.1.132.Final, 4.2.11.Final │ netty: Netty: Denial of Service via HTTP/2 CONTINUATION    │
│                            │                │          │        │                   │                             │ frame flood                                                │
│                            │                │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2026-33871                 │
└────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────────────┴────────────────────────────────────────────────────────────┘

Scanned by Trivy

Resource types within a provider are now reconciled in a deterministic
order based on @ReconciliationOrder annotations or programmatic
registration. Lower values are processed first during creation and
last during deletion. Cross-provider ordering is handled by the
existing Provider Groups feature (list order = execution order).

Closes #744
@fhussonnois fhussonnois force-pushed the feat/resource-reconciliation-ordering branch from ed0e3bc to cd840b0 Compare April 8, 2026 20:10
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud bot commented Apr 8, 2026

Quality Gate Failed Quality Gate failed

Failed conditions
47.8% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube Cloud

@fhussonnois fhussonnois merged commit 6714496 into main Apr 8, 2026
3 of 4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

feat(core): Support resource dependency ordering during reconciliation

1 participant