feat(operator): add support for new secrets watcher support

charts/controlplane/templates/authz/deployment.yaml

@@ -27,6 +27,7 @@ spec:
         {{- toYaml . | nindent 8 }}
         {{- end }}
       labels:
+        platform.union.ai/zone: "controlplane"
         {{- include "union.authz.selectorLabels" . | nindent 8 }}
     spec:
       {{- with .Values.imagePullSecrets }}

charts/controlplane/templates/cacheservice/deployment.yaml

@@ -19,7 +19,9 @@ spec:
         {{- with .Values.podAnnotations }}
         {{- toYaml . | nindent 8 }}
         {{- end }}
-      labels: {{ include "cacheservice.podLabels" . | nindent 8 }}
+      labels:
+        platform.union.ai/zone: "controlplane"
+        {{ include "cacheservice.podLabels" . | nindent 8 }}
     spec:
       {{- with .Values.flyte.cacheservice.securityContext }}
       securityContext: {{ tpl (toYaml .) $ | nindent 8 }}

charts/controlplane/templates/console/deployment.yaml

@@ -27,6 +27,7 @@ spec:
         {{- toYaml . | nindent 8 }}
         {{- end }}
       labels:
+        platform.union.ai/zone: "controlplane"
         {{- include "console.selectorLabels" . | nindent 8 }}
         {{- with .Values.console.podLabels }}
         {{- tpl (toYaml .) $ | nindent 8 }}

charts/dataplane/templates/clusterresourcesync/deployment.yaml

@@ -20,6 +20,7 @@ spec:
         {{- end }}
         {{- include "global.podAnnotations" . | nindent 8 }}
       labels:
+        platform.union.ai/zone: "dataplane"
         {{- include "clusterresourcesync.podLabels" . | nindent 8 }}
     spec:
       containers:

charts/dataplane/templates/flyteconnector/deployment.yaml

@@ -15,7 +15,9 @@ spec:
         {{- with .Values.flyteconnector.podAnnotations }}
           {{- toYaml . | nindent 8 }}
           {{- end }}
-      labels: {{ include "flyteconnector.labels" . | nindent 8 }}
+      labels:
+        platform.union.ai/zone: "dataplane"
+        {{ include "flyteconnector.labels" . | nindent 8 }}
     spec:
       {{- if .Values.flyteconnector.priorityClassName }}
       priorityClassName: {{ .Values.flyteconnector.priorityClassName }}

charts/dataplane/templates/imagebuilder/deployment.yaml

@@ -26,6 +26,7 @@ spec:
         {{- end }}
       {{- end }}
       labels:
+        platform.union.ai/zone: "dataplane"
         {{- include "imagebuilder.buildkit.selectorLabels" . | nindent 8 }}
     spec:
       serviceAccountName: {{ .Values.imageBuilder.buildkit.serviceAccount.name | default "union-imagebuilder" | quote }}

charts/dataplane/templates/nodeexecutor/deployment.yaml

@@ -20,6 +20,7 @@ spec:
         {{- end }}
         {{- include "global.podAnnotations" . | nindent 8 }}
       labels:
+        platform.union.ai/zone: "dataplane"
         {{- include "executor.podLabels" . | nindent 8 }}
     spec:
       securityContext:

charts/dataplane/templates/nodeobserver/daemonset.yaml

@@ -19,6 +19,7 @@ spec:
         {{- end }}
         {{- include "global.podAnnotations" . | nindent 8 }}
       labels:
+        platform.union.ai/zone: "dataplane"
         {{ include "nodeobserver.podLabels" . | nindent 8 }}
     spec:
       priorityClassName: {{ .Values.operator.priorityClassName }}

charts/dataplane/templates/operator/configmap.yaml

@@ -69,6 +69,10 @@ data:
       org:
         {{- tpl (toYaml .) $ | nindent 8 }}
     {{- end }}
+    {{- with .Values.config.operator.secretsWatcher }}
+      secretsWatcher:
+        {{- tpl (toYaml .) $ | nindent 8 }}
+    {{- end }}
     {{- if and (not .Values.config.operator.org) .Values.namespace_mapping }}
       org:
         namespaceTemplate: {{ tpl (.Values.namespace_mapping.template | quote) $ }}

charts/dataplane/templates/operator/serviceaccount.yaml

@@ -154,6 +154,19 @@ rules:
       - update
       - delete
   {{- end }}
+  {{- if .Values.config.operator.secretsWatcher.enabled }}
+  - apiGroups:
+      - apps
+    resources:
+      - replicasets
+      - deployments
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+      - patch
+  {{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding

charts/dataplane/templates/propeller/deployment-webhook.yaml

@@ -23,6 +23,7 @@ spec:
   template:
     metadata:
       labels:
+        platform.union.ai/zone: "dataplane"
         {{- include "flytepropellerwebhook.podLabels" . | nindent 8 }}
       annotations:
         configChecksum: {{ include (print .Template.BasePath "/propeller/configmap.yaml") . | sha256sum | trunc 63 | quote }}

charts/dataplane/templates/propeller/deployment.yaml

@@ -20,6 +20,7 @@ spec:
         {{- end }}
         {{- include "global.podAnnotations" . | nindent 8 }}
       labels:
+        platform.union.ai/zone: "dataplane"
         {{ include "flytepropeller.podLabels" . | nindent 8 }}
     spec:
       {{- with .Values.flytepropeller.securityContext }}

charts/dataplane/values.yaml

@@ -497,6 +497,12 @@ config:
       # -- Define the prometheus health check endpoint.
       prometheus:
         endpoint: '{{ include "prometheus.health.url" . }}'
+    # -- Configuration for the secrets watcher, which triggers rolling restarts when secrets change.
+    secretsWatcher:
+      # -- Enable the secrets watcher.
+      enabled: false
+      # -- Log changes but do not update deployments.
+      dryRun: true
   # -- Configuration for the operator proxy service.
   proxy:
     # -- Secret manager configuration

tests/generated/controlplane.aws.billing-enable.yaml

@@ -6338,7 +6338,9 @@ spec:
         linkerd.io/inject: disabled
         prometheus.io/path: /metrics
         prometheus.io/port: "10254"
-      labels: 
+      labels:
+        platform.union.ai/zone: "controlplane"
+
         app.kubernetes.io/name: cacheservice
         app.kubernetes.io/instance: release-name
         helm.sh/chart: controlplane-2026.4.1
@@ -6456,6 +6458,7 @@ spec:
         prometheus.io/path: /metrics
         prometheus.io/port: "10254"
       labels:
+        platform.union.ai/zone: "controlplane"
         app.kubernetes.io/name: unionconsole
         app.kubernetes.io/instance: release-name
     spec:

tests/generated/controlplane.aws.yaml

@@ -6339,7 +6339,9 @@ spec:
         prometheus.io/path: /metrics
         prometheus.io/port: "10254"
         prometheus.io/scrape: "true"
-      labels: 
+      labels:
+        platform.union.ai/zone: "controlplane"
+
         app.kubernetes.io/name: cacheservice
         app.kubernetes.io/instance: release-name
         helm.sh/chart: controlplane-2026.4.1
@@ -6458,6 +6460,7 @@ spec:
         prometheus.io/port: "10254"
         prometheus.io/scrape: "true"
       labels:
+        platform.union.ai/zone: "controlplane"
         app.kubernetes.io/name: unionconsole
         app.kubernetes.io/instance: release-name
     spec:

tests/generated/controlplane.external-authz.yaml

@@ -6343,7 +6343,9 @@ spec:
         linkerd.io/inject: disabled
         prometheus.io/path: /metrics
         prometheus.io/port: "10254"
-      labels: 
+      labels:
+        platform.union.ai/zone: "controlplane"
+
         app.kubernetes.io/name: cacheservice
         app.kubernetes.io/instance: release-name
         helm.sh/chart: controlplane-2026.4.1
@@ -6461,6 +6463,7 @@ spec:
         prometheus.io/path: /metrics
         prometheus.io/port: "10254"
       labels:
+        platform.union.ai/zone: "controlplane"
         app.kubernetes.io/name: unionconsole
         app.kubernetes.io/instance: release-name
     spec:

tests/generated/controlplane.userclouds.yaml

@@ -6338,7 +6338,9 @@ spec:
         linkerd.io/inject: disabled
         prometheus.io/path: /metrics
         prometheus.io/port: "10254"
-      labels: 
+      labels:
+        platform.union.ai/zone: "controlplane"
+
         app.kubernetes.io/name: cacheservice
         app.kubernetes.io/instance: release-name
         helm.sh/chart: controlplane-2026.4.1
@@ -6456,6 +6458,7 @@ spec:
         prometheus.io/path: /metrics
         prometheus.io/port: "10254"
       labels:
+        platform.union.ai/zone: "controlplane"
         app.kubernetes.io/name: unionconsole
         app.kubernetes.io/instance: release-name
     spec:

tests/generated/dataplane.additional-podlabels.yaml

@@ -2747,6 +2747,9 @@ data:
           endpoint: 'http://flytepropeller:10254'
         proxy:
           endpoint: 'http://union-operator-proxy:10254'
+      secretsWatcher:
+        dryRun: true
+        enabled: false
       imageBuilder:
         enabled: true
         executionNamespaceLabels:
@@ -5239,6 +5242,7 @@ spec:
         configChecksum: "bef188a6ef20bf390a95e33b16ee869128e28243ae661609aab81d95191b1d3"
         prometheus.io/scrape: "true"
       labels:
+        platform.union.ai/zone: "dataplane"
 
         azure.workload.identity/use: "true"
         custom-label: custom-value
@@ -5342,6 +5346,7 @@ spec:
       annotations:
         container.apparmor.security.beta.kubernetes.io/buildkit: unconfined
       labels:
+        platform.union.ai/zone: "dataplane"
         app.kubernetes.io/name: imagebuilder-buildkit
         app.kubernetes.io/instance: release-name
     spec:
@@ -5459,6 +5464,7 @@ spec:
         configChecksum: "a1e4a396e83da22e5ffee35c34f73c3b54be6c6ba8bf8d81004e789023847e1"
         prometheus.io/scrape: "true"
       labels:
+        platform.union.ai/zone: "dataplane"
 
         azure.workload.identity/use: "true"
         custom-label: custom-value
@@ -5560,7 +5566,7 @@ spec:
   template:
     metadata:
       annotations:
-        configChecksum: "7be121e6bb634d408f8c583aea06ba12169fd6048e02dbda821b587e928f981"
+        configChecksum: "4076d001f4e350fc48c9eb224e0f71482e5fb912fa4fcbe49f7eb2ee4ac44c3"
         prometheus.io/scrape: "true"
       labels:
 
@@ -5699,7 +5705,7 @@ spec:
   template:
     metadata:
       annotations:
-        configChecksum: "7be121e6bb634d408f8c583aea06ba12169fd6048e02dbda821b587e928f981"
+        configChecksum: "4076d001f4e350fc48c9eb224e0f71482e5fb912fa4fcbe49f7eb2ee4ac44c3"
         prometheus.io/scrape: "true"
       labels:
 
@@ -5878,6 +5884,7 @@ spec:
   template:
     metadata:
       labels:
+        platform.union.ai/zone: "dataplane"
 
         azure.workload.identity/use: "true"
         custom-label: custom-value
@@ -6044,6 +6051,7 @@ spec:
         configChecksum: "24e0f0c6dd0bf39ba1103d08dedaa1047108f9263429148d8f22e6025237ac3"
         prometheus.io/scrape: "true"
       labels:
+        platform.union.ai/zone: "dataplane"
 
 
         azure.workload.identity/use: "true"

tests/generated/dataplane.additional-templates.yaml

@@ -2782,6 +2782,9 @@ data:
           endpoint: 'http://flytepropeller:10254'
         proxy:
           endpoint: 'http://union-operator-proxy:10254'
+      secretsWatcher:
+        dryRun: true
+        enabled: false
       org:
         namespaceTemplate: "{{ project }}-{{ domain }}"
       imageBuilder:
@@ -5298,6 +5301,7 @@ spec:
         configChecksum: "e8f0345934a4cc3c298aa5eef3ed39a162d412505166678ff0faf09c9d0afee"
 
       labels:
+        platform.union.ai/zone: "dataplane"
 
         app.kubernetes.io/name: clusterresourcesync
         app.kubernetes.io/instance: release-name
@@ -5399,6 +5403,7 @@ spec:
       annotations:
         container.apparmor.security.beta.kubernetes.io/buildkit: unconfined
       labels:
+        platform.union.ai/zone: "dataplane"
         app.kubernetes.io/name: imagebuilder-buildkit
         app.kubernetes.io/instance: release-name
     spec:
@@ -5516,6 +5521,7 @@ spec:
         configChecksum: "8fb93781ca61cf36fec4151f853da41981c87a2295bc90caf045122030265e9"
 
       labels:
+        platform.union.ai/zone: "dataplane"
 
         app: executor
     spec:
@@ -5615,7 +5621,7 @@ spec:
   template:
     metadata:
       annotations:
-        configChecksum: "e79830c7e404c8378f84f6a9f8d8660aaa1b896b1c03001db047f655a9d9e59"
+        configChecksum: "5ee14e6faf5726ce2b854531f04ce7cec5e963a2bbda2b5271a0a8b7f2a5219"
 
       labels:
 
@@ -5752,7 +5758,7 @@ spec:
   template:
     metadata:
       annotations:
-        configChecksum: "e79830c7e404c8378f84f6a9f8d8660aaa1b896b1c03001db047f655a9d9e59"
+        configChecksum: "5ee14e6faf5726ce2b854531f04ce7cec5e963a2bbda2b5271a0a8b7f2a5219"
 
       labels:
 
@@ -5929,6 +5935,7 @@ spec:
   template:
     metadata:
       labels:
+        platform.union.ai/zone: "dataplane"
 
         app.kubernetes.io/name: flyte-pod-webhook
         app.kubernetes.io/instance: release-name
@@ -6093,6 +6100,7 @@ spec:
         configChecksum: "54a4cba2f0b2935bab3d47d13782d2d7ea6d5fe154f434cf177d1a19dbf3dad"
 
       labels:
+        platform.union.ai/zone: "dataplane"
 
 
         app.kubernetes.io/name: flytepropeller