[martin-briatka]

Summary

This PR adds two related but independent configuration options, both coming out of #65.

Workload annotations

Add a spec.annotations (map[string]string) field. The operator merges its entries onto the metadata of every generated StatefulSet (primary, replica and sentinel), so users can attach arbitrary annotations to the workload.

The merge is performed in the operator (a generator wrapper), not in the chart templates, so it is independent of the vendored chart, the same way TopologySpreadConstraints are already injected today. The field is empty by default, so existing deployments are unaffected.

spec:
  annotations:
    example.io/some-annotation: "value"

Certificate duration

Add a spec.tls.duration field that is passed through to the generated cert-manager Certificate. When unset, the previous default of 876000h (~100 years) is preserved, so existing resources are unaffected.

spec:
  tls:
    enabled: true
    duration: 8760h

Changes

• api/v1alpha1/types.go: Annotations map[string]string on ValkeySpec, and Duration *metav1.Duration on TLSProperties
• internal/transformer/annotation_generator.go: generator wrapper that reads spec.annotations and merges them onto every generated StatefulSet's metadata
• pkg/operator/operator.go: wrap the resource generator with the annotation generator
• pkg/operator/data/parameters.yaml: pass spec.tls.duration to the Certificate, defaulting to 876000h when unset
• api/v1alpha1/zz_generated.deepcopy.go + crds/cache.cs.sap.com_valkeys.yaml: regenerated via make generate manifests

Testing

• go build and go vet pass.
• Validated end-to-end on a live cluster: with spec.annotations set, the operator writes the annotation onto the generated StatefulSet. Combined with a pod-reloader annotation referencing the TLS secret, the reloader then manages the workload and restarts the pod when that secret changes, so Valkey picks up a rotated certificate (the concern raised in [FEATURE] make cert-manager Certificate duration configurable #65).

[boribas]

Please, also add possibility to specify certificate duration as described in: #65

[cbarbian-sap]

Why don't we just use the chart's podAnnotations: https://github.com/bitnami/charts/blob/main/bitnami/valkey-cluster/templates/valkey-statefulset.yaml#L38-L40?

[martin-briatka]

Why don't we just use the chart's podAnnotations: https://github.com/bitnami/charts/blob/main/bitnami/valkey-cluster/templates/valkey-statefulset.yaml#L38-L40?

Hi @cbarbian-sap,

podAnnotations lands on spec.template.metadata.annotations (pod template), not on the StatefulSet's own metadata.annotations. The reloader we use reads the trigger only from the workload's top-level metadata, so podAnnotations has no effect.

commonAnnotations does reach the top-level but stamps every chart object (Service, SA, PVC, headless service), not just StatefulSets.

This PR adds spec.annotations which places annotations directly on the StatefulSet metadata - currently not possible via the CR at all.