feat: Support floating tag in product image selection

CHANGELOG.md

@@ -6,6 +6,8 @@ All notable changes to this project will be documented in this file.
 
 ### Added
 
+- Support floating tags for product images via the new `spec.image.stackableVersionPolicy` field
+  ([#891]).
 - Add an initial version of resource-info-fetcher, which is similar to user-info-fetcher,
   but allows to fetch additional metadata about resource information from a data catalog.
   For now only DataHub is supported.
@@ -14,13 +16,17 @@ All notable changes to this project will be documented in this file.
 - Allow specifying the maximum number of cached entries in the user-info-fetcher, defaulting to `10000`.
   The cache was previously unbounded, which a caller could exploit to exhaust the memory limit of
   the sidecar, as cache keys are built from caller-supplied parameters. Entries beyond the limit are now
-  evicted least-recently-used first ([#863])
+  evicted least-recently-used first ([#863]).
 
 ### Changed
 
+- BREAKING: `spec.image.stackableVersion` must now be a full, valid semver version, e.g. `26.7.1`.
+  Abbreviated values such as `26.7` are no longer accepted ([#891]).
+- BREAKING: `spec.image.pullPolicy` now defaults to `IfNotPresent` for non-floating tags instead of
+  always defaulting to `Always` ([#891]).
 - Internal operator refactoring: introduce a build() step in the reconciler that
   assembles all relevant Kubernetes resources before anything is applied ([#852]).
-- Bump `stackable-operator` to 0.114.0 ([#867]).
+- Bump `stackable-operator` to 0.118.0 ([#867], [#880], [#891]).
 - The RBAC ServiceAccount and RoleBinding are now built with the operator-rs `v2::rbac`
   functions and carry the full set of recommended labels ([#861]).
 - All product containers now run with `securityContext.runAsNonRoot` set to `true` to improve security ([#871]).
@@ -43,7 +49,6 @@ All notable changes to this project will be documented in this file.
   `user-info-fetcher-credentials` instead of `credentials`, so that it does not collide with the
   resource-info-fetcher's. A `podOverrides` patching that volume or its volume mount by name must be
   adjusted, otherwise it silently stops applying ([#863]).
-- Bump `stackable-operator` to 0.116.0 ([#867], [#880]).
 - The user-info-fetcher now logs a failed lookup once, where the backend was queried, instead of once
   per response it is rendered into, and logs a request it rejects as the caller's fault (an unknown
   user) at `debug` rather than `warn`. Any caller could previously fill the log with `warn` lines by
@@ -84,6 +89,7 @@ All notable changes to this project will be documented in this file.
 [#882]: https://github.com/stackabletech/opa-operator/pull/882
 [#886]: https://github.com/stackabletech/opa-operator/pull/886
 [#889]: https://github.com/stackabletech/opa-operator/pull/889
+[#891]: https://github.com/stackabletech/opa-operator/pull/891
 
 ## [26.7.0] - 2026-07-21
 

Cargo.toml

@@ -10,7 +10,7 @@ edition = "2024"
 repository = "https://github.com/stackabletech/opa-operator"
 
 [workspace.dependencies]
-stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", tag = "stackable-operator-0.116.0", features = ["webhook"] }
+stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", tag = "stackable-operator-0.118.0", features = ["webhook"] }
 krb5 = { git = "https://github.com/stackabletech/krb5-rs.git", tag = "v0.1.0" }
 
 anyhow = "1.0"