feat: config overrides

CHANGELOG.md

@@ -4,11 +4,16 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+### Added
+
+- Support `configOverrides` for `config.json` (#818).
+
 ### Changed
 
 - Set `maxSurge=1` and `maxUnavailable=0` on the OPA DaemonSet rolling update strategy to eliminate
   availability gaps during rolling updates ([#819]).
 
+[#818]: https://github.com/stackabletech/opa-operator/pull/818
 [#819]: https://github.com/stackabletech/opa-operator/pull/819
 
 ## [26.3.0] - 2026-03-16

docs/modules/opa/pages/usage-guide/OpenTelemetry.adoc

@@ -1,30 +1,19 @@
 = OpenTelemetry
 :description: Ship OPA traces and logs to OpenTelemetry
-:opa-docs: https://v1-4-2--opa-docs.netlify.app/configuration/#distributed-tracing
+:opa-docs: https://www.openpolicyagent.org/docs/configuration/#distributed-tracing
 
-Opa supports sending OpenTelemetry traces as stated in {opa-docs}[the documentation].
+OPA supports sending OpenTelemetry traces as stated in {opa-docs}[the documentation].
 
-As of SDP 25.7, `configOverrides` are (still) not supported, we are tracking the progress in https://github.com/stackabletech/opa-operator/issues/756[this GitHub issue].
-To enable traces you need to modify the config and thus xref:opa:usage-guide/operations/cluster-operations.adoc[pause the reconciliation] of your OpaCluster, so that changes to the ConfigMap aren't immediately overridden by the opa-operator.
-
-WARNING: It's not encouraged to pause the reconciliation more than just temporarily. We recommend disabling it while you debug e.g. performance problems and re-enabling it afterwards. This problem will be solved once we support configOverrides for OPA.
-
-Afterwards you can edit the `<stacklet-name>-server-default` ConfigMap and append a `distributed_tracing` section as follows.
+To enable traces, add a `distributed_tracing` section to the OPA configuration using `configOverrides`.
 Please check the {opa-docs}[OPA documentation] to see what other settings you can configure.
 
 [source,yaml]
 ----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: opa-server-default
-data:
-  config.json: |-
-    {
-      <<< existing JSON >>>
-      "distributed_tracing": {
-        "address": "jaeger-collector.default.svc.cluster.local:4317",
-        "type": "grpc"
-      }
-    }
+servers:
+  configOverrides:
+    config.json:
+      jsonMergePatch:
+        distributed_tracing:
+          address: jaeger-collector.default.svc.cluster.local:4317
+          type: grpc
 ----

docs/modules/opa/pages/usage-guide/configuration-environment-overrides.adoc

@@ -8,34 +8,65 @@ This will lead to faulty installations.
 
 == Configuration properties
 
-Currently, not supported for `config.json`.
+OPA's `config.json` can be overridden using `configOverrides`.
+For details on the supported override strategies, see the xref:concepts:overrides.adoc#config-overrides[config overrides documentation].
+
+For example per role:
+
+[source,yaml]
+----
+servers:
+  configOverrides:
+    config.json:
+      jsonPatches:
+        - '{"op": "replace", "path": "/bundles/stackable/polling/min_delay_seconds", "value": 3}'
+        - '{"op": "add", "path": "/default_decision", "value": "allow"}'
+  roleGroups:
+    default:
+      config: {}
+----
+
+or per role group:
+
+[source,yaml]
+----
+servers:
+  roleGroups:
+    default:
+      configOverrides:
+        config.json:
+          jsonMergePatch:
+            distributed_tracing:
+              address: jaeger-collector.default.svc.cluster.local:4317
+              type: grpc
+----
 
 == Environment variables
 
 Environment variables can be (over)written by adding the `envOverrides` property.
 
-For example per role group:
+For example per role:
 
 [source,yaml]
 ----
 servers:
+  envOverrides:
+    MY_ENV_VAR: "MY_VALUE"
   roleGroups:
     default:
       config: {}
-      envOverrides:
-        MY_ENV_VAR: "MY_VALUE"
 ----
 
-or per role:
+or per role group:
 
 [source,yaml]
 ----
 servers:
-  envOverrides:
-    MY_ENV_VAR: "MY_VALUE"
   roleGroups:
     default:
       config: {}
+      envOverrides:
+        MY_ENV_VAR: "MY_VALUE"
 ----
 
 == CLI overrides
@@ -45,28 +76,28 @@ This allows you to customize OPA's behavior by passing additional or overriding
 
 CLI overrides can be specified at both the role and rolegroup level, with rolegroup overrides taking precedence over role overrides.
 
-For example, per rolegroup:
+For example, per role:
 
 [source,yaml]
 ----
 servers:
+  cliOverrides:
+    --log-format: json
+    --diagnostic-addr: "0.0.0.0:8282"
   roleGroups:
-    default:
-      cliOverrides:
-        --log-format: json-pretty
-        --diagnostic-addr: "0.0.0.0:8282"
+    default: {}
 ----
 
-or per role:
+or per rolegroup:
 
 [source,yaml]
 ----
 servers:
-  cliOverrides:
-    --log-format: json
-    --diagnostic-addr: "0.0.0.0:8282"
   roleGroups:
-    default: {}
+    default:
+      cliOverrides:
+        --log-format: json-pretty
+        --diagnostic-addr: "0.0.0.0:8282"
 ----
 
 For a complete list of available flags, refer to the https://www.openpolicyagent.org/docs/latest/cli/#run[OPA documentation].

extra/crds.yaml

@@ -1121,17 +1121,50 @@ spec:
                         type: object
                     type: object
                   configOverrides:
-                    additionalProperties:
-                      additionalProperties:
-                        type: string
-                      type: object
-                    default: {}
                     description: |-
                       The `configOverrides` can be used to configure properties in product config files
                       that are not exposed in the CRD. Read the
                       [config overrides documentation](https://docs.stackable.tech/home/nightly/concepts/overrides#config-overrides)
                       and consult the operator specific usage guide documentation for details on the
                       available config files and settings for the specific product.
+                    properties:
+                      config.json:
+                        description: Overrides for the OPA `config.json` file.
+                        nullable: true
+                        oneOf:
+                        - required:
+                          - jsonMergePatch
+                        - required:
+                          - jsonPatches
+                        - required:
+                          - userProvided
+                        properties:
+                          jsonMergePatch:
+                            description: |-
+                              Can be set to arbitrary YAML content, which is converted to JSON and used as
+                              [RFC 7396](https://datatracker.ietf.org/doc/html/rfc7396) JSON merge patch.
+                            x-kubernetes-preserve-unknown-fields: true
+                          jsonPatches:
+                            description: |-
+                              List of [RFC 6902](https://datatracker.ietf.org/doc/html/rfc6902) JSON patches.
+
+                              Can be used when more flexibility is needed, e.g. to only modify elements
+                              in a list based on a condition.
+
+                              A patch looks something like
+
+                              `{"op": "test", "path": "/0/name", "value": "Andrew"}`
+
+                              or
+
+                              `{"op": "add", "path": "/0/happy", "value": true}`
+                            items:
+                              type: string
+                            type: array
+                          userProvided:
+                            description: Override the entire config file with the specified String.
+                            type: string
+                        type: object
                     type: object
                   envOverrides:
                     additionalProperties:
@@ -1680,17 +1713,50 @@ spec:
                               type: object
                           type: object
                         configOverrides:
-                          additionalProperties:
-                            additionalProperties:
-                              type: string
-                            type: object
-                          default: {}
                           description: |-
                             The `configOverrides` can be used to configure properties in product config files
                             that are not exposed in the CRD. Read the
                             [config overrides documentation](https://docs.stackable.tech/home/nightly/concepts/overrides#config-overrides)
                             and consult the operator specific usage guide documentation for details on the
                             available config files and settings for the specific product.
+                          properties:
+                            config.json:
+                              description: Overrides for the OPA `config.json` file.
+                              nullable: true
+                              oneOf:
+                              - required:
+                                - jsonMergePatch
+                              - required:
+                                - jsonPatches
+                              - required:
+                                - userProvided
+                              properties:
+                                jsonMergePatch:
+                                  description: |-
+                                    Can be set to arbitrary YAML content, which is converted to JSON and used as
+                                    [RFC 7396](https://datatracker.ietf.org/doc/html/rfc7396) JSON merge patch.
+                                  x-kubernetes-preserve-unknown-fields: true
+                                jsonPatches:
+                                  description: |-
+                                    List of [RFC 6902](https://datatracker.ietf.org/doc/html/rfc6902) JSON patches.
+
+                                    Can be used when more flexibility is needed, e.g. to only modify elements
+                                    in a list based on a condition.
+
+                                    A patch looks something like
+
+                                    `{"op": "test", "path": "/0/name", "value": "Andrew"}`
+
+                                    or
+
+                                    `{"op": "add", "path": "/0/happy", "value": true}`
+                                  items:
+                                    type: string
+                                  type: array
+                                userProvided:
+                                  description: Override the entire config file with the specified String.
+                                  type: string
+                              type: object
                           type: object
                         envOverrides:
                           additionalProperties:
@@ -2887,17 +2953,50 @@ spec:
                         type: object
                     type: object
                   configOverrides:
-                    additionalProperties:
-                      additionalProperties:
-                        type: string
-                      type: object
-                    default: {}
                     description: |-
                       The `configOverrides` can be used to configure properties in product config files
                       that are not exposed in the CRD. Read the
                       [config overrides documentation](https://docs.stackable.tech/home/nightly/concepts/overrides#config-overrides)
                       and consult the operator specific usage guide documentation for details on the
                       available config files and settings for the specific product.
+                    properties:
+                      config.json:
+                        description: Overrides for the OPA `config.json` file.
+                        nullable: true
+                        oneOf:
+                        - required:
+                          - jsonMergePatch
+                        - required:
+                          - jsonPatches
+                        - required:
+                          - userProvided
+                        properties:
+                          jsonMergePatch:
+                            description: |-
+                              Can be set to arbitrary YAML content, which is converted to JSON and used as
+                              [RFC 7396](https://datatracker.ietf.org/doc/html/rfc7396) JSON merge patch.
+                            x-kubernetes-preserve-unknown-fields: true
+                          jsonPatches:
+                            description: |-
+                              List of [RFC 6902](https://datatracker.ietf.org/doc/html/rfc6902) JSON patches.
+
+                              Can be used when more flexibility is needed, e.g. to only modify elements
+                              in a list based on a condition.
+
+                              A patch looks something like
+
+                              `{"op": "test", "path": "/0/name", "value": "Andrew"}`
+
+                              or
+
+                              `{"op": "add", "path": "/0/happy", "value": true}`
+                            items:
+                              type: string
+                            type: array
+                          userProvided:
+                            description: Override the entire config file with the specified String.
+                            type: string
+                        type: object
                     type: object
                   envOverrides:
                     additionalProperties:
@@ -3446,17 +3545,50 @@ spec:
                               type: object
                           type: object
                         configOverrides:
-                          additionalProperties:
-                            additionalProperties:
-                              type: string
-                            type: object
-                          default: {}
                           description: |-
                             The `configOverrides` can be used to configure properties in product config files
                             that are not exposed in the CRD. Read the
                             [config overrides documentation](https://docs.stackable.tech/home/nightly/concepts/overrides#config-overrides)
                             and consult the operator specific usage guide documentation for details on the
                             available config files and settings for the specific product.
+                          properties:
+                            config.json:
+                              description: Overrides for the OPA `config.json` file.
+                              nullable: true
+                              oneOf:
+                              - required:
+                                - jsonMergePatch
+                              - required:
+                                - jsonPatches
+                              - required:
+                                - userProvided
+                              properties:
+                                jsonMergePatch:
+                                  description: |-
+                                    Can be set to arbitrary YAML content, which is converted to JSON and used as
+                                    [RFC 7396](https://datatracker.ietf.org/doc/html/rfc7396) JSON merge patch.
+                                  x-kubernetes-preserve-unknown-fields: true
+                                jsonPatches:
+                                  description: |-
+                                    List of [RFC 6902](https://datatracker.ietf.org/doc/html/rfc6902) JSON patches.
+
+                                    Can be used when more flexibility is needed, e.g. to only modify elements
+                                    in a list based on a condition.
+
+                                    A patch looks something like
+
+                                    `{"op": "test", "path": "/0/name", "value": "Andrew"}`
+
+                                    or
+
+                                    `{"op": "add", "path": "/0/happy", "value": true}`
+                                  items:
+                                    type: string
+                                  type: array
+                                userProvided:
+                                  description: Override the entire config file with the specified String.
+                                  type: string
+                              type: object
                           type: object
                         envOverrides:
                           additionalProperties: