fix: Delay controller startup to avoid 404 in initial list

CHANGELOG.md

@@ -14,6 +14,10 @@ All notable changes to this project will be documented in this file.
   This behaviour is in line with the default behaviour of Helm and OLM.
 - Bump testing-tools to `0.3.0-stackable0.0.0-dev` ([#671]).
 
+### Fixed
+
+- Fix "404 page not found" error for the initial object list ([#687]).
+
 ### Removed
 
 - BREAKING: Removed support for ephemeral CSI volumes ([#481], [#670]).
@@ -40,6 +44,7 @@ All notable changes to this project will be documented in this file.
 [#671]: https://github.com/stackabletech/secret-operator/pull/671
 [#674]: https://github.com/stackabletech/secret-operator/pull/674
 [#685]: https://github.com/stackabletech/secret-operator/pull/685
+[#687]: https://github.com/stackabletech/secret-operator/pull/687
 
 ## [25.11.0] - 2025-11-07
 

rust/operator-binary/src/main.rs

@@ -2,7 +2,7 @@
 // This will need changes in our and upstream error types.
 #![allow(clippy::result_large_err)]
 
-use std::{os::unix::prelude::FileTypeExt, path::PathBuf};
+use std::{future::Future, os::unix::prelude::FileTypeExt, path::PathBuf};
 
 use anyhow::{Context, Ok, anyhow};
 use clap::Parser;
@@ -24,7 +24,6 @@ use stackable_operator::{
     telemetry::Tracing,
     utils::signal::SignalWatcher,
 };
-use tokio::sync::oneshot;
 use tokio_stream::wrappers::UnixListenerStream;
 use tonic::transport::Server;
 use utils::{TonicUnixStream, uds_bind_private};
@@ -209,6 +208,12 @@ async fn main() -> anyhow::Result<()> {
                     )
                     .await?;
 
+                    // Here, we multiply the initial reconcile signal received by the oneshot receiver
+                    // to be able to pass it to both the default custom resource deployer and to delay
+                    // the startup of the controller.
+                    let initial_reconcile_signal =
+                        SignalWatcher::new(initial_reconcile_rx.map(|_| ()));
+
                     let webhook_server = webhook_server
                         .run(sigterm_watcher.handle())
                         .map_err(|err| anyhow!(err).context("failed to run webhook server"));
@@ -217,7 +222,7 @@ async fn main() -> anyhow::Result<()> {
                         .unwrap_or(operator_environment.operator_namespace.clone());
 
                     let default_secretclass = create_default_secretclass(
-                        initial_reconcile_rx,
+                        initial_reconcile_signal.handle(),
                         ca_secret_namespace,
                         client.clone(),
                     )
@@ -232,8 +237,13 @@ async fn main() -> anyhow::Result<()> {
                     )
                     .map(anyhow::Ok);
 
+                    let delayed_truststore_controller = async {
+                        let _ = initial_reconcile_signal.handle().await;
+                        truststore_controller.await
+                    };
+
                     try_join!(
-                        truststore_controller,
+                        delayed_truststore_controller,
                         default_secretclass,
                         webhook_server,
                         eos_checker,
@@ -247,11 +257,11 @@ async fn main() -> anyhow::Result<()> {
 }
 
 async fn create_default_secretclass(
-    initial_reconcile_rx: oneshot::Receiver<()>,
+    initial_reconcile_signal: impl Future<Output = ()>,
     ca_secret_namespace: String,
     client: Client,
 ) -> anyhow::Result<()> {
-    initial_reconcile_rx.await?;
+    initial_reconcile_signal.await;
 
     tracing::info!("applying default secretclass");