feat(jar): add OCI registry pull for JAR artifacts with backward compat

- Add jarRef and jarPullSecret fields to FlinkJob CRD (jarUri/basicAuth deprecated)
- OCI pull via go-containerregistry with dual auth (K8s pull secret + env vars)
- Media type validation on pulled layers
- Atomic status patches with runningJarRef/runningJarDigest tracking
- NeedsUpgrade/RunningRef/RunningRefPatchData domain helpers
- README with usage guide, pushing JARs, and GitHub Actions CI/CD workflow
- CONTEXT.md domain glossary

internal/managed_job/cycle.go

@@ -10,8 +10,6 @@ import (
 )
 
 func (job *ManagedJob) Cycle() {
-	// pkg.Logger.Debug("[managed-job] [new] check cycle", zap.String("jobName", job.def.GetName()))
-
 	// Init job
 	if job.def.Status.LifeCycleStatus == "" && (job.def.Status.JobStatus == "" || job.def.Status.JobStatus == v1alpha1.JobStatusFinished) {
 		job.Run(false)
@@ -26,7 +24,8 @@ func (job *ManagedJob) Cycle() {
 				job.trackSavepoint()
 			}
 		}
-		if job.def.Status.RunningJarURI != nil && job.def.Spec.JarURI != *job.def.Status.RunningJarURI {
+
+		if job.def.Spec.NeedsUpgrade(job.def.Status) {
 			job.upgrade()
 		}
 
@@ -42,14 +41,6 @@ func (job *ManagedJob) Cycle() {
 		job.crd.SetJobStatus(job.def.UID, job.def.Status)
 		return
 	}
-	// if job.def.Status.JobStatus == v1alpha1.JobStatusFailed && job.def.Status.LastSavepointPath != nil {
-	// 	//job.restore()
-	// 	return
-	// }
-	// if job.def.Status.JobStatus == v1alpha1.JobStatusFailed && job.def.Status.LastSavepointPath == nil {
-	// 	//job.restore()
-	// 	return
-	// }
 
 	pkg.Logger.Warn("[managed-job] [cycle] unhandled job status", zap.String("name", job.def.Name), zap.String("status", string(job.def.Status.JobStatus)), zap.String("namespace", job.def.Namespace))
 }

internal/managed_job/jar.go

@@ -4,41 +4,90 @@ import (
 	"flink-kube-operator/internal/jar"
 	"flink-kube-operator/pkg"
 
+	"github.com/google/go-containerregistry/pkg/authn"
+	"github.com/google/go-containerregistry/pkg/name"
 	"go.uber.org/zap"
 )
 
-// upload jar file and set the jarId for later usages
+// upload pulls/downloads the jar and uploads it to Flink, then patches the CRD status.
 func (job *ManagedJob) upload() error {
-	jarFile, err := jar.NewJarFile(job.def.Spec.JarURI, job.def.Spec.JarURIBasicAuthUsername, job.def.Spec.JarURIBasicAuthPassword)
+	spec := job.def.Spec
+	var jarFile *jar.JarFile
+	var err error
+
+	if spec.IsOCISource() {
+		auth, authErr := job.resolveAuth()
+		if authErr != nil {
+			pkg.Logger.Error("[managed-job] [upload] auth resolution failed", zap.Error(authErr))
+			return authErr
+		}
+		jarFile, err = jar.NewJarFile(spec.EffectiveJarRef(), auth)
+	} else {
+		jarFile, err = jar.NewJarFileFromURI(spec.JarURI, spec.JarURIBasicAuthUsername, spec.JarURIBasicAuthPassword)
+	}
+
 	if err != nil {
-		pkg.Logger.Debug("[manage-job] [upload] error on download jar", zap.Error(err))
+		pkg.Logger.Debug("[managed-job] [upload] error on pull/download jar", zap.Error(err))
 		return err
 	}
+
 	jarId, err := jarFile.Upload(job.client)
 	if err != nil {
-		pkg.Logger.Debug("[manage-job] [upload] error on upload jar", zap.Error(err))
+		pkg.Logger.Debug("[managed-job] [upload] error on upload jar", zap.Error(err))
 		return err
 	}
-	pkg.Logger.Info("[manage-job] [upload] uploaded", zap.Any("upload-jar-resp", jarId))
+	pkg.Logger.Info("[managed-job] [upload] uploaded", zap.String("jarId", jarId))
 
-	job.def.Status.JarId = &jarId
-	job.crd.Patch(job.def.UID, map[string]interface{}{
+	patchData := map[string]interface{}{
 		"status": map[string]interface{}{
-			"jarId": job.def.Status.JarId,
+			"jarId": &jarId,
 		},
-	})
+	}
+
+	if spec.IsOCISource() {
+		digest := jarFile.Digest()
+		patchData["status"].(map[string]interface{})["runningJarDigest"] = &digest
+	}
+
+	job.crd.Patch(job.def.UID, patchData)
 	return nil
 }
 
+func (job *ManagedJob) resolveAuth() (authn.Authenticator, error) {
+	s := job.def.Spec
+	server := ""
+	ref := s.EffectiveJarRef()
+	if reg, err := extractRegistry(ref); err == nil {
+		server = reg
+	}
+	return job.crd.ResolveAuth(s.JarPullSecret, server)
+}
+
+func extractRegistry(ref string) (string, error) {
+	r, err := name.NewRegistry(ref)
+	if err != nil {
+		t, err2 := name.NewTag(ref)
+		if err2 != nil {
+			return "", err
+		}
+		return t.RegistryStr(), nil
+	}
+	return r.RegistryStr(), nil
+}
+
 func (job *ManagedJob) RemoveJar() {
 	if job.def.Status.JarId != nil {
 		err := job.client.DeleteJar(*job.def.Status.JarId)
-		pkg.Logger.Error("[managed-job] [jar]", zap.Error(err))
+		if err != nil {
+			pkg.Logger.Error("[managed-job] [jar] delete jar error", zap.Error(err))
+		}
 		err = job.crd.Patch(job.def.UID, map[string]interface{}{
 			"status": map[string]interface{}{
 				"jarId": nil,
 			},
 		})
-		pkg.Logger.Error("[managed-job] [jar]", zap.Error(err))
+		if err != nil {
+			pkg.Logger.Error("[managed-job] [jar] patch jarId error", zap.Error(err))
+		}
 	}
 }

internal/managed_job/run.go

@@ -83,17 +83,21 @@ func (job *ManagedJob) Run(restoreMode bool) error {
 	// job.def.Status.JobId = &runJarResp.JobId
 	// job.def.Status.JobStatus = v1alpha1.JobStatusCreating
 	// job.def.Status.Error = nil
+	statusPatch := map[string]interface{}{
+		"jobId":                             jobId,
+		"jobStatus":                         v1alpha1.JobStatusCreating,
+		"lifeCycleStatus":                   v1alpha1.LifeCycleStatusRestoring,
+		"lastRestoredSavepointDate":         job.def.Status.LastSavepointDate,
+		"restoredCount":                     job.def.Status.RestoredCount + 1,
+		"lastRestoredSavepointRestoredDate": time.Now().Format(time.RFC3339),
+		"error":                             nil,
+	}
+
+	refKey, refVal := job.def.Spec.RunningRefPatchData()
+	statusPatch[refKey] = refVal
+
 	job.crd.Patch(job.def.UID, map[string]interface{}{
-		"status": map[string]interface{}{
-			"jobId":                             jobId,
-			"runningJarURI":                     job.def.Spec.JarURI,
-			"jobStatus":                         v1alpha1.JobStatusCreating,
-			"lifeCycleStatus":                   v1alpha1.LifeCycleStatusRestoring,
-			"lastRestoredSavepointDate":         job.def.Status.LastSavepointDate,
-			"restoredCount":                     job.def.Status.RestoredCount + 1,
-			"lastRestoredSavepointRestoredDate": time.Now().Format(time.RFC3339),
-			"error":                             nil,
-		},
+		"status": statusPatch,
 	})
 
 	return nil

internal/managed_job/upgrade.go

@@ -7,10 +7,13 @@ import (
 )
 
 func (job *ManagedJob) upgrade() {
-	pkg.Logger.Info("[managed-job] [upgrade] pausing... ",
+	effectiveRef := job.def.Spec.EffectiveJarRef()
+	prevRef := job.def.Status.RunningRef()
+
+	pkg.Logger.Info("[managed-job] [upgrade] pausing...",
 		zap.String("jobName", job.def.GetName()),
-		zap.String("currentJarURI", job.def.Spec.JarURI),
-		zap.String("prevJarURI", *job.def.Status.RunningJarURI),
+		zap.String("currentRef", effectiveRef),
+		zap.String("prevRef", prevRef),
 	)
 	job.def.Status.JarId = nil
 	job.crd.Patch(job.def.UID, map[string]interface{}{
@@ -23,11 +26,10 @@ func (job *ManagedJob) upgrade() {
 		pkg.Logger.Error("[managed-job] [upgrade] error in pausing", zap.Error(err))
 		return
 	}
-	pkg.Logger.Info("[managed-job] [upgrade] restoring... ",
+	pkg.Logger.Info("[managed-job] [upgrade] restoring...",
 		zap.String("jobName", job.def.GetName()),
-		zap.String("currentJarURI", job.def.Spec.JarURI),
-		zap.String("prevJarURI", *job.def.Status.RunningJarURI),
-		zap.Error(err),
+		zap.String("currentRef", effectiveRef),
+		zap.String("prevRef", prevRef),
 	)
 
 	err = job.Run(true)