build: add SpotBugs plugin and fix all reported findings

bootstrapper-maven-plugin/src/main/java/io/javaoperatorsdk/boostrapper/Bootstrapper.java

@@ -18,6 +18,7 @@
 import java.io.File;
 import java.io.FileWriter;
 import java.io.IOException;
+import java.nio.charset.StandardCharsets;
 import java.util.Arrays;
 import java.util.List;
 import java.util.Map;
@@ -132,9 +133,10 @@ private void addTemplatedFile(
               targetDir == null ? projectDir : targetDir,
               targetFileName == null ? fileName : targetFileName);
       FileUtils.forceMkdir(targetFile.getParentFile());
-      var writer = new FileWriter(targetFile);
-      mustache.execute(writer, values);
-      writer.flush();
+      try (var writer = new FileWriter(targetFile, StandardCharsets.UTF_8)) {
+        mustache.execute(writer, values);
+        writer.flush();
+      }
     } catch (IOException e) {
       throw new RuntimeException(e);
     }

micrometer-support/src/main/java/io/javaoperatorsdk/operator/monitoring/micrometer/MicrometerMetrics.java

@@ -277,7 +277,8 @@ private void addMetadataTags(
       addTagOmittingOnEmptyValue(NAMESPACE, resourceID.getNamespace().orElse(null), tags, prefixed);
     }
     addTag(SCOPE, getScope(resourceID), tags, prefixed);
-    final var gvk = (GroupVersionKind) metadata.get(Constants.RESOURCE_GVK_KEY);
+    final var gvk =
+        metadata == null ? null : (GroupVersionKind) metadata.get(Constants.RESOURCE_GVK_KEY);
     if (gvk != null) {
       addGVKTags(gvk, tags, prefixed);
     }

operator-framework-core/src/main/java/io/javaoperatorsdk/operator/api/config/ExecutorServiceManager.java

@@ -132,7 +132,7 @@ public ScheduledExecutorService scheduledExecutorService() {
     return scheduledExecutorService;
   }
 
-  public void start(ConfigurationService configurationService) {
+  public synchronized void start(ConfigurationService configurationService) {
     if (!started) {
       this.configurationService = configurationService; // used to lazy init workflow executor
       this.cachingExecutorService = Executors.newCachedThreadPool();
@@ -142,7 +142,7 @@ public void start(ConfigurationService configurationService) {
     }
   }
 
-  public void stop(Duration gracefulShutdownTimeout) {
+  public synchronized void stop(Duration gracefulShutdownTimeout) {
     try {
       log.debug("Closing executor");
       var parallelExec = Executors.newFixedThreadPool(3);

operator-framework-core/src/main/java/io/javaoperatorsdk/operator/processing/dependent/AbstractEventSourceHolderDependentResource.java

@@ -36,7 +36,7 @@ public abstract class AbstractEventSourceHolderDependentResource<
 
   private T eventSource;
   private final Class<R> resourceType;
-  private boolean isCacheFillerEventSource;
+  private volatile boolean isCacheFillerEventSource;
   protected String eventSourceNameToUse;
 
   @SuppressWarnings("unchecked")

operator-framework-core/src/main/java/io/javaoperatorsdk/operator/processing/event/source/informer/ManagedInformerEventSource.java

@@ -61,9 +61,9 @@ public abstract class ManagedInformerEventSource<
         Configurable<C> {
 
   private static final Logger log = LoggerFactory.getLogger(ManagedInformerEventSource.class);
-  private InformerManager<R, C> cache;
+  private volatile InformerManager<R, C> cache;
   private final boolean comparableResourceVersions;
-  private ControllerConfiguration<R> controllerConfiguration;
+  private volatile ControllerConfiguration<R> controllerConfiguration;
   private final C configuration;
   private final Map<String, Function<R, List<String>>> indexers = new HashMap<>();
   protected TemporaryResourceCache<R> temporaryResourceCache;

operator-framework-junit/src/main/java/io/javaoperatorsdk/operator/junit/AbstractOperatorExtension.java

@@ -61,7 +61,7 @@ public abstract class AbstractOperatorExtension
   protected final boolean preserveNamespaceOnError;
   protected final boolean skipNamespaceDeletion;
   protected final boolean waitForNamespaceDeletion;
-  protected final int namespaceDeleteTimeout = DEFAULT_NAMESPACE_DELETE_TIMEOUT;
+  protected final int namespaceDeleteTimeout;
   protected final Function<ExtensionContext, String> namespaceNameSupplier;
   protected final Function<ExtensionContext, String> perClassNamespaceNameSupplier;
 
@@ -74,6 +74,7 @@ protected AbstractOperatorExtension(
       boolean preserveNamespaceOnError,
       boolean skipNamespaceDeletion,
       boolean waitForNamespaceDeletion,
+      int namespaceDeleteTimeout,
       KubernetesClient kubernetesClient,
       KubernetesClient infrastructureKubernetesClient,
       Function<ExtensionContext, String> namespaceNameSupplier,
@@ -90,6 +91,7 @@ protected AbstractOperatorExtension(
     this.preserveNamespaceOnError = preserveNamespaceOnError;
     this.skipNamespaceDeletion = skipNamespaceDeletion;
     this.waitForNamespaceDeletion = waitForNamespaceDeletion;
+    this.namespaceDeleteTimeout = namespaceDeleteTimeout;
     this.namespaceNameSupplier = namespaceNameSupplier;
     this.perClassNamespaceNameSupplier = perClassNamespaceNameSupplier;
   }

operator-framework-junit/src/main/java/io/javaoperatorsdk/operator/junit/ClusterDeployedOperatorExtension.java

@@ -53,6 +53,7 @@ private ClusterDeployedOperatorExtension(
       boolean preserveNamespaceOnError,
       boolean skipNamespaceDeletion,
       boolean waitForNamespaceDeletion,
+      int namespaceDeleteTimeout,
       boolean oneNamespacePerClass,
       KubernetesClient kubernetesClient,
       KubernetesClient infrastructureKubernetesClient,
@@ -65,6 +66,7 @@ private ClusterDeployedOperatorExtension(
         preserveNamespaceOnError,
         skipNamespaceDeletion,
         waitForNamespaceDeletion,
+        namespaceDeleteTimeout,
         kubernetesClient,
         infrastructureKubernetesClient,
         namespaceNameSupplier,
@@ -231,6 +233,7 @@ public ClusterDeployedOperatorExtension build() {
           preserveNamespaceOnError,
           skipNamespaceDeletion,
           waitForNamespaceDeletion,
+          namespaceDeleteTimeout,
           oneNamespacePerClass,
           kubernetesClient,
           infrastructureKubernetesClient,

operator-framework-junit/src/main/java/io/javaoperatorsdk/operator/junit/LocallyRunOperatorExtension.java

@@ -87,6 +87,7 @@ private LocallyRunOperatorExtension(
       boolean preserveNamespaceOnError,
       boolean skipNamespaceDeletion,
       boolean waitForNamespaceDeletion,
+      int namespaceDeleteTimeout,
       boolean oneNamespacePerClass,
       KubernetesClient kubernetesClient,
       KubernetesClient infrastructureKubernetesClient,
@@ -103,6 +104,7 @@ private LocallyRunOperatorExtension(
         preserveNamespaceOnError,
         skipNamespaceDeletion,
         waitForNamespaceDeletion,
+        namespaceDeleteTimeout,
         kubernetesClient,
         infrastructureKubernetesClient,
         namespaceNameSupplier,
@@ -184,7 +186,8 @@ public static void applyCrd(String resourceTypeName, KubernetesClient client) {
   private static void applyCrd(String crdString, String path, KubernetesClient client) {
     try {
       LOGGER.debug("Applying CRD: {}", crdString);
-      final var crd = client.load(new ByteArrayInputStream(crdString.getBytes()));
+      final var crd =
+          client.load(new ByteArrayInputStream(crdString.getBytes(StandardCharsets.UTF_8)));
       crd.serverSideApply();
       appliedCRDs.add(new AppliedCRD.FileCRD(crdString, path));
       Thread.sleep(CRD_READY_WAIT); // readiness is not applicable for CRD, just wait a little
@@ -446,7 +449,10 @@ record FileCRD(String crdString, String path) implements AppliedCRD {
       public void delete(KubernetesClient client) {
         try {
           LOGGER.debug("Deleting CRD: {}", crdString);
-          final var items = client.load(new ByteArrayInputStream(crdString.getBytes())).items();
+          final var items =
+              client
+                  .load(new ByteArrayInputStream(crdString.getBytes(StandardCharsets.UTF_8)))
+                  .items();
           if (items == null || items.isEmpty() || items.get(0) == null) {
             LOGGER.warn("Could not determine CRD name from yaml: {}", path);
             return;
@@ -620,6 +626,7 @@ public LocallyRunOperatorExtension build() {
           preserveNamespaceOnError,
           skipNamespaceDeletion,
           waitForNamespaceDeletion,
+          namespaceDeleteTimeout,
           oneNamespacePerClass,
           kubernetesClient,
           infrastructureKubernetesClient,

operator-framework/src/main/java/io/javaoperatorsdk/operator/config/runtime/AccumulativeMappingWriter.java

@@ -19,6 +19,7 @@
 import java.io.IOException;
 import java.io.InputStreamReader;
 import java.io.PrintWriter;
+import java.nio.charset.StandardCharsets;
 import java.util.Map;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.stream.Collectors;
@@ -51,7 +52,8 @@ public AccumulativeMappingWriter loadExistingMappings() {
               .getResource(StandardLocation.CLASS_OUTPUT, "", resourcePath);
 
       try (BufferedReader bufferedReader =
-          new BufferedReader(new InputStreamReader(readonlyResource.openInputStream()))) {
+          new BufferedReader(
+              new InputStreamReader(readonlyResource.openInputStream(), StandardCharsets.UTF_8))) {
         final var existingLines =
             bufferedReader
                 .lines()
@@ -81,7 +83,7 @@ public void flush() {
           processingEnvironment
               .getFiler()
               .createResource(StandardLocation.CLASS_OUTPUT, "", resourcePath);
-      printWriter = new PrintWriter(resource.openOutputStream());
+      printWriter = new PrintWriter(resource.openOutputStream(), false, StandardCharsets.UTF_8);
 
       for (Map.Entry<String, String> entry : mappings.entrySet()) {
         printWriter.println(entry.getKey() + "," + entry.getValue());

operator-framework/src/main/java/io/javaoperatorsdk/operator/config/runtime/ClassMappingProvider.java

@@ -19,6 +19,7 @@
 import java.io.IOException;
 import java.io.InputStreamReader;
 import java.net.URL;
+import java.nio.charset.StandardCharsets;
 import java.util.Enumeration;
 import java.util.HashMap;
 import java.util.Iterator;
@@ -69,7 +70,8 @@ static <T, V> Map<T, V> provide(final String resourcePath, T key, V value) {
   }
 
   private static List<String> retrieveClassNamePairs(URL url) throws IOException {
-    try (BufferedReader br = new BufferedReader(new InputStreamReader(url.openStream()))) {
+    try (BufferedReader br =
+        new BufferedReader(new InputStreamReader(url.openStream(), StandardCharsets.UTF_8))) {
       return br.lines().collect(Collectors.toList());
     }
   }

pom.xml

@@ -103,6 +103,7 @@
     <git-commit-id-maven-plugin.version>10.0.0</git-commit-id-maven-plugin.version>
     <jib-maven-plugin.version>3.5.1</jib-maven-plugin.version>
     <spotless.version>3.6.0</spotless.version>
+    <spotbugs-maven-plugin.version>4.9.8.3</spotbugs-maven-plugin.version>
   </properties>
 
   <dependencyManagement>
@@ -331,6 +332,11 @@
           <artifactId>spotless-maven-plugin</artifactId>
           <version>${spotless.version}</version>
         </plugin>
+        <plugin>
+          <groupId>com.github.spotbugs</groupId>
+          <artifactId>spotbugs-maven-plugin</artifactId>
+          <version>${spotbugs-maven-plugin.version}</version>
+        </plugin>
       </plugins>
     </pluginManagement>
     <plugins>
@@ -431,6 +437,25 @@
           </execution>
         </executions>
       </plugin>
+      <plugin>
+        <groupId>com.github.spotbugs</groupId>
+        <artifactId>spotbugs-maven-plugin</artifactId>
+        <configuration>
+          <effort>Max</effort>
+          <threshold>Medium</threshold>
+          <includeTests>false</includeTests>
+          <excludeFilterFile>${maven.multiModuleProjectDirectory}/spotbugs-exclude.xml</excludeFilterFile>
+        </configuration>
+        <executions>
+          <execution>
+            <id>spotbugs-check</id>
+            <goals>
+              <goal>check</goal>
+            </goals>
+            <phase>verify</phase>
+          </execution>
+        </executions>
+      </plugin>
     </plugins>
   </build>
   <profiles>

sample-operators/mysql-schema/src/main/java/io/javaoperatorsdk/operator/sample/dependent/SchemaDependentResource.java

@@ -15,6 +15,7 @@
  */
 package io.javaoperatorsdk.operator.sample.dependent;
 
+import java.nio.charset.StandardCharsets;
 import java.sql.Connection;
 import java.sql.DriverManager;
 import java.sql.SQLException;
@@ -121,7 +122,7 @@ public void delete(MySQLSchema primary, Context<MySQLSchema> context) {
   }
 
   public static String decode(String value) {
-    return new String(Base64.getDecoder().decode(value.getBytes()));
+    return new String(Base64.getDecoder().decode(value), StandardCharsets.UTF_8);
   }
 
   @Override

sample-operators/mysql-schema/src/main/java/io/javaoperatorsdk/operator/sample/dependent/SecretDependentResource.java

@@ -15,6 +15,7 @@
  */
 package io.javaoperatorsdk.operator.sample.dependent;
 
+import java.nio.charset.StandardCharsets;
 import java.util.Base64;
 import java.util.Set;
 
@@ -43,7 +44,7 @@ public class SecretDependentResource extends KubernetesDependentResource<Secret,
   public static final String MYSQL_SECRET_PASSWORD = "mysql.secret.user.password";
 
   private static String encode(String value) {
-    return Base64.getEncoder().encodeToString(value.getBytes());
+    return Base64.getEncoder().encodeToString(value.getBytes(StandardCharsets.UTF_8));
   }
 
   @Override

sample-operators/operations/src/main/java/io/javaoperatorsdk/operator/sample/operations/OperationsSampleOperator.java

@@ -66,7 +66,8 @@ public static void main(String[] args) throws Exception {
 
     var configProviders = new ArrayList<ConfigProvider>();
     configProviders.add(new EnvVarConfigProvider());
-    configProviders.add(new YamlConfigProvider(Path.of("/config/config.yaml")));
+    var configPath = System.getenv().getOrDefault("CONFIG_PATH", "/config/config.yaml");
+    configProviders.add(new YamlConfigProvider(Path.of(configPath)));
     var configLoader = new ConfigLoader(new AggregatePriorityListConfigProvider(configProviders));
 
     Metrics metrics = initOTLPMetrics(isLocal());

sample-operators/tomcat-operator/src/main/java/io/javaoperatorsdk/operator/sample/TomcatReconciler.java

@@ -51,7 +51,9 @@ public UpdateControl<Tomcat> reconcile(Tomcat tomcat, Context<Tomcat> context) {
                   "Updating status of Tomcat {} in namespace {} to {} ready replicas",
                   tomcat.getMetadata().getName(),
                   tomcat.getMetadata().getNamespace(),
-                  tomcat.getStatus() == null ? 0 : tomcat.getStatus().getReadyReplicas());
+                  tomcat.getStatus() == null
+                      ? Integer.valueOf(0)
+                      : tomcat.getStatus().getReadyReplicas());
               return UpdateControl.patchStatus(updatedTomcat);
             })
         .orElseGet(UpdateControl::noUpdate);

sample-operators/tomcat-operator/src/main/java/io/javaoperatorsdk/operator/sample/WebappReconciler.java

@@ -16,6 +16,7 @@
 package io.javaoperatorsdk.operator.sample;
 
 import java.io.ByteArrayOutputStream;
+import java.nio.charset.StandardCharsets;
 import java.util.List;
 import java.util.Objects;
 import java.util.Set;
@@ -252,7 +253,7 @@ public void onFailure(Throwable t, Response response) {
     @Override
     public void onClose(int code, String reason) {
       log.debug("Exit with: {} and with reason: {}", code, reason);
-      data.complete(baos.toString());
+      data.complete(baos.toString(StandardCharsets.UTF_8));
     }
   }
 }

spotbugs-exclude.xml

@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+
+    Copyright Java Operator SDK Authors
+
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
+
+            http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+
+-->
+<FindBugsFilter>
+  <!--
+    Exposing/storing internal representation. This SDK intentionally shares references
+    (caches, primary resource, builder-held collections) for performance and by design;
+    defensive copies would change behavior. Treated as noise project-wide.
+  -->
+  <Match>
+    <Bug pattern="EI_EXPOSE_REP,EI_EXPOSE_REP2"/>
+  </Match>
+
+  <!--
+    Constructor may throw before object is fully constructed (finalizer-attack hardening,
+    Java 17+). None of these classes declare a finalizer, so the attack vector does not apply.
+  -->
+  <Match>
+    <Bug pattern="CT_CONSTRUCTOR_THROW"/>
+  </Match>
+
+  <!-- Intentional: losing leadership terminates the process. -->
+  <Match>
+    <Class name="io.javaoperatorsdk.operator.LeaderElectionManager"/>
+    <Bug pattern="DM_EXIT"/>
+  </Match>
+
+  <!-- Intentional tri-state (true/false/undefined) modelled with a nullable Boolean. -->
+  <Match>
+    <Class name="io.javaoperatorsdk.operator.processing.dependent.kubernetes.BooleanWithUndefined"/>
+    <Bug pattern="NP_BOOLEAN_RETURN_NULL"/>
+  </Match>
+
+  <!-- equals() is intentionally inherited from GroupVersionKind; plural is not part of identity. -->
+  <Match>
+    <Class name="io.javaoperatorsdk.operator.processing.dependent.kubernetes.GroupVersionKindPlural"/>
+    <Bug pattern="EQ_DOESNT_OVERRIDE_EQUALS"/>
+  </Match>
+
+  <!-- Package-private constructor is required for testing the matcher. -->
+  <Match>
+    <Class name="io.javaoperatorsdk.operator.processing.dependent.kubernetes.SSABasedGenericKubernetesResourceMatcher"/>
+    <Bug pattern="SING_SINGLETON_HAS_NONPRIVATE_CONSTRUCTOR"/>
+  </Match>
+
+  <!--
+    Not a singleton: ConfigLoader exposes a static DEFAULT convenience instance via getDefault(),
+    but is part of the public API and is meant to be instantiated with custom ConfigProviders
+    through its public constructors. The singleton heuristic is a false positive here.
+  -->
+  <Match>
+    <Class name="io.javaoperatorsdk.operator.config.loader.ConfigLoader"/>
+    <Bug pattern="SING_SINGLETON_HAS_NONPRIVATE_CONSTRUCTOR"/>
+  </Match>
+</FindBugsFilter>