feat: extend enable/disable/teardown pattern to Workbench, Package Manager, and Chronicle

api/core/v1beta1/chronicle_types.go

@@ -13,6 +13,11 @@ import (
 
 // ChronicleSpec defines the desired state of Chronicle
 type ChronicleSpec struct {
+	// Suspended indicates Chronicle should not run serving resources (StatefulSet, Service)
+	// but should preserve configuration. Set by the Site controller.
+	// +optional
+	Suspended *bool `json:"suspended,omitempty"`
+
 	Config ChronicleConfig `json:"config,omitempty"`
 
 	// ImagePullSecrets is a set of image pull secrets to use for all image pulls. These names / secrets

api/core/v1beta1/packagemanager_types.go

@@ -16,6 +16,11 @@ import (
 
 // PackageManagerSpec defines the desired state of PackageManager
 type PackageManagerSpec struct {
+	// Suspended indicates Package Manager should not run serving resources (Deployment, Service, Ingress)
+	// but should preserve data resources (PVC, database, secrets). Set by the Site controller.
+	// +optional
+	Suspended *bool `json:"suspended,omitempty"`
+
 	License    product.LicenseSpec    `json:"license,omitempty"`
 	Config     *PackageManagerConfig  `json:"config,omitempty"`
 	Volume     *product.VolumeSpec    `json:"volume,omitempty"`

api/core/v1beta1/site_types.go

@@ -189,6 +189,21 @@ type FeatureEnablerConfig struct {
 }
 
 type InternalPackageManagerSpec struct {
+	// Enabled controls whether Package Manager is running. Defaults to true.
+	// Setting to false suspends Package Manager: stops pods and removes ingress/service,
+	// but preserves PVC, database, and secrets so data is retained.
+	// Re-enabling restores full service without data loss.
+	// +kubebuilder:default=true
+	// +optional
+	Enabled *bool `json:"enabled,omitempty"`
+
+	// Teardown permanently destroys all Package Manager resources including the database,
+	// secrets, and persistent volume claim. Only takes effect when Enabled is false.
+	// Re-enabling after teardown starts fresh with a new empty database.
+	// +kubebuilder:default=false
+	// +optional
+	Teardown *bool `json:"teardown,omitempty"`
+
 	License product.LicenseSpec `json:"license,omitempty"`
 
 	Volume *product.VolumeSpec `json:"volume,omitempty"`
@@ -341,6 +356,21 @@ type InternalConnectExperimentalFeatures struct {
 }
 
 type InternalWorkbenchSpec struct {
+	// Enabled controls whether Workbench is running. Defaults to true.
+	// Setting to false suspends Workbench: stops pods and removes ingress/service,
+	// but preserves PVC, database, and secrets so data is retained.
+	// Re-enabling restores full service without data loss.
+	// +kubebuilder:default=true
+	// +optional
+	Enabled *bool `json:"enabled,omitempty"`
+
+	// Teardown permanently destroys all Workbench resources including the database,
+	// secrets, and persistent volume claim. Only takes effect when Enabled is false.
+	// Re-enabling after teardown starts fresh with a new empty database.
+	// +kubebuilder:default=false
+	// +optional
+	Teardown *bool `json:"teardown,omitempty"`
+
 	Databricks map[string]DatabricksConfig `json:"databricks,omitempty"`
 
 	Snowflake SnowflakeConfig `json:"snowflake,omitempty"`
@@ -509,6 +539,20 @@ type InternalWorkbenchExperimentalFeatures struct {
 }
 
 type InternalChronicleSpec struct {
+	// Enabled controls whether Chronicle is running. Defaults to true.
+	// Setting to false suspends Chronicle: stops the StatefulSet and removes the service.
+	// Re-enabling restores full service.
+	// +kubebuilder:default=true
+	// +optional
+	Enabled *bool `json:"enabled,omitempty"`
+
+	// Teardown permanently destroys all Chronicle resources.
+	// Only takes effect when Enabled is false.
+	// Re-enabling after teardown starts fresh.
+	// +kubebuilder:default=false
+	// +optional
+	Teardown *bool `json:"teardown,omitempty"`
+
 	NodeSelector map[string]string `json:"nodeSelector,omitempty"`
 
 	Image string `json:"image,omitempty"`

api/core/v1beta1/workbench_types.go

@@ -25,6 +25,11 @@ const MaxLoginPageHtmlSize = 64 * 1024
 
 // WorkbenchSpec defines the desired state of Workbench
 type WorkbenchSpec struct {
+	// Suspended indicates Workbench should not run serving resources (Deployment, Service, Ingress)
+	// but should preserve data resources (PVC, database, secrets). Set by the Site controller.
+	// +optional
+	Suspended *bool `json:"suspended,omitempty"`
+
 	License       product.LicenseSpec    `json:"license,omitempty"`
 	Config        WorkbenchConfig        `json:"config,omitempty"`
 	SecretConfig  WorkbenchSecretConfig  `json:"secretConfig,omitempty"`

api/localtest/local.go

@@ -24,6 +24,7 @@ func (lte *LocalTestEnv) makeEnv() error {
 			filepath.Join(RootDir, "config", "crd", "bases"),
 			filepath.Join(RootDir, "hack", "keycloak", "crds"),
 			filepath.Join(RootDir, "hack", "traefik", "crds"),
+			filepath.Join(RootDir, "hack", "secrets-store", "crds"),
 		},
 		ErrorIfCRDPathMissing: true,
 	}

config/crd/bases/core.posit.team_chronicles.yaml

@@ -118,6 +118,11 @@ spec:
                 additionalProperties:
                   type: string
                 type: object
+              suspended:
+                description: |-
+                  Suspended indicates Chronicle should not run serving resources (StatefulSet, Service)
+                  but should preserve configuration. Set by the Site controller.
+                type: boolean
               workloadCompoundName:
                 description: WorkloadCompoundName is the name for the workload
                 type: string

config/crd/bases/core.posit.team_packagemanagers.yaml

@@ -321,6 +321,11 @@ spec:
                   Sleep puts the service to sleep... so you can debug a crash looping container / etc. It is an ugly escape hatch,
                   but can also be useful on occasion
                 type: boolean
+              suspended:
+                description: |-
+                  Suspended indicates Package Manager should not run serving resources (Deployment, Service, Ingress)
+                  but should preserve data resources (PVC, database, secrets). Set by the Site controller.
+                type: boolean
               url:
                 type: string
               volume: