feat: pass --skip-seed to node, rollout, opamp, and nats

docs/architecture.md

@@ -22,6 +22,8 @@ The primary service that users and managed collectors connect to. Exposes the Bi
 
 Manages periodic background jobs, such as agent cleanup and maintenance tasks.
 
+The Jobs pod is the only component that seeds Bindplane resources (such as resource types) into the store on startup. All other `bindplane serve` workloads are started with `--skip-seed`. The Jobs Migrate Job does not seed resources.
+
 **Scaling**: Always one pod.
 
 ### Bindplane Jobs Migrate

internal/controller/bindplane_controller.go

@@ -431,6 +431,9 @@ const (
 	preStopArgs = "-c"
 	// preStopSleep is the sleep command for preStop hooks
 	preStopSleep = "sleep 5"
+	// skipSeedArg is passed to `bindplane serve` on components that must not seed
+	// resources on startup. Seeding is performed only by the Bindplane Jobs pod.
+	skipSeedArg = "--skip-seed"
 )
 
 // Probe timing constants

internal/controller/nats.go

@@ -154,6 +154,7 @@ func (r *BindplaneReconciler) natsStatefulSet(bindplane *bindplanev1alpha1.Bindp
 						Containers: []corev1.Container{
 							{
 								Name:         natsContainerName,
+								Args:         []string{skipSeedArg},
 								Image:        getNatsImage(bindplane),
 								VolumeMounts: configMounts,
 								Ports: []corev1.ContainerPort{

internal/controller/node.go

@@ -182,6 +182,7 @@ func (r *BindplaneReconciler) nodeDeployment(bindplane *bindplanev1alpha1.Bindpl
 						Containers: []corev1.Container{
 							{
 								Name:         nodeContainerName,
+								Args:         []string{skipSeedArg},
 								Image:        getNodeImage(bindplane),
 								VolumeMounts: configMounts,
 								Ports: []corev1.ContainerPort{

internal/controller/node_rollout.go

@@ -111,6 +111,7 @@ func (r *BindplaneReconciler) nodeRollout(bindplane *bindplanev1alpha1.Bindplane
 						Containers: []corev1.Container{
 							{
 								Name:         nodeContainerName,
+								Args:         []string{skipSeedArg},
 								Image:        getNodeImage(bindplane),
 								VolumeMounts: configMounts,
 								Ports: []corev1.ContainerPort{

internal/controller/opamp.go

@@ -236,6 +236,7 @@ func (r *BindplaneReconciler) opampDeployment(bindplane *bindplanev1alpha1.Bindp
 						Containers: []corev1.Container{
 							{
 								Name:         opampContainerName,
+								Args:         []string{skipSeedArg},
 								Image:        getOpAMPImage(bindplane),
 								VolumeMounts: configMounts,
 								Ports: []corev1.ContainerPort{

internal/controller/skip_seed_test.go

@@ -0,0 +1,98 @@
+/*
+Copyright 2025.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package controller
+
+import (
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+	corev1 "k8s.io/api/core/v1"
+
+	bindplanev1alpha1 "github.com/observiq/bindplane-operator/api/v1alpha1"
+)
+
+// Only the Bindplane Jobs pod seeds resources on startup. Every other
+// `bindplane serve` workload passes --skip-seed.
+var _ = Describe("skip seed", func() {
+	var r *BindplaneReconciler
+
+	newBindplane := func() *bindplanev1alpha1.Bindplane {
+		bp := newTestBindplane("my-bp", "default")
+		bp.Spec.Bindplane.Replicas = new(int32(2))
+		bp.Spec.Nats = &bindplanev1alpha1.NatsComponentSpec{Replicas: new(int32(3))}
+		return bp
+	}
+
+	BeforeEach(func() {
+		r = newReconciler()
+	})
+
+	It("node deployment passes --skip-seed", func() {
+		bp := newBindplane()
+		container := r.nodeDeployment(bp).Spec.Template.Spec.Containers[0]
+		Expect(container.Args).To(Equal([]string{skipSeedArg}))
+	})
+
+	It("node rollout passes --skip-seed", func() {
+		bp := newTestBindplaneWithArgoRollout("my-bp", "default")
+		container := r.nodeRollout(bp).Spec.Template.Spec.Containers[0]
+		Expect(container.Args).To(Equal([]string{skipSeedArg}))
+	})
+
+	It("opamp deployment passes --skip-seed", func() {
+		bp := newTestBindplaneWithOpAMP("my-bp", "default")
+		container := r.opampDeployment(bp).Spec.Template.Spec.Containers[0]
+		Expect(container.Args).To(Equal([]string{skipSeedArg}))
+	})
+
+	It("nats statefulset passes --skip-seed", func() {
+		bp := newBindplane()
+		container := r.natsStatefulSet(bp).Spec.Template.Spec.Containers[0]
+		Expect(container.Args).To(Equal([]string{skipSeedArg}))
+	})
+
+	It("jobs deployment does not pass --skip-seed so it seeds on startup", func() {
+		bp := newTestBindplane("my-bp", "default")
+		container := r.bindplaneJobsDeployment(bp).Spec.Template.Spec.Containers[0]
+		Expect(container.Args).NotTo(ContainElement(skipSeedArg))
+		Expect(container.Command).NotTo(ContainElement(skipSeedArg))
+	})
+
+	It("jobs migrate job does not pass --skip-seed", func() {
+		bp := newTestBindplane("my-bp", "default")
+		container := r.bindplaneJobsMigrateJob(bp).Spec.Template.Spec.Containers[0]
+		Expect(container.Command).NotTo(ContainElement(skipSeedArg))
+		Expect(container.Args).NotTo(ContainElement(skipSeedArg))
+	})
+
+	It("user podTemplate cannot remove --skip-seed from the node container", func() {
+		bp := newBindplane()
+		bp.Spec.Bindplane.PodTemplate = &bindplanev1alpha1.PodTemplateSpec{
+			PodTemplateSpec: corev1.PodTemplateSpec{
+				Spec: corev1.PodSpec{
+					Containers: []corev1.Container{
+						{
+							Name: nodeContainerName,
+							Args: []string{"--something-else"},
+						},
+					},
+				},
+			},
+		}
+		container := r.nodeDeployment(bp).Spec.Template.Spec.Containers[0]
+		Expect(container.Args).To(Equal([]string{skipSeedArg}))
+	})
+})