refactor: merge and move webserver config & envars to controller/build

Author: maltesander

rust/operator-binary/src/config/webserver_config.rs

@@ -15,11 +15,11 @@ use stackable_operator::{
 };
 
 use crate::{
-    config::webserver_config,
     controller::{
         ValidatedCluster, ValidatedLogging,
-        build::properties::product_logging::{
-            LOG_CONFIG_FILE, create_airflow_config, vector_config_file_content,
+        build::properties::{
+            product_logging::{LOG_CONFIG_FILE, create_airflow_config, vector_config_file_content},
+            webserver_config,
         },
     },
     crd::{AIRFLOW_CONFIG_FILENAME, AirflowConfigOverrides, Container, STACKABLE_LOG_DIR},

rust/operator-binary/src/controller/build/config_map.rs

@@ -1,3 +1,6 @@
-//! Renders the config files (logging, …) assembled into the rolegroup `ConfigMap`.
+//! Renders the config files (`webserver_config.py`, env vars, logging, …) assembled into the
+//! rolegroup `ConfigMap`.
 
+pub mod env_vars;
 pub mod product_logging;
+pub mod webserver_config;

rust/operator-binary/src/env_vars.rs …/controller/build/properties/env_vars.rsrust/operator-binary/src/env_vars.rs renamed to rust/operator-binary/src/controller/build/properties/env_vars.rs rust/operator-binary/src/env_vars.rs renamed to rust/operator-binary/src/controller/build/properties/env_vars.rs

@@ -1,30 +1,40 @@
-pub mod webserver_config;
+//! Builds the `webserver_config.py` Flask configuration file from the resolved
+//! authentication/authorization config plus user-provided config overrides.
 
-use std::collections::BTreeMap;
+use std::{collections::BTreeMap, io::Write};
 
 use indoc::formatdoc;
 use snafu::{ResultExt, Snafu};
 use stackable_operator::{
     commons::tls_verification::TlsVerification,
     crd::authentication::{ldap, oidc},
+    v2::flask_config_writer,
 };
 
-use crate::crd::{
-    AirflowConfigOptions,
-    authentication::{
-        AirflowAuthenticationClassResolved, AirflowClientAuthenticationDetailsResolved,
-        DEFAULT_OIDC_PROVIDER, FlaskRolesSyncMoment,
+use crate::{
+    controller::ValidatedCluster,
+    crd::{
+        AirflowConfigOptions,
+        authentication::{
+            AirflowAuthenticationClassResolved, AirflowClientAuthenticationDetailsResolved,
+            DEFAULT_OIDC_PROVIDER, FlaskRolesSyncMoment,
+        },
+        authorization::AirflowAuthorizationResolved,
     },
-    authorization::AirflowAuthorizationResolved,
 };
 
-pub const PYTHON_IMPORTS: &[&str] = &[
+const PYTHON_IMPORTS: &[&str] = &[
     "import os",
     "from flask_appbuilder.const import (AUTH_DB, AUTH_LDAP, AUTH_OAUTH, AUTH_REMOTE_USER)",
     "basedir = os.path.abspath(os.path.dirname(__file__))",
     "WTF_CSRF_ENABLED = True",
 ];
 
+/// Marks arbitrary Python code to prepend verbatim to the generated file.
+const CONFIG_OVERRIDE_FILE_HEADER_KEY: &str = "FILE_HEADER";
+/// Marks arbitrary Python code to append verbatim to the generated file.
+const CONFIG_OVERRIDE_FILE_FOOTER_KEY: &str = "FILE_FOOTER";
+
 type Result<T, E = Error> = std::result::Result<T, E>;
 
 #[derive(Snafu, Debug)]
@@ -37,6 +47,57 @@ pub enum Error {
 
     #[snafu(display("invalid well-known OIDC configuration URL"))]
     InvalidWellKnownConfigUrl { source: oidc::v1alpha1::Error },
+
+    #[snafu(display("failed to write the webserver config file"))]
+    WriteConfigFile {
+        source: flask_config_writer::FlaskAppConfigWriterError,
+    },
+
+    #[snafu(display("failed to write the header/footer to the webserver config file"))]
+    WriteHeaderFooter { source: std::io::Error },
+}
+
+/// Renders the `webserver_config.py` contents: operator defaults (derived from the
+/// resolved authentication/authorization config) with the user's `config_overrides`
+/// applied last, wrapped by the optional `FILE_HEADER`/`FILE_FOOTER` Python blocks.
+pub fn build(
+    validated_cluster: &ValidatedCluster,
+    config_file_overrides: &BTreeMap<String, String>,
+) -> Result<String, Error> {
+    // this will call default values from AirflowClientAuthenticationDetails
+    let mut config = build_airflow_config(
+        &validated_cluster.cluster_config.authentication_config,
+        &validated_cluster.cluster_config.authorization_config,
+        &validated_cluster.image.product_version,
+    )?;
+
+    let mut file_config = config_file_overrides.clone();
+
+    // now add any overrides, replacing any defaults
+    config.append(&mut file_config);
+
+    let mut config_file = Vec::new();
+
+    // By removing the keys from `config`, we avoid pasting the Python code into a Python variable as well
+    // (which would be bad)
+    if let Some(header) = config.remove(CONFIG_OVERRIDE_FILE_HEADER_KEY) {
+        writeln!(config_file, "{}", header).context(WriteHeaderFooterSnafu)?;
+    }
+
+    let temp_file_footer: Option<String> = config.remove(CONFIG_OVERRIDE_FILE_FOOTER_KEY);
+
+    flask_config_writer::write::<AirflowConfigOptions, _, _>(
+        &mut config_file,
+        config.iter(),
+        PYTHON_IMPORTS,
+    )
+    .context(WriteConfigFileSnafu)?;
+
+    if let Some(footer) = temp_file_footer {
+        writeln!(config_file, "{}", footer).context(WriteHeaderFooterSnafu)?;
+    }
+
+    Ok(String::from_utf8(config_file).expect("the Flask config writer only emits valid UTF-8"))
 }
 
 /// Builds the operator-default `webserver_config.py` entries derived from the resolved
@@ -322,15 +383,13 @@ mod tests {
         shared::time::Duration,
     };
 
-    use crate::{
-        config::build_airflow_config,
-        crd::{
-            authentication::{
-                AirflowAuthenticationClassResolved, AirflowClientAuthenticationDetailsResolved,
-                FlaskRolesSyncMoment, default_user_registration,
-            },
-            authorization::{AirflowAuthorizationResolved, OpaConfigResolved},
+    use super::build_airflow_config;
+    use crate::crd::{
+        authentication::{
+            AirflowAuthenticationClassResolved, AirflowClientAuthenticationDetailsResolved,
+            FlaskRolesSyncMoment, default_user_registration,
         },
+        authorization::{AirflowAuthorizationResolved, OpaConfigResolved},
     };
 
     const TEST_AIRFLOW_VERSION: &str = "3.0.6";

rust/operator-binary/src/controller/build/properties/mod.rs

@@ -27,6 +27,7 @@ use crate::{
         ValidatedCluster, ValidatedLogging,
         build::{
             graceful_shutdown::add_graceful_shutdown_config,
+            properties::env_vars::build_airflow_template_envs,
             resource::pod::{
                 add_authentication_volumes_and_volume_mounts, add_git_sync_resources,
                 build_logging_container,
@@ -37,11 +38,9 @@ use crate::{
     crd::{
         CONFIG_PATH, Container, ExecutorConfig, LOG_CONFIG_DIR, STACKABLE_LOG_DIR, TEMPLATE_NAME,
     },
-    env_vars::build_airflow_template_envs,
 };
 
 #[derive(Snafu, Debug)]
-#[snafu(visibility(pub(crate)))]
 pub enum Error {
     #[snafu(display("invalid container name"))]
     InvalidContainerName {

rust/operator-binary/src/config/mod.rs …ler/build/properties/webserver_config.rsrust/operator-binary/src/config/mod.rs renamed to rust/operator-binary/src/controller/build/properties/webserver_config.rs rust/operator-binary/src/config/mod.rs renamed to rust/operator-binary/src/controller/build/properties/webserver_config.rs

@@ -33,6 +33,7 @@ use crate::{
         AirflowRoleGroupConfig, ValidatedCluster, ValidatedLogging,
         build::{
             graceful_shutdown::add_graceful_shutdown_config,
+            properties::env_vars,
             resource::{
                 pod::{
                     add_authentication_volumes_and_volume_mounts, add_git_sync_resources,
@@ -48,7 +49,6 @@ use crate::{
         LISTENER_VOLUME_NAME, LOG_CONFIG_DIR, METRICS_PORT, METRICS_PORT_NAME, STACKABLE_LOG_DIR,
         TEMPLATE_LOCATION, TEMPLATE_VOLUME_NAME,
     },
-    env_vars,
 };
 
 #[derive(Snafu, Debug)]

rust/operator-binary/src/controller/build/resource/executor.rs

@@ -39,11 +39,9 @@ use crate::{
 };
 
 mod airflow_controller;
-mod config;
 mod controller;
 mod controller_commons;
 mod crd;
-mod env_vars;
 mod util;
 mod webhooks;