refactor: use ConfigMapName, SecretName, ListenerName in CRD

Author: maltesander

extra/crds.yaml

@@ -1273,6 +1273,9 @@ spec:
                       The name of the Secret object containing the admin user credentials. Read the
                       [getting started guide first steps](https://docs.stackable.tech/home/nightly/airflow/getting_started/first_steps)
                       to find out more.
+                    maxLength: 253
+                    minLength: 1
+                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                     type: string
                   dagsGitSync:
                     default: []
@@ -1494,7 +1497,10 @@ spec:
                       It must contain the key `ADDRESS` with the address of the Vector aggregator.
                       Follow the [logging tutorial](https://docs.stackable.tech/home/nightly/tutorials/logging-vector-aggregator)
                       to learn how to configure log aggregation with Vector.
+                    maxLength: 253
+                    minLength: 1
                     nullable: true
+                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                     type: string
                   volumeMounts:
                     default: []
@@ -5587,6 +5593,9 @@ spec:
                       listenerClass:
                         default: cluster-internal
                         description: This field controls which [ListenerClass](https://docs.stackable.tech/home/nightly/listener-operator/listenerclass.html) is used to expose the webserver.
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                         type: string
                       podDisruptionBudget:
                         default:
@@ -7419,6 +7428,9 @@ spec:
                       The name of the Secret object containing the admin user credentials. Read the
                       [getting started guide first steps](https://docs.stackable.tech/home/nightly/airflow/getting_started/first_steps)
                       to find out more.
+                    maxLength: 253
+                    minLength: 1
+                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                     type: string
                   dagsGitSync:
                     default: []
@@ -7616,7 +7628,10 @@ spec:
                       It must contain the key `ADDRESS` with the address of the Vector aggregator.
                       Follow the [logging tutorial](https://docs.stackable.tech/home/nightly/tutorials/logging-vector-aggregator)
                       to learn how to configure log aggregation with Vector.
+                    maxLength: 253
+                    minLength: 1
                     nullable: true
+                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                     type: string
                   volumeMounts:
                     default: []
@@ -11709,6 +11724,9 @@ spec:
                       listenerClass:
                         default: cluster-internal
                         description: This field controls which [ListenerClass](https://docs.stackable.tech/home/nightly/listener-operator/listenerclass.html) is used to expose the webserver.
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                         type: string
                       podDisruptionBudget:
                         default:

rust/operator-binary/src/airflow_controller.rs

@@ -240,7 +240,7 @@ pub async fn reconcile_airflow(
 
     // TODO: Move secret creation to a dedicated apply step once it exists.
     random_secret_creation::create_random_secret_if_not_exists(
-        &validated_cluster.internal_secret_name(),
+        validated_cluster.internal_secret_name().as_ref(),
         INTERNAL_SECRET_SECRET_KEY,
         256,
         airflow,
@@ -250,7 +250,7 @@ pub async fn reconcile_airflow(
     .context(InternalSecretSnafu)?;
 
     random_secret_creation::create_random_secret_if_not_exists(
-        &validated_cluster.jwt_secret_name(),
+        validated_cluster.jwt_secret_name().as_ref(),
         JWT_SECRET_SECRET_KEY,
         256,
         airflow,
@@ -264,7 +264,7 @@ pub async fn reconcile_airflow(
     // python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
     // which returns `jUm21LuA76YZmrIa9u4eXRg0h0P24MDC9IDOmDvJbfw=`, which has 44 characters, which makes 32 bytes.
     random_secret_creation::create_random_secret_if_not_exists(
-        &validated_cluster.fernet_key_name(),
+        validated_cluster.fernet_key_name().as_ref(),
         FERNET_KEY_SECRET_KEY,
         32,
         airflow,
@@ -335,7 +335,7 @@ pub async fn reconcile_airflow(
                 let rg_group_listener = build_group_listener(
                     &validated_cluster,
                     airflow_role,
-                    listener_class.to_string(),
+                    listener_class.clone(),
                     listener_group_name.clone(),
                 );
                 cluster_resources

rust/operator-binary/src/controller/build/properties/env_vars.rs

@@ -118,7 +118,7 @@ pub fn build_airflow_statefulset_envs(
         "AIRFLOW__CORE__FERNET_KEY".into(),
         env_var_from_secret(
             "AIRFLOW__CORE__FERNET_KEY",
-            &cluster.fernet_key_name(),
+            cluster.fernet_key_name(),
             FERNET_KEY_SECRET_KEY,
         ),
     );
@@ -488,7 +488,7 @@ fn add_version_specific_env_vars(
             "AIRFLOW__API_AUTH__JWT_SECRET".into(),
             env_var_from_secret(
                 "AIRFLOW__API_AUTH__JWT_SECRET",
-                &cluster.jwt_secret_name(),
+                cluster.jwt_secret_name(),
                 JWT_SECRET_SECRET_KEY,
             ),
         );

rust/operator-binary/src/controller/build/resource/listener.rs

@@ -1,6 +1,10 @@
 use stackable_operator::{
-    builder::meta::ObjectMetaBuilder, crd::listener,
-    v2::builder::meta::ownerreference_from_resource,
+    builder::meta::ObjectMetaBuilder,
+    crd::listener,
+    v2::{
+        builder::meta::ownerreference_from_resource,
+        types::kubernetes::{ListenerClassName, ListenerName},
+    },
 };
 
 use crate::{
@@ -11,8 +15,8 @@ use crate::{
 pub fn build_group_listener(
     cluster: &ValidatedCluster,
     role: &AirflowRole,
-    listener_class: String,
-    listener_group_name: String,
+    listener_class: ListenerClassName,
+    listener_group_name: ListenerName,
 ) -> listener::v1alpha1::Listener {
     listener::v1alpha1::Listener {
         metadata: ObjectMetaBuilder::new()
@@ -27,7 +31,7 @@ pub fn build_group_listener(
             ))
             .build(),
         spec: listener::v1alpha1::ListenerSpec {
-            class_name: Some(listener_class),
+            class_name: Some(listener_class.to_string()),
             ports: Some(listener_ports()),
             ..listener::v1alpha1::ListenerSpec::default()
         },

rust/operator-binary/src/controller/build/resource/statefulset.rs

@@ -241,7 +241,7 @@ pub fn build_server_rolegroup_statefulset(
         // be the case even when no class is set (and the value defaults to
         // cluster-internal) as the address should still be consistent.
         let pvc = ListenerOperatorVolumeSourceBuilder::new(
-            &ListenerReference::ListenerName(listener_group_name),
+            &ListenerReference::ListenerName(listener_group_name.to_string()),
             &unversioned_recommended_labels,
         )
         .build_pvc(LISTENER_VOLUME_NAME.to_string())

rust/operator-binary/src/controller/mod.rs

@@ -15,7 +15,7 @@ use stackable_operator::{
         product_logging::framework::{ValidatedContainerLogConfigChoice, VectorContainerLogConfig},
         role_group_utils::ResourceNames,
         types::{
-            kubernetes::{ConfigMapName, Uid},
+            kubernetes::{ConfigMapName, ListenerClassName, ListenerName, SecretName, Uid},
             operator::{
                 ClusterName, ControllerName, OperatorName, ProductName, ProductVersion,
                 RoleGroupName, RoleName,
@@ -41,8 +41,8 @@ pub mod validate;
 #[derive(Clone, Debug)]
 pub struct ValidatedRoleConfig {
     pub pdb: Option<stackable_operator::commons::pdb::PdbConfig>,
-    pub listener_class: Option<String>,
-    pub group_listener_name: Option<String>,
+    pub listener_class: Option<ListenerClassName>,
+    pub group_listener_name: Option<ListenerName>,
 }
 
 /// Per-rolegroup configuration: the merged CRD config plus overrides.
@@ -91,7 +91,7 @@ pub struct ValidatedClusterConfig {
     pub authorization_config: AirflowAuthorizationResolved,
     /// The Git-sync definitions for the DAGs (`spec.clusterConfig.dagsGitSync`).
     pub dags_git_sync: Vec<git_sync::v1alpha2::GitSync>,
-    pub credentials_secret_name: String,
+    pub credentials_secret_name: SecretName,
     pub load_examples: bool,
     pub expose_config: bool,
     pub database_initialization_enabled: bool,
@@ -168,23 +168,27 @@ impl ValidatedCluster {
     }
 
     /// The Secret holding the shared internal secret (`<cluster>-internal-secret`).
-    pub fn internal_secret_name(&self) -> String {
-        format!("{}-internal-secret", self.name_any())
+    pub fn internal_secret_name(&self) -> SecretName {
+        SecretName::from_str(&format!("{}-internal-secret", self.name_any()))
+            .expect("the internal secret name is a valid Secret name")
     }
 
     /// The Secret holding the shared JWT secret (`<cluster>-jwt-secret`).
-    pub fn jwt_secret_name(&self) -> String {
-        format!("{}-jwt-secret", self.name_any())
+    pub fn jwt_secret_name(&self) -> SecretName {
+        SecretName::from_str(&format!("{}-jwt-secret", self.name_any()))
+            .expect("the JWT secret name is a valid Secret name")
     }
 
     /// The Secret holding the shared Fernet key (`<cluster>-fernet-key`).
-    pub fn fernet_key_name(&self) -> String {
-        format!("{}-fernet-key", self.name_any())
+    pub fn fernet_key_name(&self) -> SecretName {
+        SecretName::from_str(&format!("{}-fernet-key", self.name_any()))
+            .expect("the Fernet key secret name is a valid Secret name")
     }
 
     /// The ConfigMap holding the Kubernetes-executor pod template (`<cluster>-executor-pod-template`).
-    pub fn executor_template_configmap_name(&self) -> String {
-        format!("{}-executor-pod-template", self.name_any())
+    pub fn executor_template_configmap_name(&self) -> ConfigMapName {
+        ConfigMapName::from_str(&format!("{}-executor-pod-template", self.name_any()))
+            .expect("the executor pod-template ConfigMap name is a valid ConfigMap name")
     }
 
     /// User-supplied extra Volumes (`spec.clusterConfig.volumes`).

rust/operator-binary/src/controller/validate.rs

@@ -79,11 +79,6 @@ pub enum Error {
         "the Vector aggregator discovery ConfigMap name must be set when the Vector agent is enabled"
     ))]
     MissingVectorAggregatorConfigMapName,
-
-    #[snafu(display("invalid Vector aggregator discovery ConfigMap name"))]
-    ParseVectorAggregatorConfigMapName {
-        source: stackable_operator::v2::macros::attributed_string_type::Error,
-    },
 }
 
 pub fn validate_cluster(
@@ -106,9 +101,13 @@ pub fn validate_cluster(
             cluster_name: airflow.name_any(),
         })?;
 
-    // The Vector aggregator discovery ConfigMap name (validated here so an invalid name fails
-    // up-front). It is only required when the Vector agent is enabled for a role group.
-    let vector_aggregator_config_map_name = parse_vector_aggregator_config_map_name(airflow)?;
+    // The Vector aggregator discovery ConfigMap name. Validity is already enforced by the
+    // `ConfigMapName` type on the CRD; it is only required when the Vector agent is enabled.
+    let vector_aggregator_config_map_name = airflow
+        .spec
+        .cluster_config
+        .vector_aggregator_config_map_name
+        .clone();
 
     let mut role_groups = BTreeMap::new();
     let mut role_configs = BTreeMap::new();
@@ -126,7 +125,7 @@ pub fn validate_cluster(
                 pdb: airflow
                     .role_config(&role)
                     .map(|rc| rc.pod_disruption_budget),
-                listener_class: role.listener_class_name(airflow).map(|s| s.to_string()),
+                listener_class: role.listener_class_name(airflow),
                 group_listener_name: airflow.group_listener_name(&role),
             },
         );
@@ -293,21 +292,6 @@ fn validate_role_group(
     })
 }
 
-/// Parses the optional Vector aggregator discovery ConfigMap name from the cluster spec into a
-/// typed [`ConfigMapName`], so an invalid name fails reconciliation up-front.
-pub(crate) fn parse_vector_aggregator_config_map_name(
-    airflow: &v1alpha2::AirflowCluster,
-) -> Result<Option<ConfigMapName>, Error> {
-    airflow
-        .spec
-        .cluster_config
-        .vector_aggregator_config_map_name
-        .as_deref()
-        .map(ConfigMapName::from_str)
-        .transpose()
-        .context(ParseVectorAggregatorConfigMapNameSnafu)
-}
-
 /// Validates the logging configuration for the product container and the (optional) Vector
 /// container.
 ///

rust/operator-binary/src/crd/mod.rs

@@ -1,4 +1,4 @@
-use std::collections::BTreeSet;
+use std::{collections::BTreeSet, str::FromStr};
 
 use serde::{Deserialize, Serialize};
 use snafu::{ResultExt, Snafu};
@@ -40,6 +40,7 @@ use stackable_operator::{
         config_overrides::KeyValueConfigOverrides,
         flask_config_writer::{FlaskAppConfigOptions, PythonType},
         role_utils::GenericCommonConfig,
+        types::kubernetes::{ConfigMapName, ListenerClassName, ListenerName, SecretName},
     },
     versioned::versioned,
 };
@@ -264,7 +265,7 @@ pub mod versioned {
         /// The name of the Secret object containing the admin user credentials. Read the
         /// [getting started guide first steps](DOCS_BASE_URL_PLACEHOLDER/airflow/getting_started/first_steps)
         /// to find out more.
-        pub credentials_secret_name: String,
+        pub credentials_secret_name: SecretName,
 
         /// The `gitSync` settings allow configuring DAGs to mount via `git-sync`. Learn more in the
         /// [mounting DAGs documentation](DOCS_BASE_URL_PLACEHOLDER/airflow/usage-guide/mounting-dags#_via_git_sync).
@@ -301,7 +302,7 @@ pub mod versioned {
         /// Follow the [logging tutorial](DOCS_BASE_URL_PLACEHOLDER/tutorials/logging-vector-aggregator)
         /// to learn how to configure log aggregation with Vector.
         #[serde(skip_serializing_if = "Option::is_none")]
-        pub vector_aggregator_config_map_name: Option<String>,
+        pub vector_aggregator_config_map_name: Option<ConfigMapName>,
 
         /// Additional volumes to define. Use together with `volumeMounts` to mount the volumes.
         #[serde(default)]
@@ -322,7 +323,7 @@ pub mod versioned {
 
         /// This field controls which [ListenerClass](https://docs.stackable.tech/home/nightly/listener-operator/listenerclass.html) is used to expose the webserver.
         #[serde(default = "webserver_default_listener_class")]
-        pub listener_class: String,
+        pub listener_class: ListenerClassName,
     }
 }
 
@@ -357,8 +358,9 @@ impl Default for v1alpha2::WebserverRoleConfig {
     }
 }
 
-fn webserver_default_listener_class() -> String {
-    "cluster-internal".to_string()
+fn webserver_default_listener_class() -> ListenerClassName {
+    ListenerClassName::from_str("cluster-internal")
+        .expect("the default listener class is a valid listener class name")
 }
 
 #[derive(Clone, Debug, Default, Deserialize, JsonSchema, PartialEq, Eq, Serialize)]
@@ -381,9 +383,12 @@ impl v1alpha2::AirflowCluster {
     /// The name of the group-listener provided for a specific role.
     /// Webservers will use this group listener so that only one load balancer
     /// is needed for that role.
-    pub fn group_listener_name(&self, role: &AirflowRole) -> Option<String> {
+    pub fn group_listener_name(&self, role: &AirflowRole) -> Option<ListenerName> {
         match role {
-            AirflowRole::Webserver => Some(role_service_name(&self.name_any(), &role.to_string())),
+            AirflowRole::Webserver => Some(
+                ListenerName::from_str(&role_service_name(&self.name_any(), &role.to_string()))
+                    .expect("the group listener name is a valid Listener name"),
+            ),
             AirflowRole::Scheduler
             | AirflowRole::Worker
             | AirflowRole::DagProcessor
@@ -733,7 +738,10 @@ impl AirflowRole {
             .expect("an AirflowRole serialises to a valid RoleName")
     }
 
-    pub fn listener_class_name(&self, airflow: &v1alpha2::AirflowCluster) -> Option<String> {
+    pub fn listener_class_name(
+        &self,
+        airflow: &v1alpha2::AirflowCluster,
+    ) -> Option<ListenerClassName> {
         match self {
             Self::Webserver => airflow
                 .spec

rust/operator-binary/src/util.rs

@@ -1,11 +1,11 @@
 use stackable_operator::k8s_openapi::api::core::v1::{EnvVar, EnvVarSource, SecretKeySelector};
 
-pub fn env_var_from_secret(var_name: &str, secret: &str, secret_key: &str) -> EnvVar {
+pub fn env_var_from_secret(var_name: &str, secret: impl AsRef<str>, secret_key: &str) -> EnvVar {
     EnvVar {
         name: String::from(var_name),
         value_from: Some(EnvVarSource {
             secret_key_ref: Some(SecretKeySelector {
-                name: String::from(secret),
+                name: String::from(secret.as_ref()),
                 key: String::from(secret_key),
                 ..Default::default()
             }),