refactor: consolidate tls secruity module to build

Author: maltesander

rust/operator-binary/src/controller/build/mod.rs

@@ -20,3 +20,4 @@ pub mod graceful_shutdown;
 pub mod jvm;
 pub mod properties;
 pub mod resource;
+pub mod security;

rust/operator-binary/src/controller/build/resource/config_map.rs

@@ -32,6 +32,7 @@ use crate::{
                 product_logging::{build_log4j2, vector_config_file_content},
                 runtime_properties, security_properties,
             },
+            security::add_tls_config_properties,
         },
         validate::{DruidRoleGroupConfig, ValidatedCluster},
     },
@@ -252,7 +253,7 @@ pub fn build_rolegroup_config_map(
         );
 
         // add tls encryption / auth properties
-        druid_tls_security.add_tls_config_properties(&mut conf, role);
+        add_tls_config_properties(druid_tls_security, &mut conf, role);
 
         if let Some(auth_config) = druid_auth_config {
             conf.extend(

rust/operator-binary/src/controller/build/resource/listener.rs

@@ -14,7 +14,10 @@ use stackable_operator::{
 };
 
 use crate::{
-    controller::{build::PLACEHOLDER_LISTENER_ROLE_GROUP, validate::ValidatedCluster},
+    controller::{
+        build::{PLACEHOLDER_LISTENER_ROLE_GROUP, security::listener_ports},
+        validate::ValidatedCluster,
+    },
     crd::{
         DruidRole,
         security::{DruidTlsSecurity, PLAINTEXT_PORT_NAME, TLS_PORT_NAME},
@@ -54,12 +57,10 @@ pub fn build_group_listener(
             .build(),
         spec: listener::v1alpha1::ListenerSpec {
             class_name: Some(listener_class),
-            ports: Some(
-                cluster
-                    .cluster_config
-                    .druid_tls_security
-                    .listener_ports(druid_role),
-            ),
+            ports: Some(listener_ports(
+                &cluster.cluster_config.druid_tls_security,
+                druid_role,
+            )),
             ..listener::v1alpha1::ListenerSpec::default()
         },
         status: None,

rust/operator-binary/src/controller/build/resource/service.rs

@@ -5,7 +5,7 @@ use stackable_operator::{
 };
 
 use crate::{
-    controller::validate::ValidatedCluster,
+    controller::{build::security::service_ports, validate::ValidatedCluster},
     crd::{DruidRole, METRICS_PORT, METRICS_PORT_NAME},
 };
 
@@ -31,12 +31,10 @@ pub fn build_rolegroup_headless_service(
             // Internal communication does not need to be exposed
             type_: Some("ClusterIP".to_string()),
             cluster_ip: Some("None".to_string()),
-            ports: Some(
-                cluster
-                    .cluster_config
-                    .druid_tls_security
-                    .service_ports(druid_role),
-            ),
+            ports: Some(service_ports(
+                &cluster.cluster_config.druid_tls_security,
+                druid_role,
+            )),
             selector: Some(
                 cluster
                     .role_group_selector(druid_role, role_group_name)

rust/operator-binary/src/controller/build/resource/statefulset.rs

@@ -45,6 +45,10 @@ use crate::{
                 LISTENER_VOLUME_DIR, LISTENER_VOLUME_NAME, build_group_listener_pvc,
                 group_listener_name, secret_volume_listener_scope,
             },
+            security::{
+                add_tls_volume_and_volume_mounts, build_tls_key_stores_cmd, container_ports,
+                get_tcp_socket_probe,
+            },
         },
         validate::{DruidRoleGroupConfig, ValidatedCluster},
     },
@@ -78,7 +82,9 @@ pub enum Error {
     },
 
     #[snafu(display("failed to initialize security context"))]
-    FailedToInitializeSecurityContext { source: crate::crd::security::Error },
+    FailedToInitializeSecurityContext {
+        source: crate::controller::build::security::Error,
+    },
 
     #[snafu(display(
         "Druid does not support skipping the verification of the tls enabled S3 server"
@@ -156,7 +162,7 @@ pub fn build_rolegroup_statefulset(
             log_config,
         ));
     }
-    prepare_container_commands.extend(druid_tls_security.build_tls_key_stores_cmd());
+    prepare_container_commands.extend(build_tls_key_stores_cmd(druid_tls_security));
 
     if let Some(auth_config) = druid_auth_config {
         auth_config
@@ -167,16 +173,16 @@ pub fn build_rolegroup_statefulset(
     }
 
     // volume and volume mounts
-    druid_tls_security
-        .add_tls_volume_and_volume_mounts(
-            &mut cb_prepare,
-            &mut cb_druid,
-            &mut pb,
-            &merged_rolegroup_config.requested_secret_lifetime,
-            // add listener
-            secret_volume_listener_scope(role),
-        )
-        .context(FailedToInitializeSecurityContextSnafu)?;
+    add_tls_volume_and_volume_mounts(
+        druid_tls_security,
+        &mut cb_prepare,
+        &mut cb_druid,
+        &mut pb,
+        &merged_rolegroup_config.requested_secret_lifetime,
+        // add listener
+        secret_volume_listener_scope(role),
+    )
+    .context(FailedToInitializeSecurityContextSnafu)?;
 
     if let Some(s3) = s3_conn {
         if s3.tls.uses_tls() && !s3.tls.uses_tls_verification() {
@@ -251,14 +257,14 @@ pub fn build_rolegroup_statefulset(
         ])
         .args(vec![main_container_commands.join("\n")])
         .add_env_vars(rest_env)
-        .add_container_ports(druid_tls_security.container_ports(role))
+        .add_container_ports(container_ports(druid_tls_security, role))
         .add_container_port(METRICS_PORT_NAME, METRICS_PORT.into())
         // 10s * 30 = 300s to come up
-        .startup_probe(druid_tls_security.get_tcp_socket_probe(30, 10, 30, 3))
+        .startup_probe(get_tcp_socket_probe(druid_tls_security, 30, 10, 30, 3))
         // 10s * 1 = 10s to get removed from service
-        .readiness_probe(druid_tls_security.get_tcp_socket_probe(10, 10, 1, 3))
+        .readiness_probe(get_tcp_socket_probe(druid_tls_security, 10, 10, 1, 3))
         // 10s * 3 = 30s to be restarted
-        .liveness_probe(druid_tls_security.get_tcp_socket_probe(10, 10, 3, 3))
+        .liveness_probe(get_tcp_socket_probe(druid_tls_security, 10, 10, 3, 3))
         .resources(merged_rolegroup_config.resources.as_resource_requirements());
 
     // Add extra mounts if any are specified and the current role is MiddleManager