refactor: split auth class resolve to fetch & validate

Author: maltesander

rust/operator-binary/src/controller/dereference.rs

@@ -1,19 +1,22 @@
 //! The dereference step in the DruidCluster controller
 //!
 //! Fetches all Kubernetes objects referenced by the DruidCluster spec and returns them in
-//! [`DereferencedObjects`]. The helpers called here (`AuthenticationClassesResolved::from`,
-//! `DruidCluster::get_s3_connection`, `S3Bucket::resolve`,
-//! `OpaConfig::full_document_url_from_config_map`) currently mix fetching and validation;
-//! their outputs are treated as "dereferenced" for now. Splitting those helpers is a
-//! follow-up.
+//! [`DereferencedObjects`]. AuthenticationClasses are fetched raw here
+//! ([`fetch_authentication_classes`]) and validated later in the validate step. The remaining
+//! helpers (`DruidCluster::get_s3_connection`, `S3Bucket::resolve`,
+//! `OpaConfig::full_document_url_from_config_map`) still mix fetching and validation; their
+//! outputs are treated as "dereferenced" for now. Splitting those is a follow-up.
 
 use snafu::{OptionExt, ResultExt, Snafu};
 use stackable_operator::{
-    client::Client, commons::opa::OpaApiVersion, crd::s3, k8s_openapi::api::core::v1::ConfigMap,
+    client::Client,
+    commons::opa::OpaApiVersion,
+    crd::{authentication::core, s3},
+    k8s_openapi::api::core::v1::ConfigMap,
 };
 
 use crate::crd::{
-    DeepStorageSpec, authentication::AuthenticationClassesResolved,
+    DeepStorageSpec, authentication::fetch_authentication_classes,
     authorization::DruidAuthorization, v1alpha1,
 };
 
@@ -70,7 +73,9 @@ pub struct DereferencedObjects {
     pub opa_connection_string: Option<String>,
     pub s3_connection: Option<s3::v1alpha1::ConnectionSpec>,
     pub deep_storage_bucket_name: Option<String>,
-    pub resolved_authentication_classes: AuthenticationClassesResolved,
+    /// The raw, fetched `AuthenticationClass` objects (in spec order). Validation of these happens
+    /// in the validate step via [`AuthenticationClassesResolved::from_fetched`].
+    pub authentication_classes: Vec<core::v1alpha1::AuthenticationClass>,
 }
 
 /// Fetches all Kubernetes objects referenced from the [`v1alpha1::DruidCluster`] spec.
@@ -134,16 +139,15 @@ pub async fn dereference(
         _ => None,
     };
 
-    let resolved_authentication_classes =
-        AuthenticationClassesResolved::from(&druid.spec.cluster_config, client)
-            .await
-            .context(AuthenticationClassRetrievalSnafu)?;
+    let authentication_classes = fetch_authentication_classes(&druid.spec.cluster_config, client)
+        .await
+        .context(AuthenticationClassRetrievalSnafu)?;
 
     Ok(DereferencedObjects {
         zookeeper_connection_string,
         opa_connection_string,
         s3_connection,
         deep_storage_bucket_name,
-        resolved_authentication_classes,
+        authentication_classes,
     })
 }

rust/operator-binary/src/controller/validate.rs

@@ -40,8 +40,8 @@ use crate::{
     authentication::DruidAuthenticationConfig,
     controller::{controller_name, dereference::DereferencedObjects, operator_name, product_name},
     crd::{
-        DeepStorageSpec, DruidRole, database::MetadataDatabaseConnection,
-        security::DruidTlsSecurity, v1alpha1,
+        DeepStorageSpec, DruidRole, authentication::AuthenticationClassesResolved,
+        database::MetadataDatabaseConnection, security::DruidTlsSecurity, v1alpha1,
     },
 };
 
@@ -65,6 +65,11 @@ pub enum Error {
     InvalidMetadataDatabaseConnection {
         source: stackable_operator::database_connections::Error,
     },
+
+    #[snafu(display("failed to resolve authentication classes"))]
+    ResolveAuthenticationClasses {
+        source: crate::crd::authentication::Error,
+    },
 }
 
 type Result<T, E = Error> = std::result::Result<T, E>;
@@ -323,14 +328,17 @@ pub fn validate(
         )
         .context(ResolveProductImageSnafu)?;
 
-    let druid_tls_security = DruidTlsSecurity::new_from_druid_cluster(
-        druid,
-        &dereferenced_objects.resolved_authentication_classes,
-    );
+    let resolved_authentication_classes = AuthenticationClassesResolved::from_fetched(
+        &druid.spec.cluster_config,
+        &dereferenced_objects.authentication_classes,
+    )
+    .context(ResolveAuthenticationClassesSnafu)?;
+
+    let druid_tls_security =
+        DruidTlsSecurity::new_from_druid_cluster(druid, &resolved_authentication_classes);
 
-    let druid_auth_config = DruidAuthenticationConfig::from_auth_classes(
-        dereferenced_objects.resolved_authentication_classes.clone(),
-    );
+    let druid_auth_config =
+        DruidAuthenticationConfig::from_auth_classes(resolved_authentication_classes);
 
     let mut role_group_configs: BTreeMap<DruidRole, BTreeMap<RoleGroupName, DruidRoleGroupConfig>> =
         BTreeMap::new();
@@ -539,10 +547,7 @@ mod tests {
         test_support::{MINIMAL_DRUID_YAML, druid_from_yaml},
         validate,
     };
-    use crate::{
-        controller::dereference::DereferencedObjects,
-        crd::{DruidRole, authentication::AuthenticationClassesResolved},
-    };
+    use crate::{controller::dereference::DereferencedObjects, crd::DruidRole};
 
     /// Dereferenced inputs with test defaults: no S3, no OPA, no auth, a fixed ZooKeeper string.
     fn dereferenced_objects() -> DereferencedObjects {
@@ -551,9 +556,7 @@ mod tests {
             opa_connection_string: None,
             s3_connection: None,
             deep_storage_bucket_name: None,
-            resolved_authentication_classes: AuthenticationClassesResolved {
-                auth_classes: Vec::new(),
-            },
+            authentication_classes: Vec::new(),
         }
     }