refactor: remove hardcoded constants

Author: maltesander

rust/operator-binary/src/controller/build/authentication/ldap.rs

@@ -10,17 +10,19 @@ use super::{
     AddLdapVolumesSnafu, ConstructLdapEndpointUrlSnafu, Error, MissingLdapBindCredentialsSnafu,
 };
 use crate::crd::{
-    file_reference,
-    security::{STACKABLE_TLS_DIR, TLS_STORE_PASSWORD, add_cert_to_trust_store_cmd},
+    STACKABLE_TRUST_STORE_PASSWORD, file_reference,
+    security::{STACKABLE_TLS_DIR, add_cert_to_trust_store_cmd},
 };
 
+const LDAP_AUTHORIZER: &str = "LdapAuthorizer";
+
 fn add_authenticator_config(
     provider: &ldap::v1alpha1::AuthenticationProvider,
     config: &mut BTreeMap<String, String>,
 ) -> Result<(), Error> {
     config.insert(
         "druid.auth.authenticator.Ldap.type".to_string(),
-        "basic".to_string(),
+        super::AUTHENTICATOR_TYPE_BASIC.to_string(),
     );
     config.insert(
         "druid.auth.authenticator.Ldap.enableCacheNotifications".to_string(),
@@ -65,7 +67,7 @@ fn add_authenticator_config(
     );
     config.insert(
         "druid.auth.authenticator.Ldap.authorizerName".to_string(),
-        "LdapAuthorizer".to_string(),
+        LDAP_AUTHORIZER.to_string(),
     );
     super::set_authenticator_chain(config, &["Ldap"]);
 
@@ -77,7 +79,7 @@ pub(super) fn generate_runtime_properties_config(
     config: &mut BTreeMap<String, String>,
 ) -> Result<(), Error> {
     add_authenticator_config(provider, config)?;
-    super::add_authorizer_config(config, "LdapAuthorizer");
+    super::add_authorizer_config(config, LDAP_AUTHORIZER);
 
     Ok(())
 }
@@ -90,7 +92,7 @@ pub(super) fn prepare_container_commands(
         command.extend(add_cert_to_trust_store_cmd(
             &tls_ca_cert_mount_path,
             STACKABLE_TLS_DIR,
-            TLS_STORE_PASSWORD,
+            STACKABLE_TRUST_STORE_PASSWORD,
         ))
     }
 }

rust/operator-binary/src/controller/build/authentication/mod.rs

@@ -26,6 +26,15 @@ pub mod oidc;
 // It seems this needs to be the same password for Druid to work, so we re-use the existing env variable.
 const ESCALATOR_INTERNAL_CLIENT_PASSWORD_ENV: &str = INTERNAL_INITIAL_CLIENT_PASSWORD_ENV;
 
+// Authorizer/authenticator names and types used in the Druid runtime.properties auth config.
+// These are shared across the LDAP and OIDC providers (in the child modules).
+const DRUID_SYSTEM_AUTHORIZER: &str = "DruidSystemAuthorizer";
+const DRUID_SYSTEM_AUTHENTICATOR: &str = "DruidSystemAuthenticator";
+/// The `allowAll` authorizer type.
+const AUTHORIZER_TYPE_ALLOW_ALL: &str = "allowAll";
+/// The `basic` authenticator/escalator type.
+const AUTHENTICATOR_TYPE_BASIC: &str = "basic";
+
 type Result<T, E = Error> = std::result::Result<T, E>;
 
 #[derive(Snafu, Debug)]
@@ -61,11 +70,11 @@ pub enum Error {
 fn add_authorizer_config(config: &mut BTreeMap<String, String>, authorizer_name: &str) {
     config.insert(
         "druid.auth.authorizers".to_string(),
-        format!(r#"["{authorizer_name}", "DruidSystemAuthorizer"]"#),
+        format!(r#"["{authorizer_name}", "{DRUID_SYSTEM_AUTHORIZER}"]"#),
     );
     config.insert(
         format!("druid.auth.authorizer.{authorizer_name}.type"),
-        "allowAll".to_string(),
+        AUTHORIZER_TYPE_ALLOW_ALL.to_string(),
     );
 }
 
@@ -75,7 +84,7 @@ fn set_authenticator_chain(
     config: &mut BTreeMap<String, String>,
     provider_authenticators: &[&str],
 ) {
-    let authenticators: Vec<String> = std::iter::once("DruidSystemAuthenticator")
+    let authenticators: Vec<String> = std::iter::once(DRUID_SYSTEM_AUTHENTICATOR)
         .chain(provider_authenticators.iter().copied())
         .map(|name| format!("\"{name}\""))
         .collect();
@@ -114,7 +123,7 @@ fn generate_common_runtime_properties_config(config: &mut BTreeMap<String, Strin
 
     config.insert(
         "druid.auth.authorizer.DruidSystemAuthorizer.type".to_string(),
-        r#"allowAll"#.to_string(),
+        AUTHORIZER_TYPE_ALLOW_ALL.to_string(),
     );
 }
 
@@ -177,7 +186,7 @@ pub fn add_volumes_and_mounts(
 fn add_druid_system_authenticator_config(config: &mut BTreeMap<String, String>) {
     config.insert(
         "druid.auth.authenticator.DruidSystemAuthenticator.type".to_string(),
-        "basic".to_string(),
+        AUTHENTICATOR_TYPE_BASIC.to_string(),
     );
     config.insert(
         "druid.auth.authenticator.DruidSystemAuthenticator.credentialsValidator.type".to_string(),
@@ -191,7 +200,7 @@ fn add_druid_system_authenticator_config(config: &mut BTreeMap<String, String>)
     );
     config.insert(
         "druid.auth.authenticator.DruidSystemAuthenticator.authorizerName".to_string(),
-        "DruidSystemAuthorizer".to_string(),
+        DRUID_SYSTEM_AUTHORIZER.to_string(),
     );
     config.insert(
         "druid.auth.authenticator.DruidSystemAuthenticator.skipOnFailure".to_string(),
@@ -202,7 +211,10 @@ fn add_druid_system_authenticator_config(config: &mut BTreeMap<String, String>)
 /// Creates the escalator config: <https://druid.apache.org/docs/latest/operations/auth/#escalator>.
 /// This configures Druid processes to use the basic auth authentication added in `add_druid_system_authenticator_config` for internal communication.
 fn add_escalator_config(config: &mut BTreeMap<String, String>) {
-    config.insert("druid.escalator.type".to_string(), "basic".to_string());
+    config.insert(
+        "druid.escalator.type".to_string(),
+        AUTHENTICATOR_TYPE_BASIC.to_string(),
+    );
     config.insert(
         "druid.escalator.internalClientUsername".to_string(),
         "druid_system".to_string(),
@@ -213,7 +225,7 @@ fn add_escalator_config(config: &mut BTreeMap<String, String>) {
     );
     config.insert(
         "druid.escalator.authorizerName".to_string(),
-        "DruidSystemAuthorizer".to_string(),
+        DRUID_SYSTEM_AUTHORIZER.to_string(),
     );
 }
 

rust/operator-binary/src/controller/build/authentication/oidc.rs

@@ -17,6 +17,8 @@ use crate::{
     internal_secret::env_var_from_secret,
 };
 
+const OIDC_AUTHORIZER: &str = "OidcAuthorizer";
+
 /// Creates OIDC authenticator config using the pac4j extension for Druid: <https://druid.apache.org/docs/latest/development/extensions-core/druid-pac4j>.
 fn add_authenticator_config(
     provider: &oidc::v1alpha1::AuthenticationProvider,
@@ -41,7 +43,7 @@ fn add_authenticator_config(
     );
     config.insert(
         "druid.auth.authenticator.Oidc.authorizerName".to_string(),
-        r#"OidcAuthorizer"#.to_string(),
+        OIDC_AUTHORIZER.to_string(),
     );
     config.insert(
         "druid.auth.pac4j.cookiePassphrase".to_string(),
@@ -94,7 +96,7 @@ pub(super) fn generate_runtime_properties_config(
         }
         _ => {
             add_authenticator_config(provider, oidc, config)?;
-            super::add_authorizer_config(config, "OidcAuthorizer");
+            super::add_authorizer_config(config, OIDC_AUTHORIZER);
         }
     }
     Ok(())

rust/operator-binary/src/controller/build/security.rs

@@ -30,10 +30,8 @@ use stackable_operator::{
 };
 
 use crate::crd::{
-    DruidRole,
-    security::{
-        DruidTlsSecurity, PLAINTEXT_PORT_NAME, STACKABLE_TLS_DIR, TLS_PORT_NAME, TLS_STORE_PASSWORD,
-    },
+    DruidRole, STACKABLE_TRUST_STORE_PASSWORD, STACKABLE_TRUST_STORE_TYPE,
+    security::{DruidTlsSecurity, PLAINTEXT_PORT_NAME, STACKABLE_TLS_DIR, TLS_PORT_NAME},
 };
 
 #[derive(Snafu, Debug)]
@@ -85,8 +83,9 @@ const TLS_ALIAS_NAME: &str = "1";
 const AUTH_TRUST_STORE_PATH: &str = "druid.auth.basic.ssl.trustStorePath";
 const AUTH_TRUST_STORE_TYPE: &str = "druid.auth.basic.ssl.trustStoreType";
 const AUTH_TRUST_STORE_PASSWORD: &str = "druid.auth.basic.ssl.trustStorePassword";
-// Misc TLS
-const TLS_STORE_TYPE: &str = "pkcs12";
+// PKCS12 store file names (within the TLS store directory).
+const TRUST_STORE_FILE: &str = "truststore.p12";
+const KEY_STORE_FILE: &str = "keystore.p12";
 
 // directories
 const STACKABLE_MOUNT_TLS_DIR: &str = "/stackable/mount_tls";
@@ -162,7 +161,7 @@ pub fn add_tls_volume_and_volume_mounts(
         secret_volume_source_builder
             .with_pod_scope()
             .with_format(SecretFormat::TlsPkcs12)
-            .with_tls_pkcs12_password(TLS_STORE_PASSWORD)
+            .with_tls_pkcs12_password(STACKABLE_TRUST_STORE_PASSWORD)
             .with_auto_tls_cert_lifetime(*requested_secret_lifetime);
 
         if let Some(listener_scope) = &listener_scope {
@@ -254,10 +253,13 @@ fn add_pkcs12_store_properties(
         path_property.to_string(),
         format!("{store_directory}/{store_file}"),
     );
-    config.insert(type_property.to_string(), TLS_STORE_TYPE.to_string());
+    config.insert(
+        type_property.to_string(),
+        STACKABLE_TRUST_STORE_TYPE.to_string(),
+    );
     config.insert(
         password_property.to_string(),
-        TLS_STORE_PASSWORD.to_string(),
+        STACKABLE_TRUST_STORE_PASSWORD.to_string(),
     );
 }
 
@@ -271,7 +273,7 @@ fn add_tls_encryption_config_properties(
     add_pkcs12_store_properties(
         config,
         store_directory,
-        "truststore.p12",
+        TRUST_STORE_FILE,
         CLIENT_HTTPS_TRUST_STORE_PATH,
         CLIENT_HTTPS_TRUST_STORE_TYPE,
         CLIENT_HTTPS_TRUST_STORE_PASSWORD,
@@ -280,7 +282,7 @@ fn add_tls_encryption_config_properties(
     add_pkcs12_store_properties(
         config,
         store_directory,
-        "keystore.p12",
+        KEY_STORE_FILE,
         SERVER_HTTPS_KEY_STORE_PATH,
         SERVER_HTTPS_KEY_STORE_TYPE,
         SERVER_HTTPS_KEY_STORE_PASSWORD,
@@ -292,7 +294,7 @@ fn add_tls_encryption_config_properties(
     add_pkcs12_store_properties(
         config,
         store_directory,
-        "truststore.p12",
+        TRUST_STORE_FILE,
         AUTH_TRUST_STORE_PATH,
         AUTH_TRUST_STORE_TYPE,
         AUTH_TRUST_STORE_PASSWORD,
@@ -307,7 +309,7 @@ fn add_tls_auth_config_properties(
     add_pkcs12_store_properties(
         config,
         store_directory,
-        "keystore.p12",
+        KEY_STORE_FILE,
         CLIENT_HTTPS_KEY_STORE_PATH,
         CLIENT_HTTPS_KEY_STORE_TYPE,
         CLIENT_HTTPS_KEY_STORE_PASSWORD,
@@ -319,7 +321,7 @@ fn add_tls_auth_config_properties(
     // javax.crypto.BadPaddingException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.
     config.insert(
         CLIENT_HTTPS_KEY_MANAGER_PASSWORD.to_string(),
-        TLS_STORE_PASSWORD.to_string(),
+        STACKABLE_TRUST_STORE_PASSWORD.to_string(),
     );
     config.insert(CLIENT_HTTPS_CERT_ALIAS.to_string(), store_alias.to_string());
     // FIXME: https://github.com/stackabletech/druid-operator/issues/372
@@ -338,7 +340,7 @@ fn add_tls_auth_config_properties(
     add_pkcs12_store_properties(
         config,
         store_directory,
-        "truststore.p12",
+        TRUST_STORE_FILE,
         SERVER_HTTPS_TRUST_STORE_PATH,
         SERVER_HTTPS_TRUST_STORE_TYPE,
         SERVER_HTTPS_TRUST_STORE_PASSWORD,
@@ -350,7 +352,7 @@ fn add_tls_auth_config_properties(
     // javax.crypto.BadPaddingException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.
     config.insert(
         SERVER_HTTPS_KEY_MANAGER_PASSWORD.to_string(),
-        TLS_STORE_PASSWORD.to_string(),
+        STACKABLE_TRUST_STORE_PASSWORD.to_string(),
     );
     // FIXME: https://github.com/stackabletech/druid-operator/issues/372
     // This is required because the client will send its pod ip which is not in the SANs of the certificates
@@ -369,10 +371,12 @@ pub fn build_tls_key_stores_cmd(tls: &DruidTlsSecurity) -> Vec<String> {
         // FIXME: *Technically* we should only add the system truststore in case any webPki usage is detected,
         // wether that's in S3, LDAP, OIDC, FTE or whatnot.
         format!(
-            "cert-tools generate-pkcs12-truststore --pkcs12 '{STACKABLE_MOUNT_TLS_DIR}/truststore.p12:{TLS_STORE_PASSWORD}' --pem /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem --out {STACKABLE_TLS_DIR}/truststore.p12 --out-password '{TLS_STORE_PASSWORD}'"
+            "cert-tools generate-pkcs12-truststore --pkcs12 '{STACKABLE_MOUNT_TLS_DIR}/{TRUST_STORE_FILE}:{STACKABLE_TRUST_STORE_PASSWORD}' --pem /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem --out {STACKABLE_TLS_DIR}/{TRUST_STORE_FILE} --out-password '{STACKABLE_TRUST_STORE_PASSWORD}'"
         ),
         // We can copy the keystore as is.
-        format!("cp {STACKABLE_MOUNT_TLS_DIR}/keystore.p12 {STACKABLE_TLS_DIR}/keystore.p12"),
+        format!(
+            "cp {STACKABLE_MOUNT_TLS_DIR}/{KEY_STORE_FILE} {STACKABLE_TLS_DIR}/{KEY_STORE_FILE}"
+        ),
     ]
 }
 

rust/operator-binary/src/crd/security.rs

@@ -19,7 +19,6 @@ pub const PLAINTEXT_PORT_NAME: &str = "http";
 pub const TLS_PORT_NAME: &str = "https";
 
 // Misc TLS (shared with the build-side renderer and the LDAP authentication module)
-pub const TLS_STORE_PASSWORD: &str = "changeit";
 pub const STACKABLE_TLS_DIR: &str = "/stackable/tls";
 
 pub const INTERNAL_INITIAL_CLIENT_PASSWORD_ENV: &str = "INTERNAL_INITIAL_CLIENT_PASSWORD";