refactor: extract dereference and validate steps into controller modules

Move external-reference resolution (product image, ZooKeeper, OPA) into
controller/dereference.rs and product-config validation with config
merging into controller/validate.rs. The reconciler now calls
dereference → validate as an explicit pipeline, matching the pattern
established in the airflow and hive operators.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: adwk67

rust/operator-binary/src/controller/dereference.rs

@@ -0,0 +1,60 @@
+use snafu::{ResultExt, Snafu};
+use stackable_operator::commons::product_image_selection::{self, ResolvedProductImage};
+
+use crate::{
+    crd::v1alpha1, security::opa::HbaseOpaConfig, zookeeper::ZookeeperConnectionInformation,
+};
+
+#[derive(Snafu, Debug)]
+pub enum Error {
+    #[snafu(display("failed to resolve product image"))]
+    ResolveProductImage {
+        source: product_image_selection::Error,
+    },
+
+    #[snafu(display("failed to retrieve zookeeper connection information"))]
+    RetrieveZookeeperConnectionInformation { source: crate::zookeeper::Error },
+
+    #[snafu(display("invalid OPA configuration"))]
+    InvalidOpaConfig { source: crate::security::opa::Error },
+}
+
+/// External references resolved during the dereference step.
+pub struct DereferencedObjects {
+    pub resolved_product_image: ResolvedProductImage,
+    pub zookeeper_connection_information: ZookeeperConnectionInformation,
+    pub hbase_opa_config: Option<HbaseOpaConfig>,
+}
+
+pub async fn dereference(
+    client: &stackable_operator::client::Client,
+    hbase: &v1alpha1::HbaseCluster,
+    image_base_name: &str,
+    image_repository: &str,
+    pkg_version: &str,
+) -> Result<DereferencedObjects, Error> {
+    let resolved_product_image = hbase
+        .spec
+        .image
+        .resolve(image_base_name, image_repository, pkg_version)
+        .context(ResolveProductImageSnafu)?;
+
+    let zookeeper_connection_information = ZookeeperConnectionInformation::retrieve(hbase, client)
+        .await
+        .context(RetrieveZookeeperConnectionInformationSnafu)?;
+
+    let hbase_opa_config = match &hbase.spec.cluster_config.authorization {
+        Some(opa_config) => Some(
+            HbaseOpaConfig::from_opa_config(client, hbase, opa_config)
+                .await
+                .context(InvalidOpaConfigSnafu)?,
+        ),
+        None => None,
+    };
+
+    Ok(DereferencedObjects {
+        resolved_product_image,
+        zookeeper_connection_information,
+        hbase_opa_config,
+    })
+}

rust/operator-binary/src/controller/mod.rs

@@ -0,0 +1,2 @@
+pub mod dereference;
+pub mod validate;

rust/operator-binary/src/controller/validate.rs

@@ -0,0 +1,124 @@
+use std::{
+    collections::{BTreeMap, HashMap},
+    str::FromStr,
+};
+
+use product_config::{ProductConfigManager, types::PropertyNameKind};
+use snafu::{ResultExt, Snafu};
+use stackable_operator::{
+    commons::product_image_selection::ResolvedProductImage,
+    product_config_utils::{transform_all_roles_to_config, validate_all_roles_and_groups_config},
+    role_utils::GenericRoleConfig,
+};
+
+use super::dereference::DereferencedObjects;
+use crate::crd::{AnyServiceConfig, HbaseRole, v1alpha1};
+
+#[derive(Snafu, Debug)]
+pub enum Error {
+    #[snafu(display("invalid role properties"))]
+    RoleProperties { source: crate::crd::Error },
+
+    #[snafu(display("failed to generate product config"))]
+    GenerateProductConfig {
+        source: stackable_operator::product_config_utils::Error,
+    },
+
+    #[snafu(display("invalid product config"))]
+    InvalidProductConfig {
+        source: stackable_operator::product_config_utils::Error,
+    },
+
+    #[snafu(display("could not parse Hbase role [{role}]"))]
+    UnidentifiedHbaseRole {
+        source: strum::ParseError,
+        role: String,
+    },
+
+    #[snafu(display("failed to resolve and merge config for role and role group"))]
+    FailedToResolveConfig { source: crate::crd::Error },
+}
+
+/// Per-role configuration extracted during validation.
+#[derive(Clone, Debug)]
+pub struct ValidatedRoleConfig {
+    pub pdb: stackable_operator::commons::pdb::PdbConfig,
+}
+
+/// Per-rolegroup configuration: the merged CRD config plus the product-config properties.
+#[derive(Clone, Debug)]
+pub struct ValidatedRoleGroupConfig {
+    pub merged_config: AnyServiceConfig,
+    pub product_config_properties: HashMap<PropertyNameKind, BTreeMap<String, String>>,
+}
+
+/// The validated cluster: proves that product-config validation and config merging
+/// succeeded for every role and role group before any resources are created.
+#[derive(Clone, Debug)]
+pub struct ValidatedHbaseCluster {
+    pub image: ResolvedProductImage,
+    pub role_groups: BTreeMap<HbaseRole, BTreeMap<String, ValidatedRoleGroupConfig>>,
+    pub role_configs: BTreeMap<HbaseRole, ValidatedRoleConfig>,
+}
+
+pub fn validate_cluster(
+    hbase: &v1alpha1::HbaseCluster,
+    dereferenced: &DereferencedObjects,
+    product_config_manager: &ProductConfigManager,
+) -> Result<ValidatedHbaseCluster, Error> {
+    let roles = hbase.build_role_properties().context(RolePropertiesSnafu)?;
+
+    let validated_config = validate_all_roles_and_groups_config(
+        &dereferenced.resolved_product_image.app_version_label_value,
+        &transform_all_roles_to_config(hbase, &roles).context(GenerateProductConfigSnafu)?,
+        product_config_manager,
+        false,
+        false,
+    )
+    .context(InvalidProductConfigSnafu)?;
+
+    let mut role_groups = BTreeMap::new();
+    let mut role_configs = BTreeMap::new();
+
+    for (role_name, group_config) in validated_config.iter() {
+        let hbase_role = HbaseRole::from_str(role_name).context(UnidentifiedHbaseRoleSnafu {
+            role: role_name.to_string(),
+        })?;
+
+        if let Some(GenericRoleConfig {
+            pod_disruption_budget: pdb,
+        }) = hbase.role_config(&hbase_role)
+        {
+            role_configs.insert(hbase_role.clone(), ValidatedRoleConfig { pdb: pdb.clone() });
+        }
+
+        let mut group_configs = BTreeMap::new();
+        for (rolegroup_name, rolegroup_config) in group_config.iter() {
+            let rolegroup = hbase.server_rolegroup_ref(role_name, rolegroup_name);
+
+            let merged_config = hbase
+                .merged_config(
+                    &hbase_role,
+                    &rolegroup.role_group,
+                    &hbase.spec.cluster_config.hdfs_config_map_name,
+                )
+                .context(FailedToResolveConfigSnafu)?;
+
+            group_configs.insert(
+                rolegroup_name.clone(),
+                ValidatedRoleGroupConfig {
+                    merged_config,
+                    product_config_properties: rolegroup_config.clone(),
+                },
+            );
+        }
+
+        role_groups.insert(hbase_role, group_configs);
+    }
+
+    Ok(ValidatedHbaseCluster {
+        image: dereferenced.resolved_product_image.clone(),
+        role_groups,
+        role_configs,
+    })
+}

rust/operator-binary/src/crd/mod.rs

@@ -623,7 +623,9 @@ pub fn merged_env(rolegroup_config: Option<&BTreeMap<String, String>>) -> Vec<En
     Eq,
     Hash,
     JsonSchema,
+    Ord,
     PartialEq,
+    PartialOrd,
     Serialize,
     EnumString,
 )]
@@ -1253,6 +1255,7 @@ pub struct HbaseClusterStatus {
     pub conditions: Vec<ClusterCondition>,
 }
 
+#[derive(Clone, Debug)]
 pub enum AnyServiceConfig {
     Master(HbaseConfig),
     RegionServer(RegionServerConfig),