fix: make opaconfig optional, rename logging module, document listener ephemeral API

maltesander · maltesander · commit aad5110fac9a · 2026-06-17T22:13:28.000+02:00
diff --git a/extra/crds.yaml b/extra/crds.yaml
@@ -68,6 +68,7 @@ spec:
                           and the name of the Rego package containing your authorization rules.
                           Consult the [OPA authorization documentation](https://docs.stackable.tech/home/nightly/concepts/opa)
                           to learn how to deploy Rego authorization rules with OPA.
+                        nullable: true
                         properties:
                           configMapName:
                             description: |-
@@ -81,8 +82,6 @@ spec:
                         required:
                         - configMapName
                         type: object
-                    required:
-                    - opa
                     type: object
                   hdfsConfigMapName:
                     description: |-
diff --git a/rust/operator-binary/src/controller/build/opa.rs b/rust/operator-binary/src/controller/build/opa.rs
@@ -1,7 +1,10 @@
 use snafu::{ResultExt, Snafu};
-use stackable_operator::{client::Client, commons::opa::OpaApiVersion};
+use stackable_operator::{
+    client::Client,
+    commons::opa::{OpaApiVersion, OpaConfig},
+};
 
-use crate::crd::{security::AuthorizationConfig, v1alpha1};
+use crate::crd::v1alpha1;
 
 const DEFAULT_DRY_RUN: bool = false;
 const DEFAULT_CACHE_ACTIVE: bool = true;
@@ -51,10 +54,9 @@ impl HbaseOpaConfig {
     pub async fn from_opa_config(
         client: &Client,
         hbase: &v1alpha1::HbaseCluster,
-        authorization_config: &AuthorizationConfig,
+        opa_config: &OpaConfig,
     ) -> Result<Self> {
-        let authorization_connection_string = authorization_config
-            .opa
+        let authorization_connection_string = opa_config
             .full_document_url_from_config_map(client, hbase, Some("allow"), &OpaApiVersion::V1)
             .await
             .context(ConstructOpaEndpointForAuthorizerSnafu)?;
diff --git a/rust/operator-binary/src/controller/build/properties/mod.rs b/rust/operator-binary/src/controller/build/properties/mod.rs
@@ -11,7 +11,7 @@ use stackable_operator::v2::{
 
 pub mod hbase_env;
 pub mod hbase_site;
-pub mod logging;
+pub mod product_logging;
 pub mod security_properties;
 pub mod ssl_client;
 pub mod ssl_server;
diff --git a/rust/operator-binary/src/controller/build/properties/product_logging/mod.rs b/rust/operator-binary/src/controller/build/properties/product_logging/mod.rs
diff --git a/rust/operator-binary/src/controller/build/properties/product_logging/test-vector.sh b/rust/operator-binary/src/controller/build/properties/product_logging/test-vector.sh
diff --git a/rust/operator-binary/src/controller/build/properties/product_logging/vector-test.yaml b/rust/operator-binary/src/controller/build/properties/product_logging/vector-test.yaml
diff --git a/rust/operator-binary/src/controller/build/properties/product_logging/vector.yaml b/rust/operator-binary/src/controller/build/properties/product_logging/vector.yaml
diff --git a/rust/operator-binary/src/controller/build/resource/config_map.rs b/rust/operator-binary/src/controller/build/resource/config_map.rs
@@ -16,8 +16,8 @@ use crate::{
             jvm::construct_role_specific_non_heap_jvm_args,
             kerberos,
             properties::{
-                ConfigFileName, hbase_env, hbase_site, logging, security_properties, ssl_client,
-                ssl_server,
+                ConfigFileName, hbase_env, hbase_site, product_logging, security_properties,
+                ssl_client, ssl_server,
             },
         },
     },
@@ -136,11 +136,16 @@ pub fn build_rolegroup_config_map(
         builder.add_data(ConfigFileName::SslClient.to_string(), ssl_client_xml);
     }
 
-    if let Some(log4j2_properties) = logging::build_log4j2(&rg.config.logging.hbase_container) {
+    if let Some(log4j2_properties) =
+        product_logging::build_log4j2(&rg.config.logging.hbase_container)
+    {
         builder.add_data(ConfigFileName::Log4j2.to_string(), log4j2_properties);
     }
     if rg.config.logging.enable_vector_agent {
-        builder.add_data(VECTOR_CONFIG_FILE, logging::vector_config_file_content());
+        builder.add_data(
+            VECTOR_CONFIG_FILE,
+            product_logging::vector_config_file_content(),
+        );
     }
 
     builder.build().with_context(|_| AssembleSnafu {
diff --git a/rust/operator-binary/src/controller/build/resource/listener.rs b/rust/operator-binary/src/controller/build/resource/listener.rs
@@ -51,6 +51,12 @@ pub fn build_listener_volume(
         HbaseRole::Master | HbaseRole::RegionServer => Some(
             VolumeBuilder::new(LISTENER_VOLUME_NAME)
                 .ephemeral(
+                    // The v2 framework only exposes a PVC builder
+                    // (`listener_operator_volume_source_builder_build_pvc`, used by
+                    // `build_listener_pvc`), so the ephemeral case still uses the legacy
+                    // `ListenerOperatorVolumeSourceBuilder` and its stringly-typed
+                    // `ListenerReference`. We keep the typed `listener_class()` and convert to a
+                    // `String` only at this boundary; switch to a v2 helper once one exists.
                     ListenerOperatorVolumeSourceBuilder::new(
                         &ListenerReference::ListenerClass(
                             merged_config.listener_class().to_string(),
diff --git a/rust/operator-binary/src/controller/build/resource/statefulset.rs b/rust/operator-binary/src/controller/build/resource/statefulset.rs
@@ -40,7 +40,7 @@ use crate::{
         build::{
             graceful_shutdown::{self, add_graceful_shutdown_config},
             kerberos::{self, add_kerberos_pod_config},
-            properties::logging::{MAX_HBASE_LOG_FILES_SIZE, STACKABLE_LOG_DIR},
+            properties::product_logging::{MAX_HBASE_LOG_FILES_SIZE, STACKABLE_LOG_DIR},
         },
     },
     crd::{CONFIG_DIR_NAME, HbaseRole, LISTENER_VOLUME_DIR, LISTENER_VOLUME_NAME},
diff --git a/rust/operator-binary/src/controller/dereference.rs b/rust/operator-binary/src/controller/dereference.rs
@@ -32,7 +32,13 @@ pub async fn dereference(
         .await
         .context(RetrieveZookeeperConnectionInformationSnafu)?;
 
-    let hbase_opa_config = match &hbase.spec.cluster_config.authorization {
+    let hbase_opa_config = match hbase
+        .spec
+        .cluster_config
+        .authorization
+        .as_ref()
+        .and_then(|authorization| authorization.opa.as_ref())
+    {
         Some(opa_config) => Some(
             HbaseOpaConfig::from_opa_config(client, hbase, opa_config)
                 .await
diff --git a/rust/operator-binary/src/crd/security.rs b/rust/operator-binary/src/crd/security.rs
@@ -32,5 +32,26 @@ pub struct KerberosConfig {
 #[serde(rename_all = "camelCase")]
 pub struct AuthorizationConfig {
     // No doc - it's in the struct.
-    pub opa: OpaConfig,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub opa: Option<OpaConfig>,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn authorization_without_opa_is_valid() {
+        // `opa` is optional (matching the hive template), so an empty `authorization` deserializes.
+        let config: AuthorizationConfig = serde_yaml::from_str("{}").expect("empty authorization");
+        assert!(config.opa.is_none());
+    }
+
+    #[test]
+    fn authorization_with_opa_is_parsed() {
+        let yaml = ["opa:", "  configMapName: my-opa", "  package: hbase"].join("\n");
+        let config: AuthorizationConfig =
+            serde_yaml::from_str(&yaml).expect("authorization with opa");
+        assert!(config.opa.is_some());
+    }
 }
diff --git a/rust/operator-binary/src/main.rs b/rust/operator-binary/src/main.rs
@@ -200,10 +200,11 @@ fn references_config_map(
         .to_string()
         == config_map.name_any()
         || hbase.spec.cluster_config.hdfs_config_map_name.to_string() == config_map.name_any()
-        || match &hbase.spec.cluster_config.authorization {
-            Some(hbase_authorization) => {
-                hbase_authorization.opa.config_map_name == config_map.name_any()
-            }
-            None => false,
-        }
+        || hbase
+            .spec
+            .cluster_config
+            .authorization
+            .as_ref()
+            .and_then(|authorization| authorization.opa.as_ref())
+            .is_some_and(|opa| opa.config_map_name == config_map.name_any())
 }
