refactor: remove raw cluster references from k8s resources

Author: maltesander

rust/operator-binary/src/controller/build/kerberos.rs

@@ -16,7 +16,10 @@ use stackable_operator::{
     utils::cluster_info::KubernetesClusterInfo,
 };
 
-use crate::crd::{TLS_STORE_DIR, TLS_STORE_PASSWORD, TLS_STORE_VOLUME_NAME, v1alpha1};
+use crate::{
+    controller::ValidatedCluster,
+    crd::{TLS_STORE_DIR, TLS_STORE_PASSWORD, TLS_STORE_VOLUME_NAME, v1alpha1},
+};
 
 /// Mount path of the Kerberos secret volume (keytab + `krb5.conf`).
 pub const STACKABLE_KERBEROS_DIR: &str = "/stackable/kerberos";
@@ -177,20 +180,20 @@ pub fn kerberos_ssl_client_settings(hbase: &v1alpha1::HbaseCluster) -> BTreeMap<
 }
 
 pub fn add_kerberos_pod_config(
-    hbase: &v1alpha1::HbaseCluster,
+    cluster: &ValidatedCluster,
     metrics_service_name: &str,
     cb: &mut ContainerBuilder,
     pb: &mut PodBuilder,
     requested_secret_lifetime: Duration,
 ) -> Result<(), Error> {
-    if let Some(kerberos_secret_class) = hbase.kerberos_secret_class() {
+    if let Some(kerberos_secret_class) = cluster.cluster_config.kerberos_secret_class.clone() {
         // Mount keytab
         let kerberos_secret_operator_volume = SecretOperatorVolumeSourceBuilder::new(
             kerberos_secret_class,
             // We need both public (krb5.conf) and private (keytab) parts.
             SecretClassVolumeProvisionParts::PublicPrivate,
         )
-        .with_service_scope(hbase.name_any())
+        .with_service_scope(cluster.name.to_string())
         .with_kerberos_service_name(kerberos_service_name())
         .with_kerberos_service_name("HTTP")
         .build()
@@ -208,7 +211,7 @@ pub fn add_kerberos_pod_config(
         cb.add_env_var("KRB5_CONFIG", KRB5_CONFIG_PATH);
     }
 
-    if let Some(https_secret_class) = hbase.https_secret_class() {
+    if let Some(https_secret_class) = cluster.cluster_config.https_secret_class.clone() {
         // Mount TLS keystore
         pb.add_volume(
             VolumeBuilder::new(TLS_STORE_VOLUME_NAME)

rust/operator-binary/src/controller/build/resource/service.rs

@@ -7,7 +7,7 @@ use stackable_operator::{
 
 use crate::{
     controller::{RoleGroupName, ValidatedCluster},
-    crd::{HbaseRole, v1alpha1},
+    crd::HbaseRole,
 };
 
 /// The rolegroup [`Service`] is a headless service that allows direct access to the instances of a
@@ -16,13 +16,12 @@ use crate::{
 /// This is mostly useful for internal communication between peers, or for clients that perform
 /// client-side load balancing.
 pub fn build_rolegroup_service(
-    hbase: &v1alpha1::HbaseCluster,
     cluster: &ValidatedCluster,
     hbase_role: &HbaseRole,
     role_group_name: &RoleGroupName,
 ) -> Service {
     let ports = hbase_role
-        .ports(hbase)
+        .ports(cluster.has_https_enabled())
         .into_iter()
         .map(|(name, value)| ServicePort {
             name: Some(name),
@@ -63,7 +62,6 @@ pub fn build_rolegroup_service(
 /// The rolegroup metrics [`Service`] is a service that exposes metrics and a prometheus scraping
 /// label.
 pub fn build_rolegroup_metrics_service(
-    hbase: &v1alpha1::HbaseCluster,
     cluster: &ValidatedCluster,
     hbase_role: &HbaseRole,
     role_group_name: &RoleGroupName,
@@ -86,7 +84,10 @@ pub fn build_rolegroup_metrics_service(
                 role_group_name,
             )
             .with_labels(prometheus_labels())
-            .with_annotations(prometheus_annotations(hbase, hbase_role))
+            .with_annotations(prometheus_annotations(
+                cluster.has_https_enabled(),
+                hbase_role,
+            ))
             .build(),
         spec: Some(ServiceSpec {
             // Internal communication does not need to be exposed
@@ -115,7 +116,7 @@ fn prometheus_labels() -> Labels {
 /// These annotations can be used in a ServiceMonitor.
 ///
 /// see also <https://github.com/prometheus-community/helm-charts/blob/prometheus-27.32.0/charts/prometheus/values.yaml#L983-L1036>
-fn prometheus_annotations(hbase: &v1alpha1::HbaseCluster, hbase_role: &HbaseRole) -> Annotations {
+fn prometheus_annotations(https_enabled: bool, hbase_role: &HbaseRole) -> Annotations {
     Annotations::try_from([
         ("prometheus.io/path".to_owned(), "/prometheus".to_owned()),
         (
@@ -124,7 +125,7 @@ fn prometheus_annotations(hbase: &v1alpha1::HbaseCluster, hbase_role: &HbaseRole
         ),
         (
             "prometheus.io/scheme".to_owned(),
-            if hbase.has_https_enabled() {
+            if https_enabled {
                 "https".to_owned()
             } else {
                 "http".to_owned()
@@ -143,50 +144,13 @@ mod test {
     use crate::test_utils;
 
     #[rstest]
-    #[case("2.6.3", HbaseRole::Master, vec!["master", "ui-http"])]
-    #[case("2.6.3", HbaseRole::RegionServer, vec!["regionserver", "ui-http"])]
-    #[case("2.6.3", HbaseRole::RestServer, vec!["rest-http", "ui-http"])]
-    #[case("2.6.4", HbaseRole::Master, vec!["master", "ui-http"])]
-    #[case("2.6.4", HbaseRole::RegionServer, vec!["regionserver", "ui-http"])]
-    #[case("2.6.4", HbaseRole::RestServer, vec!["rest-http", "ui-http"])]
-    fn test_rolegroup_service_ports(
-        #[case] hbase_version: &str,
-        #[case] role: HbaseRole,
-        #[case] expected_ports: Vec<&str>,
-    ) {
-        let input = format!(
-            "
-        apiVersion: hbase.stackable.tech/v1alpha1
-        kind: HbaseCluster
-        metadata:
-          name: hbase
-          uid: c2e98fc1-6b88-4d11-9381-52530e3f431e
-        spec:
-          image:
-            productVersion: {hbase_version}
-          clusterConfig:
-            hdfsConfigMapName: simple-hdfs
-            zookeeperConfigMapName: simple-znode
-          masters:
-            roleGroups:
-              default:
-                replicas: 1
-          regionServers:
-            roleGroups:
-              default:
-                replicas: 1
-          restServers:
-            roleGroups:
-              default:
-                replicas: 1
-        "
-        );
-        let hbase: v1alpha1::HbaseCluster =
-            serde_yaml::from_str(&input).expect("illegal test input");
-
+    #[case(HbaseRole::Master, vec!["master", "ui-http"])]
+    #[case(HbaseRole::RegionServer, vec!["regionserver", "ui-http"])]
+    #[case(HbaseRole::RestServer, vec!["rest-http", "ui-http"])]
+    fn test_rolegroup_service_ports(#[case] role: HbaseRole, #[case] expected_ports: Vec<&str>) {
         let cluster = test_utils::validated_cluster();
         let role_group_name = test_utils::role_group_name("default");
-        let service = build_rolegroup_service(&hbase, &cluster, &role, &role_group_name);
+        let service = build_rolegroup_service(&cluster, &role, &role_group_name);
 
         assert_eq!(
             expected_ports,

rust/operator-binary/src/controller/build/resource/statefulset.rs

@@ -43,7 +43,7 @@ use crate::{
             properties::logging::{MAX_HBASE_LOG_FILES_SIZE, STACKABLE_LOG_DIR},
         },
     },
-    crd::{CONFIG_DIR_NAME, HbaseRole, LISTENER_VOLUME_DIR, LISTENER_VOLUME_NAME, v1alpha1},
+    crd::{CONFIG_DIR_NAME, HbaseRole, LISTENER_VOLUME_DIR, LISTENER_VOLUME_NAME},
 };
 
 stackable_operator::constant!(VECTOR_CONTAINER_NAME: ContainerName = "vector");
@@ -98,7 +98,6 @@ type Result<T, E = Error> = std::result::Result<T, E>;
 /// The [`Pod`](stackable_operator::k8s_openapi::api::core::v1::Pod)s are accessible through the
 /// corresponding headless [`Service`](stackable_operator::k8s_openapi::api::core::v1::Service).
 pub fn build_rolegroup_statefulset(
-    hbase: &v1alpha1::HbaseCluster,
     cluster: &ValidatedCluster,
     hbase_role: &HbaseRole,
     role_group_name: &RoleGroupName,
@@ -109,9 +108,10 @@ pub fn build_rolegroup_statefulset(
     let merged_config = &validated_rg_config.config.config;
     let logging = &validated_rg_config.config.logging;
     let resource_names = cluster.resource_names(hbase_role, role_group_name);
+    let https_enabled = cluster.has_https_enabled();
 
     let ports = hbase_role
-        .ports(hbase)
+        .ports(https_enabled)
         .into_iter()
         .map(|(name, value)| ContainerPort {
             name: Some(name),
@@ -123,7 +123,7 @@ pub fn build_rolegroup_statefulset(
 
     let probe_template = Probe {
         tcp_socket: Some(TCPSocketAction {
-            port: IntOrString::String(hbase_role.data_port_name(hbase)),
+            port: IntOrString::String(hbase_role.data_port_name(https_enabled)),
             ..TCPSocketAction::default()
         }),
         ..Probe::default()
@@ -185,8 +185,8 @@ pub fn build_rolegroup_statefulset(
             entrypoint = "/stackable/hbase/bin/hbase-entrypoint.sh".to_string(),
             role = role_name,
             port = hbase_role.data_port(),
-            port_name = hbase_role.data_port_name(hbase),
-            ui_port_name = HbaseRole::ui_port_name(hbase.has_https_enabled()),
+            port_name = hbase_role.data_port_name(https_enabled),
+            ui_port_name = HbaseRole::ui_port_name(https_enabled),
         }])
         .add_env_vars(merged_env)
         // Needed for the `containerdebug` process to log it's tracing information to.
@@ -234,7 +234,7 @@ pub fn build_rolegroup_statefulset(
         .add_volume(Volume {
             name: HDFS_DISCOVERY_VOLUME_NAME.to_string(),
             config_map: Some(ConfigMapVolumeSource {
-                name: hbase.spec.cluster_config.hdfs_config_map_name.clone(),
+                name: cluster.cluster_config.hdfs_config_map_name.clone(),
                 ..Default::default()
             }),
             ..Default::default()
@@ -273,7 +273,7 @@ pub fn build_rolegroup_statefulset(
     add_graceful_shutdown_config(merged_config, &mut pod_builder).context(GracefulShutdownSnafu)?;
     if cluster.has_kerberos_enabled() {
         add_kerberos_pod_config(
-            hbase,
+            cluster,
             resource_names.metrics_service_name().as_ref(),
             &mut hbase_container,
             &mut pod_builder,

rust/operator-binary/src/controller/mod.rs

@@ -185,6 +185,11 @@ impl ValidatedCluster {
     pub fn has_kerberos_enabled(&self) -> bool {
         self.cluster_config.kerberos_enabled
     }
+
+    /// Whether HTTPS is enabled for this cluster.
+    pub fn has_https_enabled(&self) -> bool {
+        self.cluster_config.https_enabled
+    }
 }
 
 impl Resource for ValidatedCluster {
@@ -240,6 +245,14 @@ pub struct ValidatedClusterConfig {
     // Pre-resolved OPA connection configuration.
     pub hbase_opa_config: Option<HbaseOpaConfig>,
     pub kerberos_enabled: bool,
+    /// Whether HTTPS is enabled (a TLS `SecretClass` was configured).
+    pub https_enabled: bool,
+    /// The Kerberos `SecretClass` name, if Kerberos is enabled.
+    pub kerberos_secret_class: Option<String>,
+    /// The HTTPS/TLS `SecretClass` name, if HTTPS is enabled.
+    pub https_secret_class: Option<String>,
+    /// The HDFS discovery ConfigMap name the cluster connects to.
+    pub hdfs_config_map_name: String,
     // Pre-resolved kerberos properties for hbase-site.xml (empty when kerberos is disabled).
     pub hbase_site_kerberos_config: BTreeMap<String, String>,
     // Pre-resolved kerberos properties for the discovery `hbase-site.xml` exposed to clients

rust/operator-binary/src/controller/validate.rs

@@ -243,6 +243,10 @@ pub fn validate_cluster(
             zookeeper_connection_information: dereferenced_objects.zookeeper_connection_information,
             hbase_opa_config: dereferenced_objects.hbase_opa_config,
             kerberos_enabled: hbase.has_kerberos_enabled(),
+            https_enabled: hbase.has_https_enabled(),
+            kerberos_secret_class: hbase.kerberos_secret_class(),
+            https_secret_class: hbase.https_secret_class(),
+            hdfs_config_map_name: hbase.spec.cluster_config.hdfs_config_map_name.clone(),
             hbase_site_kerberos_config,
             discovery_kerberos_config,
             ssl_server_settings,

rust/operator-binary/src/crd/mod.rs

@@ -361,11 +361,11 @@ impl HbaseRole {
     ///
     /// Hbase versions 2.6.* will have two ports for each role. The metrics are available on the
     /// UI port.
-    pub fn ports(&self, hbase: &v1alpha1::HbaseCluster) -> Vec<(String, u16)> {
+    pub fn ports(&self, https_enabled: bool) -> Vec<(String, u16)> {
         vec![
-            (self.data_port_name(hbase), self.data_port()),
+            (self.data_port_name(https_enabled), self.data_port()),
             (
-                Self::ui_port_name(hbase.has_https_enabled()).to_string(),
+                Self::ui_port_name(https_enabled).to_string(),
                 self.ui_port(),
             ),
         ]
@@ -379,11 +379,11 @@ impl HbaseRole {
         }
     }
 
-    pub fn data_port_name(&self, hbase: &v1alpha1::HbaseCluster) -> String {
+    pub fn data_port_name(&self, https_enabled: bool) -> String {
         match self {
             HbaseRole::Master | HbaseRole::RegionServer => self.to_string(),
             HbaseRole::RestServer => {
-                if hbase.has_https_enabled() {
+                if https_enabled {
                     HBASE_REST_PORT_NAME_HTTPS.to_owned()
                 } else {
                     HBASE_REST_PORT_NAME_HTTP.to_owned()

rust/operator-binary/src/hbase_controller.rs

@@ -205,20 +205,15 @@ pub async fn reconcile_hbase(
     for (hbase_role, role_group_configs) in &validated_cluster.role_group_configs {
         for (role_group_name, validated_rg_config) in role_group_configs {
             let rg_service =
-                build_rolegroup_service(hbase, &validated_cluster, hbase_role, role_group_name);
+                build_rolegroup_service(&validated_cluster, hbase_role, role_group_name);
 
-            let rg_metrics_service = build_rolegroup_metrics_service(
-                hbase,
-                &validated_cluster,
-                hbase_role,
-                role_group_name,
-            );
+            let rg_metrics_service =
+                build_rolegroup_metrics_service(&validated_cluster, hbase_role, role_group_name);
 
             let rg_configmap =
                 build_rolegroup_config_map(&validated_cluster, hbase_role, role_group_name)
                     .context(BuildRolegroupConfigMapSnafu)?;
             let rg_statefulset = build_rolegroup_statefulset(
-                hbase,
                 &validated_cluster,
                 hbase_role,
                 role_group_name,