refactor: extract dereference/validate pipeline from reconcile_hbase (#757)

* refactor: extract dereference and validate steps into controller modules

Move external-reference resolution (product image, ZooKeeper, OPA) into
controller/dereference.rs and product-config validation with config
merging into controller/validate.rs. The reconciler now calls
dereference → validate as an explicit pipeline, matching the pattern
established in the airflow and hive operators.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: pass product_version instead of app_version_label_value to product config validation

The label-safe composite version string (e.g. "2.6.4-stackable24.7.0") is
not suitable for semver matching against fromVersion/asOfVersion constraints
in properties.yaml. Use the raw product_version consistently with all other
operators.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* refactor: move product image resolution from dereference to validate

Image resolution is a pure computation, not an I/O dereference, so it
belongs in validate_cluster alongside the other config validation. This
aligns with the pattern used by the trino and airflow operators.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* changelog

* linting

* use constant for image base name

* formatting

* move validated struct to controller, add dereferenced fields to validated cluster struct

* remove securityContext from assert (might not work on Openshift)

* refine assert

* replace version with compile-time constant

* use already-resolved hbase role

* nix update

* pass dereferenced struct rather than each field

* move related structs together in controller

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: adwk67

CHANGELOG.md

@@ -13,10 +13,12 @@
   `hbase-env.sh`, `ssl-server.xml`, `ssl-client.xml` and `security.properties`).
   Previously, arbitrary file names were silently accepted and ignored ([#751]).
 - Bump `stackable-operator` to 0.111.1 and snafu to 0.9 ([#751], [#752]).
+- Internal operator refactoring: introduce dereference() and validate() steps in the reconciler ([#757]).
 
 [#745]: https://github.com/stackabletech/hbase-operator/pull/745
 [#751]: https://github.com/stackabletech/hbase-operator/pull/751
 [#752]: https://github.com/stackabletech/hbase-operator/pull/752
+[#757]: https://github.com/stackabletech/hbase-operator/pull/757
 
 ## [26.3.0] - 2026-03-16
 

Cargo.nix

@@ -0,0 +1,43 @@
+use snafu::{ResultExt, Snafu};
+
+use crate::{
+    crd::v1alpha1, security::opa::HbaseOpaConfig, zookeeper::ZookeeperConnectionInformation,
+};
+
+#[derive(Snafu, Debug)]
+pub enum Error {
+    #[snafu(display("failed to retrieve zookeeper connection information"))]
+    RetrieveZookeeperConnectionInformation { source: crate::zookeeper::Error },
+
+    #[snafu(display("invalid OPA configuration"))]
+    InvalidOpaConfig { source: crate::security::opa::Error },
+}
+
+/// External references resolved during the dereference step.
+pub struct DereferencedObjects {
+    pub zookeeper_connection_information: ZookeeperConnectionInformation,
+    pub hbase_opa_config: Option<HbaseOpaConfig>,
+}
+
+pub async fn dereference(
+    client: &stackable_operator::client::Client,
+    hbase: &v1alpha1::HbaseCluster,
+) -> Result<DereferencedObjects, Error> {
+    let zookeeper_connection_information = ZookeeperConnectionInformation::retrieve(hbase, client)
+        .await
+        .context(RetrieveZookeeperConnectionInformationSnafu)?;
+
+    let hbase_opa_config = match &hbase.spec.cluster_config.authorization {
+        Some(opa_config) => Some(
+            HbaseOpaConfig::from_opa_config(client, hbase, opa_config)
+                .await
+                .context(InvalidOpaConfigSnafu)?,
+        ),
+        None => None,
+    };
+
+    Ok(DereferencedObjects {
+        zookeeper_connection_information,
+        hbase_opa_config,
+    })
+}

crate-hashes.json

@@ -0,0 +1,2 @@
+pub mod dereference;
+pub mod validate;

rust/operator-binary/src/controller/dereference.rs

@@ -0,0 +1,122 @@
+use std::{collections::BTreeMap, str::FromStr};
+
+use product_config::ProductConfigManager;
+use snafu::{ResultExt, Snafu};
+use stackable_operator::{
+    commons::product_image_selection::{self},
+    product_config_utils::{transform_all_roles_to_config, validate_all_roles_and_groups_config},
+    role_utils::GenericRoleConfig,
+};
+
+use crate::{
+    controller::dereference::DereferencedObjects,
+    crd::{HbaseRole, v1alpha1},
+    hbase_controller::{
+        CONTAINER_IMAGE_BASE_NAME, ValidatedCluster, ValidatedRoleConfig, ValidatedRoleGroupConfig,
+    },
+};
+
+#[derive(Snafu, Debug)]
+pub enum Error {
+    #[snafu(display("failed to resolve product image"))]
+    ResolveProductImage {
+        source: product_image_selection::Error,
+    },
+
+    #[snafu(display("invalid role properties"))]
+    RoleProperties { source: crate::crd::Error },
+
+    #[snafu(display("failed to generate product config"))]
+    GenerateProductConfig {
+        source: stackable_operator::product_config_utils::Error,
+    },
+
+    #[snafu(display("invalid product config"))]
+    InvalidProductConfig {
+        source: stackable_operator::product_config_utils::Error,
+    },
+
+    #[snafu(display("could not parse Hbase role [{role}]"))]
+    UnidentifiedHbaseRole {
+        source: strum::ParseError,
+        role: String,
+    },
+
+    #[snafu(display("failed to resolve and merge config for role and role group"))]
+    FailedToResolveConfig { source: crate::crd::Error },
+}
+
+pub fn validate_cluster(
+    hbase: &v1alpha1::HbaseCluster,
+    image_repository: &str,
+    product_config_manager: &ProductConfigManager,
+    dereferenced_objects: DereferencedObjects,
+) -> Result<ValidatedCluster, Error> {
+    let resolved_product_image = hbase
+        .spec
+        .image
+        .resolve(
+            CONTAINER_IMAGE_BASE_NAME,
+            image_repository,
+            crate::built_info::PKG_VERSION,
+        )
+        .context(ResolveProductImageSnafu)?;
+
+    let roles = hbase.build_role_properties().context(RolePropertiesSnafu)?;
+
+    let validated_config = validate_all_roles_and_groups_config(
+        &resolved_product_image.product_version,
+        &transform_all_roles_to_config(hbase, &roles).context(GenerateProductConfigSnafu)?,
+        product_config_manager,
+        false,
+        false,
+    )
+    .context(InvalidProductConfigSnafu)?;
+
+    let mut role_groups = BTreeMap::new();
+    let mut role_configs = BTreeMap::new();
+
+    for (role_name, group_config) in validated_config.iter() {
+        let hbase_role = HbaseRole::from_str(role_name).context(UnidentifiedHbaseRoleSnafu {
+            role: role_name.to_string(),
+        })?;
+
+        if let Some(GenericRoleConfig {
+            pod_disruption_budget: pdb,
+        }) = hbase.role_config(&hbase_role)
+        {
+            role_configs.insert(hbase_role.clone(), ValidatedRoleConfig { pdb: pdb.clone() });
+        }
+
+        let mut group_configs = BTreeMap::new();
+        for (rolegroup_name, rolegroup_config) in group_config.iter() {
+            let rolegroup = hbase.server_rolegroup_ref(role_name, rolegroup_name);
+
+            let merged_config = hbase
+                .merged_config(
+                    &hbase_role,
+                    &rolegroup.role_group,
+                    &hbase.spec.cluster_config.hdfs_config_map_name,
+                )
+                .context(FailedToResolveConfigSnafu)?;
+
+            group_configs.insert(
+                rolegroup_name.clone(),
+                ValidatedRoleGroupConfig {
+                    merged_config,
+                    product_config_properties: rolegroup_config.clone(),
+                },
+            );
+        }
+
+        role_groups.insert(hbase_role, group_configs);
+    }
+
+    Ok(ValidatedCluster {
+        image: resolved_product_image,
+        role_groups,
+        role_configs,
+        zookeeper_connection_information: dereferenced_objects.zookeeper_connection_information,
+        hbase_opa_config: dereferenced_objects.hbase_opa_config,
+    })
+}

rust/operator-binary/src/controller/mod.rs

@@ -623,7 +623,9 @@ pub fn merged_env(rolegroup_config: Option<&BTreeMap<String, String>>) -> Vec<En
     Eq,
     Hash,
     JsonSchema,
+    Ord,
     PartialEq,
+    PartialOrd,
     Serialize,
     EnumString,
 )]
@@ -1253,6 +1255,7 @@ pub struct HbaseClusterStatus {
     pub conditions: Vec<ClusterCondition>,
 }
 
+#[derive(Clone, Debug)]
 pub enum AnyServiceConfig {
     Master(HbaseConfig),
     RegionServer(RegionServerConfig),