refactor: remove raw cluster ref from kerberos and jvm

maltesander · maltesander · commit f9056351990f · 2026-06-16T18:53:59.000+02:00
diff --git a/rust/operator-binary/src/controller/build/jvm.rs b/rust/operator-binary/src/controller/build/jvm.rs
@@ -6,7 +6,7 @@ use stackable_operator::{
 
 use crate::{
     controller::build::kerberos::KRB5_CONFIG_PATH,
-    crd::{AnyServiceConfig, CONFIG_DIR_NAME, JVM_SECURITY_PROPERTIES_FILE, v1alpha1},
+    crd::{AnyServiceConfig, CONFIG_DIR_NAME, JVM_SECURITY_PROPERTIES_FILE},
 };
 
 const JAVA_HEAP_FACTOR: f32 = 0.8;
@@ -49,14 +49,14 @@ pub fn construct_global_jvm_args(kerberos_enabled: bool) -> String {
 /// [`with_validated_config`](stackable_operator::v2::role_utils::with_validated_config). The
 /// operator-generated arguments below form the base that the user overrides are applied on top of.
 pub fn construct_role_specific_non_heap_jvm_args(
-    hbase: &v1alpha1::HbaseCluster,
+    kerberos_enabled: bool,
     merged_jvm_argument_overrides: &JvmArgumentOverrides,
 ) -> String {
     let mut operator_generated = vec![format!(
         "-Djava.security.properties={CONFIG_DIR_NAME}/{JVM_SECURITY_PROPERTIES_FILE}"
     )];
 
-    if hbase.has_kerberos_enabled() {
+    if kerberos_enabled {
         operator_generated.push(format!("-Djava.security.krb5.conf={KRB5_CONFIG_PATH}"));
     }
 
diff --git a/rust/operator-binary/src/controller/build/kerberos.rs b/rust/operator-binary/src/controller/build/kerberos.rs
@@ -1,6 +1,6 @@
 use std::collections::BTreeMap;
 
-use snafu::{OptionExt, ResultExt, Snafu};
+use snafu::{ResultExt, Snafu};
 use stackable_operator::{
     builder::{
         self,
@@ -11,14 +11,13 @@ use stackable_operator::{
         },
     },
     commons::secret_class::SecretClassVolumeProvisionParts,
-    kube::{ResourceExt, runtime::reflector::ObjectRef},
     shared::time::Duration,
     utils::cluster_info::KubernetesClusterInfo,
 };
 
 use crate::{
     controller::ValidatedCluster,
-    crd::{TLS_STORE_DIR, TLS_STORE_PASSWORD, TLS_STORE_VOLUME_NAME, v1alpha1},
+    crd::{TLS_STORE_DIR, TLS_STORE_PASSWORD, TLS_STORE_VOLUME_NAME},
 };
 
 /// Mount path of the Kerberos secret volume (keytab + `krb5.conf`).
@@ -31,18 +30,13 @@ const KERBEROS_VOLUME_NAME: &str = "kerberos";
 
 #[derive(Snafu, Debug)]
 pub enum Error {
-    #[snafu(display("object {hbase} is missing namespace"))]
-    ObjectMissingNamespace {
-        hbase: ObjectRef<v1alpha1::HbaseCluster>,
-    },
-
-    #[snafu(display("failed to add Kerberos secret volume"))]
-    AddKerberosSecretVolume {
+    #[snafu(display("failed to build Kerberos secret volume"))]
+    BuildKerberosSecretVolume {
         source: stackable_operator::builder::pod::volume::SecretOperatorVolumeSourceBuilderError,
     },
 
-    #[snafu(display("failed to add TLS secret volume"))]
-    AddTlsSecretVolume {
+    #[snafu(display("failed to build TLS secret volume"))]
+    BuildTlsSecretVolume {
         source: stackable_operator::builder::pod::volume::SecretOperatorVolumeSourceBuilderError,
     },
 
@@ -56,14 +50,11 @@ pub enum Error {
 }
 
 pub fn kerberos_config_properties(
-    hbase: &v1alpha1::HbaseCluster,
+    hbase_name: &str,
+    hbase_namespace: &str,
     cluster_info: &KubernetesClusterInfo,
-) -> Result<BTreeMap<String, String>, Error> {
-    if !hbase.has_kerberos_enabled() {
-        return Ok(BTreeMap::new());
-    }
-
-    let principal_host_part = principal_host_part(hbase, cluster_info)?;
+) -> BTreeMap<String, String> {
+    let principal_host_part = principal_host_part(hbase_name, hbase_namespace, cluster_info);
 
     let mut config = BTreeMap::from([
         // Kerberos settings
@@ -126,18 +117,15 @@ pub fn kerberos_config_properties(
         ("hbase.rest.ssl.keystore.type".to_string(), "pkcs12".to_string()),
     ]);
     config.extend(kerberos_principals(&principal_host_part));
-    Ok(config)
+    config
 }
 
 pub fn kerberos_discovery_config_properties(
-    hbase: &v1alpha1::HbaseCluster,
+    hbase_name: &str,
+    hbase_namespace: &str,
     cluster_info: &KubernetesClusterInfo,
-) -> Result<BTreeMap<String, String>, Error> {
-    if !hbase.has_kerberos_enabled() {
-        return Ok(BTreeMap::new());
-    }
-
-    let principal_host_part = principal_host_part(hbase, cluster_info)?;
+) -> BTreeMap<String, String> {
+    let principal_host_part = principal_host_part(hbase_name, hbase_namespace, cluster_info);
 
     let mut config = BTreeMap::from([
         (
@@ -148,14 +136,10 @@ pub fn kerberos_discovery_config_properties(
         ("hbase.ssl.enabled".to_string(), "true".to_string()),
     ]);
     config.extend(kerberos_principals(&principal_host_part));
-    Ok(config)
+    config
 }
 
-pub fn kerberos_ssl_server_settings(hbase: &v1alpha1::HbaseCluster) -> BTreeMap<String, String> {
-    if !hbase.has_https_enabled() {
-        return BTreeMap::new();
-    }
-
+pub fn kerberos_ssl_server_settings() -> BTreeMap<String, String> {
     let mut settings = truststore_settings("server");
     settings.extend([
         (
@@ -171,11 +155,7 @@ pub fn kerberos_ssl_server_settings(hbase: &v1alpha1::HbaseCluster) -> BTreeMap<
     settings
 }
 
-pub fn kerberos_ssl_client_settings(hbase: &v1alpha1::HbaseCluster) -> BTreeMap<String, String> {
-    if !hbase.has_https_enabled() {
-        return BTreeMap::new();
-    }
-
+pub fn kerberos_ssl_client_settings() -> BTreeMap<String, String> {
     truststore_settings("client")
 }
 
@@ -197,7 +177,7 @@ pub fn add_kerberos_pod_config(
         .with_kerberos_service_name(kerberos_service_name())
         .with_kerberos_service_name("HTTP")
         .build()
-        .context(AddKerberosSecretVolumeSnafu)?;
+        .context(BuildKerberosSecretVolumeSnafu)?;
         pb.add_volume(
             VolumeBuilder::new(KERBEROS_VOLUME_NAME)
                 .ephemeral(kerberos_secret_operator_volume)
@@ -230,7 +210,7 @@ pub fn add_kerberos_pod_config(
                     .with_tls_pkcs12_password(TLS_STORE_PASSWORD)
                     .with_auto_tls_cert_lifetime(requested_secret_lifetime)
                     .build()
-                    .context(AddTlsSecretVolumeSnafu)?,
+                    .context(BuildTlsSecretVolumeSnafu)?,
                 )
                 .build(),
         )
@@ -279,17 +259,12 @@ fn truststore_settings(role: &str) -> BTreeMap<String, String> {
 }
 
 fn principal_host_part(
-    hbase: &v1alpha1::HbaseCluster,
+    hbase_name: &str,
+    hbase_namespace: &str,
     cluster_info: &KubernetesClusterInfo,
-) -> Result<String, Error> {
-    let hbase_name = hbase.name_any();
-    let hbase_namespace = hbase.namespace().context(ObjectMissingNamespaceSnafu {
-        hbase: ObjectRef::from_obj(hbase),
-    })?;
+) -> String {
     let cluster_domain = &cluster_info.cluster_domain;
-    Ok(format!(
-        "{hbase_name}.{hbase_namespace}.svc.{cluster_domain}@${{env:KERBEROS_REALM}}"
-    ))
+    format!("{hbase_name}.{hbase_namespace}.svc.{cluster_domain}@${{env:KERBEROS_REALM}}")
 }
 
 /// We could have different service names depended on the role (e.g. "hbase-master", "hbase-regionserver" and
diff --git a/rust/operator-binary/src/controller/validate.rs b/rust/operator-binary/src/controller/validate.rs
@@ -31,7 +31,7 @@ use crate::{
         build::{
             jvm::construct_role_specific_non_heap_jvm_args,
             kerberos::{
-                self, kerberos_config_properties, kerberos_discovery_config_properties,
+                kerberos_config_properties, kerberos_discovery_config_properties,
                 kerberos_ssl_client_settings, kerberos_ssl_server_settings,
             },
         },
@@ -72,9 +72,6 @@ pub enum Error {
         role_group: String,
     },
 
-    #[snafu(display("failed to resolve kerberos config"))]
-    AddKerberosConfig { source: kerberos::Error },
-
     #[snafu(display("failed to validate logging configuration"))]
     ValidateLoggingConfig {
         source: stackable_operator::v2::product_logging::framework::Error,
@@ -216,17 +213,36 @@ pub fn validate_cluster(
         role_groups.insert(hbase_role, group_configs);
     }
 
-    let hbase_site_kerberos_config =
-        kerberos_config_properties(hbase, cluster_info).context(AddKerberosConfigSnafu)?;
-    let discovery_kerberos_config = kerberos_discovery_config_properties(hbase, cluster_info)
-        .context(AddKerberosConfigSnafu)?;
-    let ssl_server_settings = kerberos_ssl_server_settings(hbase);
-    let ssl_client_settings = kerberos_ssl_client_settings(hbase);
-
     let name = get_cluster_name(hbase).context(GetClusterIdentitySnafu)?;
     let namespace = get_namespace(hbase).context(GetClusterIdentitySnafu)?;
     let uid = get_uid(hbase).context(GetClusterIdentitySnafu)?;
 
+    let kerberos_enabled = hbase.has_kerberos_enabled();
+    let https_enabled = hbase.has_https_enabled();
+
+    // Kerberos- and TLS-related properties, pre-resolved here so the build step stays a pure
+    // function of `ValidatedCluster` (empty when the respective feature is disabled).
+    let hbase_site_kerberos_config = if kerberos_enabled {
+        kerberos_config_properties(name.as_ref(), namespace.as_ref(), cluster_info)
+    } else {
+        BTreeMap::new()
+    };
+    let discovery_kerberos_config = if kerberos_enabled {
+        kerberos_discovery_config_properties(name.as_ref(), namespace.as_ref(), cluster_info)
+    } else {
+        BTreeMap::new()
+    };
+    let ssl_server_settings = if https_enabled {
+        kerberos_ssl_server_settings()
+    } else {
+        BTreeMap::new()
+    };
+    let ssl_client_settings = if https_enabled {
+        kerberos_ssl_client_settings()
+    } else {
+        BTreeMap::new()
+    };
+
     Ok(ValidatedCluster::new(
         name,
         namespace,
@@ -235,8 +251,8 @@ pub fn validate_cluster(
         ValidatedClusterConfig {
             zookeeper_connection_information: dereferenced_objects.zookeeper_connection_information,
             hbase_opa_config: dereferenced_objects.hbase_opa_config,
-            kerberos_enabled: hbase.has_kerberos_enabled(),
-            https_enabled: hbase.has_https_enabled(),
+            kerberos_enabled,
+            https_enabled,
             kerberos_secret_class: hbase.kerberos_secret_class(),
             https_secret_class: hbase.https_secret_class(),
             hdfs_config_map_name: hbase.spec.cluster_config.hdfs_config_map_name.clone(),
@@ -308,7 +324,7 @@ where
             } = validated.config;
 
             let non_heap_jvm_args = construct_role_specific_non_heap_jvm_args(
-                hbase,
+                hbase.has_kerberos_enabled(),
                 &product_specific_common_config.jvm_argument_overrides,
             );
 
