refactor: resolve cluster-wide config into ValidatedClusterConfig

Mirrors trino-operator: ValidatedCluster now carries a
ValidatedClusterConfig (name, namespace, dfs_replication, https/kerberos/
authentication/authorization flags, rack awareness, OPA authorization)
resolved once during validation. The standalone hdfs_opa_config field is
folded into it.

The build steps no longer take the raw HdfsCluster:
- hdfs_site/core_site builders and build_rolegroup_config_map consume
  &ValidatedClusterConfig / &ValidatedCluster.
- The lower-level HdfsSiteConfigBuilder/CoreSiteConfigBuilder and their
  kerberos security_config impls take primitives (a KerberosConfig struct
  and bools) to keep the config layer free of controller types.

Behavior-preserving: the flags are computed by the same HdfsCluster
predicates as before, just resolved up-front. The discovery path keeps
using the raw HdfsCluster as it does not go through validation.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: maltesander

rust/operator-binary/src/config/mod.rs

@@ -17,7 +17,6 @@ use crate::{
             SERVICE_PORT_NAME_HTTPS, SERVICE_PORT_NAME_RPC,
         },
         storage::{DataNodeStorageConfig, DataNodeStorageConfigInnerType},
-        v1alpha1,
     },
 };
 
@@ -168,11 +167,11 @@ impl HdfsSiteConfigBuilder {
 
     pub fn dfs_namenode_http_address_ha(
         &mut self,
-        hdfs: &v1alpha1::HdfsCluster,
+        https_enabled: bool,
         cluster_info: &KubernetesClusterInfo,
         namenode_podrefs: &[HdfsPodRef],
     ) -> &mut Self {
-        if hdfs.has_https_enabled() {
+        if https_enabled {
             self.dfs_namenode_address_ha(
                 cluster_info,
                 namenode_podrefs,

rust/operator-binary/src/controller/build/config_map.rs

@@ -6,7 +6,6 @@ use snafu::{OptionExt, ResultExt, Snafu};
 use stackable_operator::{
     builder::{configmap::ConfigMapBuilder, meta::ObjectMetaBuilder},
     k8s_openapi::api::core::v1::ConfigMap,
-    kube::runtime::reflector::ObjectRef,
     role_utils::RoleGroupRef,
     utils::cluster_info::KubernetesClusterInfo,
 };
@@ -24,11 +23,6 @@ use crate::{
 
 #[derive(Snafu, Debug)]
 pub enum Error {
-    #[snafu(display("object has no name"))]
-    ObjectHasNoName {
-        obj_ref: ObjectRef<v1alpha1::HdfsCluster>,
-    },
-
     #[snafu(display("could not parse HDFS role [{role}]"))]
     UnidentifiedHdfsRole {
         source: strum::ParseError,
@@ -63,10 +57,8 @@ pub enum Error {
 
 type Result<T, E = Error> = std::result::Result<T, E>;
 
-#[allow(clippy::too_many_arguments)]
 pub fn build_rolegroup_config_map(
     cluster: &ValidatedCluster,
-    hdfs: &v1alpha1::HdfsCluster,
     cluster_info: &KubernetesClusterInfo,
     metadata: &ObjectMetaBuilder,
     rolegroup_ref: &RoleGroupRef<v1alpha1::HdfsCluster>,
@@ -90,42 +82,30 @@ pub fn build_rolegroup_config_map(
         })?;
     let merged_config = &rolegroup_config.merged_config;
     let config_overrides = &rolegroup_config.config_overrides;
-    let hdfs_opa_config = cluster.hdfs_opa_config.as_ref();
-
-    let hdfs_name = hdfs
-        .metadata
-        .name
-        .as_deref()
-        .with_context(|| ObjectHasNoNameSnafu {
-            obj_ref: ObjectRef::from_obj(hdfs),
-        })?;
+    let cluster_config = &cluster.cluster_config;
 
     let hdfs_site_xml = hdfs_site::build(
-        hdfs,
-        hdfs_name,
+        cluster_config,
         cluster_info,
         merged_config,
         namenode_podrefs,
         journalnode_podrefs,
-        hdfs_opa_config,
         config_overrides.hdfs_site_xml.clone(),
     );
     let core_site_xml = core_site::build(
-        hdfs,
-        hdfs_name,
+        cluster_config,
         role,
         cluster_info,
-        hdfs_opa_config,
         config_overrides.core_site_xml.clone(),
     )
     .context(BuildCoreSiteXmlSnafu)?;
     let hadoop_policy_xml = hadoop_policy::build(config_overrides.hadoop_policy_xml.clone());
     let ssl_server_xml = ssl_server::build(
-        hdfs.has_https_enabled(),
+        cluster_config.https_enabled,
         config_overrides.ssl_server_xml.clone(),
     );
     let ssl_client_xml = ssl_client::build(
-        hdfs.has_https_enabled(),
+        cluster_config.https_enabled,
         config_overrides.ssl_client_xml.clone(),
     );
 

rust/operator-binary/src/controller/build/properties/core_site.rs

@@ -10,8 +10,9 @@ use stackable_operator::{
 use crate::{
     config::CoreSiteConfigBuilder,
     controller::build::properties::resolved_overrides,
-    crd::{HdfsNodeRole, v1alpha1},
-    security::{kerberos, opa::HdfsOpaConfig},
+    crd::HdfsNodeRole,
+    hdfs_controller::ValidatedClusterConfig,
+    security::kerberos::{self, KerberosConfig},
 };
 
 #[derive(Debug, Snafu)]
@@ -23,32 +24,38 @@ pub enum Error {
 /// Renders `core-site.xml`: operator defaults + kerberos/OPA security config,
 /// with user `configOverrides` applied last.
 pub fn build(
-    hdfs: &v1alpha1::HdfsCluster,
-    hdfs_name: &str,
+    cluster_config: &ValidatedClusterConfig,
     role: HdfsNodeRole,
     cluster_info: &KubernetesClusterInfo,
-    opa_config: Option<&HdfsOpaConfig>,
     overrides: KeyValueConfigOverrides,
 ) -> Result<String, Error> {
-    let mut core_site = CoreSiteConfigBuilder::new(hdfs_name.to_string());
+    let kerberos = KerberosConfig {
+        cluster_name: &cluster_config.name,
+        cluster_namespace: cluster_config.namespace.as_deref(),
+        authentication_enabled: cluster_config.authentication_enabled,
+        kerberos_enabled: cluster_config.kerberos_enabled,
+        authorization_enabled: cluster_config.authorization_enabled,
+    };
+
+    let mut core_site = CoreSiteConfigBuilder::new(cluster_config.name.clone());
     core_site
         .fs_default_fs()
         .ha_zookeeper_quorum()
-        .security_config(hdfs, cluster_info)
+        .security_config(&kerberos, cluster_info)
         .context(BuildSecurityConfigSnafu)?
         .enable_prometheus_endpoint()
         // The default (4096) hasn't changed since 2009.
         // Increase to 128k to allow for faster transfers.
         .add("io.file.buffer.size", "131072");
     // Rack awareness topology provider, namenode only. Previously injected via
     // the product-config `Configuration::compute_files`.
-    if role == HdfsNodeRole::Name && hdfs.rackawareness_config().is_some() {
+    if role == HdfsNodeRole::Name && cluster_config.rack_awareness.is_some() {
         core_site.add(
             "net.topology.node.switch.mapping.impl",
             "tech.stackable.hadoop.StackableTopologyProvider",
         );
     }
-    if let Some(opa_config) = opa_config {
+    if let Some(opa_config) = &cluster_config.authorization {
         opa_config.add_core_site_config(&mut core_site);
     }
     // the extend with config must come last in order to have overrides working!!!
@@ -60,18 +67,15 @@ pub fn build(
 mod tests {
     use super::*;
     use crate::controller::build::properties::test_support::{
-        cluster_info, config_overrides, minimal_hdfs,
+        cluster_info, config_overrides, validated_cluster_config,
     };
 
     #[test]
     fn renders_operator_defaults() {
-        let hdfs = minimal_hdfs();
         let xml = build(
-            &hdfs,
-            "hdfs",
+            &validated_cluster_config(),
             HdfsNodeRole::Name,
             &cluster_info(),
-            None,
             config_overrides(&[]),
         )
         .unwrap();
@@ -93,13 +97,10 @@ mod tests {
 
     #[test]
     fn user_overrides_win_over_defaults() {
-        let hdfs = minimal_hdfs();
         let xml = build(
-            &hdfs,
-            "hdfs",
+            &validated_cluster_config(),
             HdfsNodeRole::Name,
             &cluster_info(),
-            None,
             config_overrides(&[("io.file.buffer.size", "65536")]),
         )
         .unwrap();

rust/operator-binary/src/controller/build/properties/hdfs_site.rs

@@ -9,21 +9,18 @@ use stackable_operator::{
 use crate::{
     config::HdfsSiteConfigBuilder,
     controller::build::properties::resolved_overrides,
-    crd::{AnyNodeConfig, HdfsPodRef, v1alpha1},
-    security::opa::HdfsOpaConfig,
+    crd::{AnyNodeConfig, HdfsPodRef},
+    hdfs_controller::ValidatedClusterConfig,
 };
 
 /// Renders `hdfs-site.xml`: operator defaults, HA wiring derived from the pod
 /// refs, kerberos/OPA security config, with user `configOverrides` applied last.
-#[allow(clippy::too_many_arguments)]
 pub fn build(
-    hdfs: &v1alpha1::HdfsCluster,
-    hdfs_name: &str,
+    cluster_config: &ValidatedClusterConfig,
     cluster_info: &KubernetesClusterInfo,
     merged_config: &AnyNodeConfig,
     namenode_podrefs: &[HdfsPodRef],
     journalnode_podrefs: &[HdfsPodRef],
-    opa_config: Option<&HdfsOpaConfig>,
     overrides: KeyValueConfigOverrides,
 ) -> String {
     // IMPORTANT: these folders must be under the volume mount point, otherwise they will not
@@ -37,7 +34,7 @@ pub fn build(
     // https://hadoop.apache.org/docs/stable/hadoop-project-dist/hadoop-hdfs/HDFSHighAvailabilityWithNFS.html
     // This caused a deadlock with no namenode becoming active during a startup after
     // HDFS was completely down for a while.
-    let mut hdfs_site = HdfsSiteConfigBuilder::new(hdfs_name.to_string());
+    let mut hdfs_site = HdfsSiteConfigBuilder::new(cluster_config.name.clone());
     hdfs_site
         .dfs_namenode_name_dir()
         .dfs_datanode_data_dir(
@@ -46,15 +43,15 @@ pub fn build(
                 .map(|node| node.resources.storage.clone()),
         )
         .dfs_journalnode_edits_dir()
-        .dfs_replication(hdfs.spec.cluster_config.dfs_replication)
+        .dfs_replication(cluster_config.dfs_replication)
         .dfs_name_services()
         .dfs_ha_namenodes(namenode_podrefs)
         .dfs_namenode_shared_edits_dir(cluster_info, journalnode_podrefs)
         .dfs_namenode_name_dir_ha(namenode_podrefs)
         .dfs_namenode_rpc_address_ha(cluster_info, namenode_podrefs)
-        .dfs_namenode_http_address_ha(hdfs, cluster_info, namenode_podrefs)
+        .dfs_namenode_http_address_ha(cluster_config.https_enabled, cluster_info, namenode_podrefs)
         .dfs_client_failover_proxy_provider()
-        .security_config(hdfs)
+        .security_config(cluster_config.kerberos_enabled)
         .add("dfs.ha.fencing.methods", "shell(/bin/true)")
         .add("dfs.ha.automatic-failover.enabled", "true")
         .add("dfs.ha.namenode.id", "${env.POD_NAME}")
@@ -99,12 +96,12 @@ pub fn build(
         // But today's Java and IO should be able to handle more, so bump it to 8192 for
         // better performance/concurrency.
         .add("dfs.datanode.max.transfer.threads", "8192");
-    if hdfs.has_https_enabled() {
+    if cluster_config.https_enabled {
         hdfs_site.add("dfs.datanode.registered.https.port", "${env.HTTPS_PORT}");
     } else {
         hdfs_site.add("dfs.datanode.registered.http.port", "${env.HTTP_PORT}");
     }
-    if let Some(opa_config) = opa_config {
+    if let Some(opa_config) = &cluster_config.authorization {
         opa_config.add_hdfs_site_config(&mut hdfs_site);
     }
     // the extend with config must come last in order to have overrides working!!!
@@ -117,9 +114,9 @@ mod tests {
     use super::*;
     use crate::{
         controller::build::properties::test_support::{
-            cluster_info, config_overrides, minimal_hdfs,
+            cluster_info, config_overrides, minimal_hdfs, validated_cluster_config,
         },
-        crd::HdfsNodeRole,
+        crd::{HdfsNodeRole, v1alpha1},
     };
 
     fn namenode_merged_config(hdfs: &v1alpha1::HdfsCluster) -> AnyNodeConfig {
@@ -130,16 +127,13 @@ mod tests {
 
     #[test]
     fn renders_operator_defaults() {
-        let hdfs = minimal_hdfs();
-        let merged = namenode_merged_config(&hdfs);
+        let merged = namenode_merged_config(&minimal_hdfs());
         let xml = build(
-            &hdfs,
-            "hdfs",
+            &validated_cluster_config(),
             &cluster_info(),
             &merged,
             &[],
             &[],
-            None,
             config_overrides(&[]),
         );
         assert!(
@@ -154,16 +148,13 @@ mod tests {
 
     #[test]
     fn user_overrides_win_over_defaults() {
-        let hdfs = minimal_hdfs();
-        let merged = namenode_merged_config(&hdfs);
+        let merged = namenode_merged_config(&minimal_hdfs());
         let xml = build(
-            &hdfs,
-            "hdfs",
+            &validated_cluster_config(),
             &cluster_info(),
             &merged,
             &[],
             &[],
-            None,
             config_overrides(&[("dfs.replication", "5")]),
         );
         assert!(

rust/operator-binary/src/controller/build/properties/mod.rs

@@ -73,7 +73,7 @@ pub(crate) mod test_support {
         v2::config_overrides::KeyValueConfigOverrides,
     };
 
-    use crate::crd::v1alpha1;
+    use crate::{crd::v1alpha1, hdfs_controller::ValidatedClusterConfig};
 
     /// Builds a [`KeyValueConfigOverrides`] from `(key, value)` pairs for tests.
     pub fn config_overrides(pairs: &[(&str, &str)]) -> KeyValueConfigOverrides {
@@ -120,4 +120,8 @@ spec:
             cluster_domain: DomainName::try_from("cluster.local").unwrap(),
         }
     }
+
+    pub fn validated_cluster_config() -> ValidatedClusterConfig {
+        ValidatedClusterConfig::resolve(&minimal_hdfs(), None)
+    }
 }

rust/operator-binary/src/controller/validate.rs

@@ -20,7 +20,8 @@ use strum::IntoEnumIterator;
 use crate::{
     crd::{HdfsNodeRole, v1alpha1},
     hdfs_controller::{
-        CONTAINER_IMAGE_BASE_NAME, ValidatedCluster, ValidatedRoleConfig, ValidatedRoleGroupConfig,
+        CONTAINER_IMAGE_BASE_NAME, ValidatedCluster, ValidatedClusterConfig, ValidatedRoleConfig,
+        ValidatedRoleGroupConfig,
     },
     security::opa::HdfsOpaConfig,
 };
@@ -97,9 +98,9 @@ pub fn validate_cluster(
 
     Ok(ValidatedCluster {
         image: resolved_product_image,
+        cluster_config: ValidatedClusterConfig::resolve(hdfs, hdfs_opa_config),
         role_groups,
         role_configs,
-        hdfs_opa_config,
     })
 }
 

rust/operator-binary/src/discovery.rs

@@ -12,7 +12,7 @@ use crate::{
     config::{CoreSiteConfigBuilder, HdfsSiteConfigBuilder},
     controller::build::properties::ConfigFileName,
     crd::{HdfsNodeRole, HdfsPodRef, v1alpha1},
-    security::kerberos,
+    security::kerberos::{self, KerberosConfig},
 };
 
 type Result<T, E = Error> = std::result::Result<T, E>;
@@ -89,9 +89,9 @@ fn build_discovery_hdfs_site_xml(
         .dfs_name_services()
         .dfs_ha_namenodes(namenode_podrefs)
         .dfs_namenode_rpc_address_ha(cluster_info, namenode_podrefs)
-        .dfs_namenode_http_address_ha(hdfs, cluster_info, namenode_podrefs)
+        .dfs_namenode_http_address_ha(hdfs.has_https_enabled(), cluster_info, namenode_podrefs)
         .dfs_client_failover_proxy_provider()
-        .security_discovery_config(hdfs)
+        .security_discovery_config(hdfs.has_kerberos_enabled())
         .build_as_xml()
 }
 
@@ -100,9 +100,18 @@ fn build_discovery_core_site_xml(
     cluster_info: &KubernetesClusterInfo,
     logical_name: String,
 ) -> Result<String> {
+    let cluster_name = hdfs.name_any();
+    let cluster_namespace = hdfs.namespace();
+    let kerberos = KerberosConfig {
+        cluster_name: &cluster_name,
+        cluster_namespace: cluster_namespace.as_deref(),
+        authentication_enabled: hdfs.authentication_config().is_some(),
+        kerberos_enabled: hdfs.has_kerberos_enabled(),
+        authorization_enabled: hdfs.has_authorization_enabled(),
+    };
     Ok(CoreSiteConfigBuilder::new(logical_name)
         .fs_default_fs()
-        .security_discovery_config(hdfs, cluster_info)
+        .security_discovery_config(&kerberos, cluster_info)
         .context(BuildSecurityDiscoveryConfigMapSnafu)?
         .build_as_xml())
 }