fix: use Option<T> instead of calculated redundant booleans in ValidatedClusterConfig

Author: maltesander

rust/operator-binary/src/controller/build/config_map.rs

@@ -87,11 +87,11 @@ pub fn build_rolegroup_config_map(
     );
     let hadoop_policy_xml = hadoop_policy::build(config_overrides.hadoop_policy_xml.clone());
     let ssl_server_xml = ssl_server::build(
-        cluster_config.https_enabled,
+        cluster_config.authentication.is_some(),
         config_overrides.ssl_server_xml.clone(),
     );
     let ssl_client_xml = ssl_client::build(
-        cluster_config.https_enabled,
+        cluster_config.authentication.is_some(),
         config_overrides.ssl_client_xml.clone(),
     );
 

rust/operator-binary/src/controller/build/discovery.rs

@@ -91,12 +91,12 @@ fn build_discovery_hdfs_site_xml(
         .dfs_ha_namenodes(namenode_podrefs)
         .dfs_namenode_rpc_address_ha(cluster_info, namenode_podrefs)
         .dfs_namenode_http_address_ha(
-            cluster.cluster_config.https_enabled,
+            cluster.cluster_config.authentication.is_some(),
             cluster_info,
             namenode_podrefs,
         )
         .dfs_client_failover_proxy_provider()
-        .security_discovery_config(cluster.cluster_config.kerberos_enabled)
+        .security_discovery_config(cluster.cluster_config.authentication.is_some())
         .build_as_xml()
 }
 
@@ -108,9 +108,9 @@ fn build_discovery_core_site_xml(
     let kerberos = KerberosConfig {
         cluster_name: cluster.name.as_ref(),
         cluster_namespace: cluster.namespace.as_ref(),
-        authentication_enabled: cluster_config.authentication_enabled,
-        kerberos_enabled: cluster_config.kerberos_enabled,
-        authorization_enabled: cluster_config.authorization_enabled,
+        authentication_enabled: cluster_config.authentication.is_some(),
+        kerberos_enabled: cluster_config.authentication.is_some(),
+        authorization_enabled: cluster_config.authorization.is_some(),
     };
     CoreSiteConfigBuilder::new(cluster.name.as_ref().to_owned())
         .fs_default_fs()

rust/operator-binary/src/controller/build/properties/core_site.rs

@@ -23,9 +23,9 @@ pub fn build(
     let kerberos = KerberosConfig {
         cluster_name: cluster.name.as_ref(),
         cluster_namespace: cluster.namespace.as_ref(),
-        authentication_enabled: cluster_config.authentication_enabled,
-        kerberos_enabled: cluster_config.kerberos_enabled,
-        authorization_enabled: cluster_config.authorization_enabled,
+        authentication_enabled: cluster_config.authentication.is_some(),
+        kerberos_enabled: cluster_config.authentication.is_some(),
+        authorization_enabled: cluster_config.authorization.is_some(),
     };
 
     let mut core_site = CoreSiteConfigBuilder::new(cluster.name.as_ref().to_owned());

rust/operator-binary/src/controller/build/properties/hdfs_site.rs

@@ -51,12 +51,12 @@ pub fn build(
         .dfs_namenode_name_dir_ha(&namenode_podrefs)
         .dfs_namenode_rpc_address_ha(cluster_info, &namenode_podrefs)
         .dfs_namenode_http_address_ha(
-            cluster_config.https_enabled,
+            cluster_config.authentication.is_some(),
             cluster_info,
             &namenode_podrefs,
         )
         .dfs_client_failover_proxy_provider()
-        .security_config(cluster_config.kerberos_enabled)
+        .security_config(cluster_config.authentication.is_some())
         .add("dfs.ha.fencing.methods", "shell(/bin/true)")
         .add("dfs.ha.automatic-failover.enabled", "true")
         .add("dfs.ha.namenode.id", "${env.POD_NAME}")
@@ -101,7 +101,7 @@ pub fn build(
         // But today's Java and IO should be able to handle more, so bump it to 8192 for
         // better performance/concurrency.
         .add("dfs.datanode.max.transfer.threads", "8192");
-    if cluster_config.https_enabled {
+    if cluster_config.authentication.is_some() {
         hdfs_site.add("dfs.datanode.registered.https.port", "${env.HTTPS_PORT}");
     } else {
         hdfs_site.add("dfs.datanode.registered.http.port", "${env.HTTP_PORT}");

rust/operator-binary/src/hdfs_controller.rs

@@ -51,7 +51,7 @@ use crate::{
     controller::build::discovery::{self, build_discovery_config_map},
     crd::{
         AnyNodeConfig, HdfsClusterStatus, HdfsNodeRole, HdfsPodRef, UpgradeState,
-        UpgradeStateError, constants::*, v1alpha1,
+        UpgradeStateError, constants::*, security::AuthenticationConfig, v1alpha1,
     },
     event::{build_invalid_replica_message, publish_warning_event},
     operations::{
@@ -96,7 +96,7 @@ impl ValidatedCluster {
     /// is already resolved on `self` during validation.
     pub fn pod_refs(&self, role: &HdfsNodeRole) -> Vec<HdfsPodRef> {
         let ports: HashMap<String, u16> =
-            crate::crd::role_data_ports(role, self.cluster_config.https_enabled)
+            crate::crd::role_data_ports(role, self.cluster_config.authentication.is_some())
                 .into_iter()
                 .collect();
 
@@ -124,12 +124,12 @@ impl ValidatedCluster {
 #[derive(Clone, Debug)]
 pub struct ValidatedClusterConfig {
     pub dfs_replication: u8,
-    pub https_enabled: bool,
-    pub kerberos_enabled: bool,
-    pub authentication_enabled: bool,
-    pub authorization_enabled: bool,
-    pub rack_awareness: Option<String>,
+    /// The authentication config, if configured. Its presence enables both Kerberos
+    /// and HTTPS; it also carries the TLS and Kerberos secret class names.
+    pub authentication: Option<AuthenticationConfig>,
+    /// The resolved OPA authorization config, if authorization is configured.
     pub authorization: Option<HdfsOpaConfig>,
+    pub rack_awareness: Option<String>,
 }
 
 impl ValidatedClusterConfig {
@@ -139,12 +139,9 @@ impl ValidatedClusterConfig {
     ) -> ValidatedClusterConfig {
         ValidatedClusterConfig {
             dfs_replication: hdfs.spec.cluster_config.dfs_replication,
-            https_enabled: hdfs.has_https_enabled(),
-            kerberos_enabled: hdfs.has_kerberos_enabled(),
-            authentication_enabled: hdfs.authentication_config().is_some(),
-            authorization_enabled: hdfs.has_authorization_enabled(),
-            rack_awareness: hdfs.rackawareness_config(),
+            authentication: hdfs.authentication_config().cloned(),
             authorization,
+            rack_awareness: hdfs.rackawareness_config(),
         }
     }
 }