refactor: move product image resolution from dereference to validate

Image resolution is a pure computation, not an I/O dereference, so it
belongs in validate_cluster alongside the other config validation. This
aligns with the pattern used by the trino and airflow operators.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: adwk67

rust/operator-binary/src/controller.rs

@@ -338,18 +338,18 @@ pub async fn reconcile_hive(
     let client = &ctx.client;
     let hive_namespace = hive.namespace().context(ObjectHasNoNamespaceSnafu)?;
 
-    let dereferenced = crate::controller::dereference::dereference(
-        client,
+    let dereferenced = crate::controller::dereference::dereference(client, hive)
+        .await
+        .context(DereferenceSnafu)?;
+
+    let validated = validate::validate_cluster(
         hive,
         CONTAINER_IMAGE_BASE_NAME,
         &ctx.operator_environment.image_repository,
         crate::built_info::PKG_VERSION,
+        &ctx.product_config,
     )
-    .await
-    .context(DereferenceSnafu)?;
-
-    let validated = validate::validate_cluster(hive, &dereferenced, &ctx.product_config)
-        .context(ValidateSnafu)?;
+    .context(ValidateSnafu)?;
 
     let mut cluster_resources = ClusterResources::new(
         APP_NAME,

rust/operator-binary/src/controller/dereference.rs

@@ -1,20 +1,12 @@
 use snafu::{ResultExt, Snafu};
 use stackable_operator::{
-    commons::product_image_selection::{self, ResolvedProductImage},
-    crd::s3,
-    database_connections::drivers::jdbc::JdbcDatabaseConnectionDetails,
-    kube::ResourceExt,
+    crd::s3, database_connections::drivers::jdbc::JdbcDatabaseConnectionDetails, kube::ResourceExt,
 };
 
 use crate::{config::opa::HiveOpaConfig, crd::v1alpha1};
 
 #[derive(Snafu, Debug)]
 pub enum Error {
-    #[snafu(display("failed to resolve product image"))]
-    ResolveProductImage {
-        source: product_image_selection::Error,
-    },
-
     #[snafu(display("object defines no namespace"))]
     ObjectHasNoNamespace,
 
@@ -36,7 +28,6 @@ pub enum Error {
 
 /// External references resolved during the dereference step.
 pub struct DereferencedObjects {
-    pub resolved_product_image: ResolvedProductImage,
     pub s3_connection_spec: Option<s3::v1alpha1::ConnectionSpec>,
     pub metadata_database_connection_details: JdbcDatabaseConnectionDetails,
     pub hive_opa_config: Option<HiveOpaConfig>,
@@ -45,16 +36,7 @@ pub struct DereferencedObjects {
 pub async fn dereference(
     client: &stackable_operator::client::Client,
     hive: &v1alpha1::HiveCluster,
-    image_base_name: &str,
-    image_repository: &str,
-    pkg_version: &str,
 ) -> Result<DereferencedObjects, Error> {
-    let resolved_product_image = hive
-        .spec
-        .image
-        .resolve(image_base_name, image_repository, pkg_version)
-        .context(ResolveProductImageSnafu)?;
-
     let s3_connection_spec: Option<s3::v1alpha1::ConnectionSpec> =
         if let Some(s3) = &hive.spec.cluster_config.s3 {
             Some(
@@ -87,7 +69,6 @@ pub async fn dereference(
     };
 
     Ok(DereferencedObjects {
-        resolved_product_image,
         s3_connection_spec,
         metadata_database_connection_details,
         hive_opa_config,

rust/operator-binary/src/controller/validate.rs

@@ -6,19 +6,23 @@ use std::{
 use product_config::{ProductConfigManager, types::PropertyNameKind};
 use snafu::{OptionExt, ResultExt, Snafu};
 use stackable_operator::{
-    commons::product_image_selection::ResolvedProductImage,
+    commons::product_image_selection::{self, ResolvedProductImage},
     product_config_utils::{transform_all_roles_to_config, validate_all_roles_and_groups_config},
     role_utils::GenericRoleConfig,
 };
 
-use super::dereference::DereferencedObjects;
 use crate::crd::{
     HIVE_SITE_XML, HiveRole, JVM_SECURITY_PROPERTIES_FILE, MetaStoreConfig,
     v1alpha1::{self, HiveMetastoreRoleConfig},
 };
 
 #[derive(Snafu, Debug)]
 pub enum Error {
+    #[snafu(display("failed to resolve product image"))]
+    ResolveProductImage {
+        source: product_image_selection::Error,
+    },
+
     #[snafu(display("object defines no metastore role"))]
     NoMetaStoreRole,
 
@@ -61,13 +65,21 @@ pub struct ValidatedHiveCluster {
 
 pub fn validate_cluster(
     hive: &v1alpha1::HiveCluster,
-    dereferenced: &DereferencedObjects,
+    image_base_name: &str,
+    image_repository: &str,
+    pkg_version: &str,
     product_config_manager: &ProductConfigManager,
 ) -> Result<ValidatedHiveCluster, Error> {
+    let resolved_product_image = hive
+        .spec
+        .image
+        .resolve(image_base_name, image_repository, pkg_version)
+        .context(ResolveProductImageSnafu)?;
+
     let role = hive.spec.metastore.as_ref().context(NoMetaStoreRoleSnafu)?;
 
     let validated_config = validate_all_roles_and_groups_config(
-        &dereferenced.resolved_product_image.product_version,
+        &resolved_product_image.product_version,
         &transform_all_roles_to_config(
             hive,
             &[(
@@ -137,7 +149,7 @@ pub fn validate_cluster(
     role_groups.insert(hive_role, group_configs);
 
     Ok(ValidatedHiveCluster {
-        image: dereferenced.resolved_product_image.clone(),
+        image: resolved_product_image,
         role_groups,
         role_configs,
     })