refactor: split opa config into deref and build steps

maltesander · maltesander · commit 68a3215f4624 · 2026-06-17T10:46:42.000+02:00
diff --git a/rust/operator-binary/src/controller.rs b/rust/operator-binary/src/controller.rs
@@ -49,14 +49,11 @@ use strum::EnumDiscriminants;
 
 use crate::{
     OPERATOR_NAME,
-    controller::build::{
-        opa::HiveOpaConfig,
-        resource::{
-            discovery,
-            listener::build_role_listener,
-            pdb::build_pdb,
-            service::{build_rolegroup_headless_service, build_rolegroup_metrics_service},
-        },
+    controller::build::resource::{
+        discovery,
+        listener::build_role_listener,
+        pdb::build_pdb,
+        service::{build_rolegroup_headless_service, build_rolegroup_metrics_service},
     },
     crd::{APP_NAME, HdfsConnection, HiveClusterStatus, HiveRole, MetaStoreConfig, v1alpha1},
 };
@@ -448,7 +445,7 @@ pub struct ValidatedClusterConfig {
     /// The HDFS connection (discovery ConfigMap reference), if an HDFS backend is configured.
     pub hdfs: Option<HdfsConnection>,
     pub s3_connection_spec: Option<s3::v1alpha1::ConnectionSpec>,
-    pub hive_opa_config: Option<HiveOpaConfig>,
+    pub hive_opa_config: Option<dereference::ResolvedOpaConfig>,
     /// The Kerberos `SecretClass` name, if Kerberos is enabled.
     pub kerberos_secret_class: Option<SecretClassName>,
 }
diff --git a/rust/operator-binary/src/controller/build/command.rs b/rust/operator-binary/src/controller/build/command.rs
@@ -1,10 +1,11 @@
 use stackable_operator::crd::s3;
 
 use super::{
-    opa::HiveOpaConfig, properties::ConfigFileName, resource::statefulset::HDFS_CONFIG_MOUNT_DIR,
+    opa::build_opa_tls_ca_cert_mount_path, properties::ConfigFileName,
+    resource::statefulset::HDFS_CONFIG_MOUNT_DIR,
 };
 use crate::{
-    controller::ValidatedCluster,
+    controller::{ValidatedCluster, dereference::ResolvedOpaConfig},
     crd::{
         STACKABLE_CONFIG_DIR, STACKABLE_CONFIG_MOUNT_DIR, STACKABLE_LOG_CONFIG_MOUNT_DIR,
         STACKABLE_TRUST_STORE, STACKABLE_TRUST_STORE_PASSWORD,
@@ -15,7 +16,7 @@ pub fn build_container_command_args(
     cluster: &ValidatedCluster,
     start_command: String,
     s3_connection_spec: Option<&s3::v1alpha1::ConnectionSpec>,
-    hive_opa_config: Option<&HiveOpaConfig>,
+    hive_opa_config: Option<&ResolvedOpaConfig>,
 ) -> Vec<String> {
     let log4j2_properties = ConfigFileName::Log4j2;
     let core_site = ConfigFileName::CoreSite;
@@ -59,7 +60,7 @@ pub fn build_container_command_args(
     }
 
     if let Some(opa) = hive_opa_config
-        && let Some(ca_cert_dir) = opa.tls_ca_cert_mount_path()
+        && let Some(ca_cert_dir) = build_opa_tls_ca_cert_mount_path(opa)
     {
         args.push(format!(
                 "cert-tools generate-pkcs12-truststore --pkcs12 {STACKABLE_TRUST_STORE}:{STACKABLE_TRUST_STORE_PASSWORD} --pem {ca_cert_dir}/ca.crt --out {STACKABLE_TRUST_STORE} --out-password {STACKABLE_TRUST_STORE_PASSWORD}"
diff --git a/rust/operator-binary/src/controller/build/opa.rs b/rust/operator-binary/src/controller/build/opa.rs
@@ -1,14 +1,8 @@
 use std::{collections::BTreeMap, str::FromStr};
 
-use stackable_operator::{
-    client::Client,
-    commons::opa::{OpaApiVersion, OpaConfig},
-    k8s_openapi::api::core::v1::ConfigMap,
-    kube::ResourceExt,
-    v2::types::kubernetes::VolumeName,
-};
+use stackable_operator::v2::types::kubernetes::VolumeName;
 
-use crate::crd::v1alpha1::HiveCluster;
+use crate::controller::dereference::ResolvedOpaConfig;
 
 const HIVE_METASTORE_PRE_EVENT_LISTENERS: &str = "hive.metastore.pre.event.listeners";
 const HIVE_SECURITY_METASTORE_AUTHORIZATION_MANAGER: &str =
@@ -38,95 +32,62 @@ const OPA_AUTHORIZATION_POLICY_URL_USER: &str = "com.bosch.bdps.opa.authorizatio
 // value so the produced volume/mount name is unchanged.
 stackable_operator::constant!(pub(crate) OPA_TLS_VOLUME_NAME: VolumeName = "opa-tls");
 
-pub struct HiveOpaConfig {
-    /// Endpoint for OPA, e.g.
-    /// `http://localhost:8081/v1/data/<package>`
-    pub(crate) base_endpoint: String,
-    /// Optional TLS secret class for OPA communication.
-    /// If set, the CA certificate from this secret class will be added
-    /// to hive's truststore to make it trust OPA's TLS certificate.
-    pub(crate) tls_secret_class: Option<String>,
-}
-
-impl HiveOpaConfig {
-    pub async fn from_opa_config(
-        client: &Client,
-        hive: &HiveCluster,
-        opa_config: &OpaConfig,
-    ) -> Result<Self, stackable_operator::commons::opa::Error> {
-        // See: https://github.com/boschglobal/hive-metastore-opa-authorizer?tab=readme-ov-file#configuration
-        let base_endpoint = opa_config
-            .full_document_url_from_config_map(client, hive, None, &OpaApiVersion::V1)
-            .await?;
-
-        let tls_secret_class = client
-            .get::<ConfigMap>(
-                &opa_config.config_map_name,
-                hive.namespace().as_deref().unwrap_or("default"),
-            )
-            .await
-            .ok()
-            .and_then(|cm| cm.data)
-            .and_then(|mut data| data.remove("OPA_SECRET_CLASS"));
+/// Builds the OPA-related `hive-site.xml` properties from a [`ResolvedOpaConfig`].
+pub fn build_opa_hive_site_config(
+    opa: &ResolvedOpaConfig,
+    product_version: &str,
+) -> BTreeMap<String, String> {
+    let (pre_event_listener, authorization_provider) = if product_version.starts_with("3.") {
+        (
+            OPA_AUTHORIZATION_PRE_EVENT_LISTENER_V3,
+            OPA_BASED_AUTHORIZATION_PROVIDER_V3,
+        )
+    } else {
+        (
+            OPA_AUTHORIZATION_PRE_EVENT_LISTENER_V4,
+            OPA_BASED_AUTHORIZATION_PROVIDER_V4,
+        )
+    };
 
-        Ok(HiveOpaConfig {
-            base_endpoint,
-            tls_secret_class,
-        })
-    }
-
-    pub fn as_config(&self, product_version: &str) -> BTreeMap<String, String> {
-        let (pre_event_listener, authorization_provider) = if product_version.starts_with("3.") {
-            (
-                OPA_AUTHORIZATION_PRE_EVENT_LISTENER_V3,
-                OPA_BASED_AUTHORIZATION_PROVIDER_V3,
-            )
-        } else {
-            (
-                OPA_AUTHORIZATION_PRE_EVENT_LISTENER_V4,
-                OPA_BASED_AUTHORIZATION_PROVIDER_V4,
-            )
-        };
-
-        BTreeMap::from([
-            (
-                HIVE_METASTORE_PRE_EVENT_LISTENERS.to_string(),
-                pre_event_listener.to_string(),
-            ),
-            (
-                HIVE_SECURITY_METASTORE_AUTHORIZATION_MANAGER.to_string(),
-                authorization_provider.to_string(),
-            ),
-            (
-                OPA_AUTHORIZATION_BASE_ENDPOINT.to_string(),
-                self.base_endpoint.to_owned(),
-            ),
-            (
-                OPA_AUTHORIZATION_POLICY_URL_DATA_BASE.to_string(),
-                "database_allow".to_string(),
-            ),
-            (
-                OPA_AUTHORIZATION_POLICY_URL_TABLE.to_string(),
-                "table_allow".to_string(),
-            ),
-            (
-                OPA_AUTHORIZATION_POLICY_URL_COLUMN.to_string(),
-                "column_allow".to_string(),
-            ),
-            (
-                OPA_AUTHORIZATION_POLICY_URL_PARTITION.to_string(),
-                "partition_allow".to_string(),
-            ),
-            (
-                OPA_AUTHORIZATION_POLICY_URL_USER.to_string(),
-                "user_allow".to_string(),
-            ),
-        ])
-    }
+    BTreeMap::from([
+        (
+            HIVE_METASTORE_PRE_EVENT_LISTENERS.to_string(),
+            pre_event_listener.to_string(),
+        ),
+        (
+            HIVE_SECURITY_METASTORE_AUTHORIZATION_MANAGER.to_string(),
+            authorization_provider.to_string(),
+        ),
+        (
+            OPA_AUTHORIZATION_BASE_ENDPOINT.to_string(),
+            opa.base_endpoint.to_owned(),
+        ),
+        (
+            OPA_AUTHORIZATION_POLICY_URL_DATA_BASE.to_string(),
+            "database_allow".to_string(),
+        ),
+        (
+            OPA_AUTHORIZATION_POLICY_URL_TABLE.to_string(),
+            "table_allow".to_string(),
+        ),
+        (
+            OPA_AUTHORIZATION_POLICY_URL_COLUMN.to_string(),
+            "column_allow".to_string(),
+        ),
+        (
+            OPA_AUTHORIZATION_POLICY_URL_PARTITION.to_string(),
+            "partition_allow".to_string(),
+        ),
+        (
+            OPA_AUTHORIZATION_POLICY_URL_USER.to_string(),
+            "user_allow".to_string(),
+        ),
+    ])
+}
 
-    pub fn tls_ca_cert_mount_path(&self) -> Option<String> {
-        self.tls_secret_class
-            .as_ref()
-            .map(|_| format!("/stackable/secrets/{}", *OPA_TLS_VOLUME_NAME))
-    }
+/// The mount path of the OPA TLS CA certificate, or `None` when OPA TLS is not configured.
+pub fn build_opa_tls_ca_cert_mount_path(opa: &ResolvedOpaConfig) -> Option<String> {
+    opa.tls_secret_class
+        .as_ref()
+        .map(|_| format!("/stackable/secrets/{}", *OPA_TLS_VOLUME_NAME))
 }
diff --git a/rust/operator-binary/src/controller/build/properties/hive_site.rs b/rust/operator-binary/src/controller/build/properties/hive_site.rs
@@ -4,7 +4,9 @@ use std::collections::BTreeMap;
 use snafu::{ResultExt, Snafu};
 use stackable_operator::{crd::s3, k8s_openapi::api::core::v1::EnvVar};
 
-use crate::controller::{ValidatedClusterConfig, ValidatedMetaStoreConfig};
+use crate::controller::{
+    ValidatedClusterConfig, ValidatedMetaStoreConfig, build::opa::build_opa_hive_site_config,
+};
 
 const DEFAULT_WAREHOUSE_DIR: &str = "/stackable/warehouse";
 const HIVE_METASTORE_PORT: &str = "hive.metastore.port";
@@ -103,7 +105,7 @@ pub fn build(
     data.extend(kerberos_config);
 
     if let Some(opa_config) = cluster_config.hive_opa_config.as_ref() {
-        data.extend(opa_config.as_config(product_version));
+        data.extend(build_opa_hive_site_config(opa_config, product_version));
     }
 
     // 3. Spec: warehouse dir from the merged CRD config (overrides the default).
diff --git a/rust/operator-binary/src/controller/build/resource/statefulset.rs b/rust/operator-binary/src/controller/build/resource/statefulset.rs
@@ -53,7 +53,7 @@ use crate::{
             graceful_shutdown::add_graceful_shutdown_config,
             jvm::{construct_hadoop_heapsize_env, construct_non_heap_jvm_args},
             kerberos::{add_kerberos_pod_config, kerberos_container_start_commands},
-            opa::OPA_TLS_VOLUME_NAME,
+            opa::{OPA_TLS_VOLUME_NAME, build_opa_tls_ca_cert_mount_path},
             properties::product_logging::MAX_HIVE_LOG_FILES_SIZE,
         },
     },
@@ -205,7 +205,7 @@ pub(crate) fn build_metastore_rolegroup_statefulset(
             opa_config
                 .tls_secret_class
                 .as_ref()
-                .zip(opa_config.tls_ca_cert_mount_path())
+                .zip(build_opa_tls_ca_cert_mount_path(opa_config))
         })
     {
         container_builder
@@ -215,7 +215,7 @@ pub(crate) fn build_metastore_rolegroup_statefulset(
         let opa_tls_volume = VolumeBuilder::new(&*OPA_TLS_VOLUME_NAME)
             .ephemeral(
                 SecretOperatorVolumeSourceBuilder::new(
-                    tls_secret_class,
+                    tls_secret_class.clone(),
                     // We only need the public CA certificate to verify the OPA server.
                     SecretClassVolumeProvisionParts::Public,
                 )
diff --git a/rust/operator-binary/src/controller/dereference.rs b/rust/operator-binary/src/controller/dereference.rs
@@ -1,7 +1,16 @@
+use std::str::FromStr;
+
 use snafu::{ResultExt, Snafu};
-use stackable_operator::{crd::s3, v2::controller_utils::get_namespace};
+use stackable_operator::{
+    client::Client,
+    commons::opa::{OpaApiVersion, OpaConfig},
+    crd::s3,
+    k8s_openapi::api::core::v1::ConfigMap,
+    kube::ResourceExt,
+    v2::{controller_utils::get_namespace, types::kubernetes::SecretClassName},
+};
 
-use crate::{controller::build::opa::HiveOpaConfig, crd::v1alpha1};
+use crate::crd::v1alpha1;
 
 #[derive(Snafu, Debug)]
 pub enum Error {
@@ -19,12 +28,60 @@ pub enum Error {
     InvalidOpaConfig {
         source: stackable_operator::commons::opa::Error,
     },
+
+    #[snafu(display("invalid OPA TLS secret class name"))]
+    ParseOpaTlsSecretClassName {
+        source: stackable_operator::v2::macros::attributed_string_type::Error,
+    },
 }
 
 /// External references resolved during the dereference step.
 pub struct DereferencedObjects {
     pub s3_connection_spec: Option<s3::v1alpha1::ConnectionSpec>,
-    pub hive_opa_config: Option<HiveOpaConfig>,
+    pub hive_opa_config: Option<ResolvedOpaConfig>,
+}
+
+/// OPA settings resolved from the cluster's OPA reference during the dereference step.
+pub struct ResolvedOpaConfig {
+    /// Endpoint for OPA, e.g.
+    /// `http://localhost:8081/v1/data/<package>`
+    pub(crate) base_endpoint: String,
+    /// Optional TLS secret class for OPA communication.
+    /// If set, the CA certificate from this secret class will be added
+    /// to hive's truststore to make it trust OPA's TLS certificate.
+    pub(crate) tls_secret_class: Option<SecretClassName>,
+}
+
+impl ResolvedOpaConfig {
+    pub async fn from_opa_config(
+        client: &Client,
+        hive: &v1alpha1::HiveCluster,
+        opa_config: &OpaConfig,
+    ) -> Result<Self, Error> {
+        // See: <https://github.com/boschglobal/hive-metastore-opa-authorizer?tab=readme-ov-file#configuration>
+        let base_endpoint = opa_config
+            .full_document_url_from_config_map(client, hive, None, &OpaApiVersion::V1)
+            .await
+            .context(InvalidOpaConfigSnafu)?;
+
+        let tls_secret_class = client
+            .get::<ConfigMap>(
+                &opa_config.config_map_name,
+                hive.namespace().as_deref().unwrap_or("default"),
+            )
+            .await
+            .ok()
+            .and_then(|cm| cm.data)
+            .and_then(|mut data| data.remove("OPA_SECRET_CLASS"))
+            .map(|name| SecretClassName::from_str(&name))
+            .transpose()
+            .context(ParseOpaTlsSecretClassNameSnafu)?;
+
+        Ok(ResolvedOpaConfig {
+            base_endpoint,
+            tls_secret_class,
+        })
+    }
 }
 
 pub async fn dereference(
@@ -45,11 +102,9 @@ pub async fn dereference(
         };
 
     let hive_opa_config = match hive.get_opa_config() {
-        Some(opa_config) => Some(
-            HiveOpaConfig::from_opa_config(client, hive, opa_config)
-                .await
-                .context(InvalidOpaConfigSnafu)?,
-        ),
+        Some(opa_config) => {
+            Some(ResolvedOpaConfig::from_opa_config(client, hive, opa_config).await?)
+        }
         None => None,
     };
 
