refactor: Decouple config-file builders from the HiveCluster spec

Resolve the JDBC driver, Kerberos hive-site entries and the core-site decision
into ValidatedClusterConfig during validation, so hive_site/core_site builders
consume only ValidatedClusterConfig. config_map keeps an explicit `owner:
&HiveCluster` solely for the ObjectMeta owner reference. Rename the reconcile
binding `validated` -> `validated_cluster`.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: maltesander

rust/operator-binary/src/controller.rs

@@ -322,10 +322,20 @@ pub struct ValidatedCluster {
 }
 
 /// Cluster-wide settings resolved during validation and dereferencing.
+///
+/// Everything the config-file builders need is resolved here so they never have to
+/// read the raw [`v1alpha1::HiveCluster`] spec.
 pub struct ValidatedClusterConfig {
     pub metadata_database_connection_details: JdbcDatabaseConnectionDetails,
+    /// The resolved JDBC driver class (Derby version special-casing already applied).
+    pub connection_driver: String,
     pub s3_connection_spec: Option<s3::v1alpha1::ConnectionSpec>,
     pub hive_opa_config: Option<HiveOpaConfig>,
+    /// Kerberos-related `hive-site.xml` entries (empty when Kerberos is disabled).
+    pub kerberos_config: BTreeMap<String, String>,
+    /// Whether a `core-site.xml` with `hadoop.security.authentication=kerberos` is
+    /// required (Kerberos enabled and no HDFS backend).
+    pub needs_kerberos_core_site: bool,
 }
 
 /// Per-role configuration extracted during validation.
@@ -352,9 +362,11 @@ pub async fn reconcile_hive(
         .await
         .context(DereferenceSnafu)?;
 
-    let validated = validate::validate_cluster(
+    let validated_cluster = validate::validate_cluster(
         hive,
         &ctx.operator_environment.image_repository,
+        &hive_namespace,
+        &client.kubernetes_cluster_info,
         dereferenced_objects,
     )
     .context(ValidateSnafu)?;
@@ -390,24 +402,22 @@ pub async fn reconcile_hive(
 
     let mut ss_cond_builder = StatefulSetConditionBuilder::default();
 
-    for (hive_role, role_group_configs) in &validated.role_group_configs {
+    for (hive_role, role_group_configs) in &validated_cluster.role_group_configs {
         for (rolegroup_name, rg) in role_group_configs {
             let rolegroup = hive.metastore_rolegroup_ref(rolegroup_name);
 
             let rg_metrics_service =
-                build_rolegroup_metrics_service(hive, &validated.image, &rolegroup)
+                build_rolegroup_metrics_service(hive, &validated_cluster.image, &rolegroup)
                     .context(ServiceConfigurationSnafu)?;
 
             let rg_headless_service =
-                build_rolegroup_headless_service(hive, &validated.image, &rolegroup)
+                build_rolegroup_headless_service(hive, &validated_cluster.image, &rolegroup)
                     .context(ServiceConfigurationSnafu)?;
 
             let rg_configmap = build::config_map::build_metastore_rolegroup_config_map(
                 hive,
-                &hive_namespace,
-                &validated,
+                &validated_cluster,
                 &rolegroup,
-                &client.kubernetes_cluster_info,
             )
             .with_context(|_| BuildRoleGroupConfigMapSnafu {
                 rolegroup: rolegroup.clone(),
@@ -416,7 +426,7 @@ pub async fn reconcile_hive(
             let rg_statefulset = build_metastore_rolegroup_statefulset(
                 hive,
                 hive_role,
-                &validated,
+                &validated_cluster,
                 &rolegroup,
                 rg,
                 &rbac_sa.name_any(),
@@ -460,7 +470,7 @@ pub async fn reconcile_hive(
     // We don't /need/ stability, but it's still nice to avoid spurious changes where possible.
     let mut discovery_hash = FnvHasher::with_key(0);
 
-    if let Some(role_config) = validated.role_config {
+    if let Some(role_config) = validated_cluster.role_config {
         add_pdbs(
             &role_config.pdb,
             hive,
@@ -473,7 +483,7 @@ pub async fn reconcile_hive(
 
         let role_listener: Listener = build_role_listener(
             hive,
-            &validated.image,
+            &validated_cluster.image,
             &HiveRole::MetaStore,
             &role_config.listener_class,
         )
@@ -488,7 +498,7 @@ pub async fn reconcile_hive(
             hive,
             hive,
             HiveRole::MetaStore,
-            &validated.image,
+            &validated_cluster.image,
             None,
             listener,
         )

rust/operator-binary/src/controller/build/config_map.rs

@@ -5,7 +5,6 @@ use stackable_operator::{
     builder::{configmap::ConfigMapBuilder, meta::ObjectMetaBuilder},
     k8s_openapi::api::core::v1::ConfigMap,
     role_utils::RoleGroupRef,
-    utils::cluster_info::KubernetesClusterInfo,
 };
 
 use crate::{
@@ -60,11 +59,9 @@ type Result<T, E = Error> = std::result::Result<T, E>;
 /// The rolegroup [`ConfigMap`] configures the rolegroup based on the configuration given by the
 /// administrator.
 pub fn build_metastore_rolegroup_config_map(
-    hive: &v1alpha1::HiveCluster,
-    hive_namespace: &str,
+    owner: &v1alpha1::HiveCluster,
     cluster: &ValidatedCluster,
     rolegroup: &RoleGroupRef<v1alpha1::HiveCluster>,
-    cluster_info: &KubernetesClusterInfo,
 ) -> Result<ConfigMap> {
     let rg = cluster
         .role_group_configs
@@ -77,14 +74,9 @@ pub fn build_metastore_rolegroup_config_map(
     // hive-site.xml
     let hive_site_overrides = resolved_overrides(rg.config_overrides.hive_site_xml.clone());
     let hive_site_data = hive_site::build(
-        hive,
-        hive_namespace,
+        &cluster.cluster_config,
         &cluster.image.product_version,
         &rg.config,
-        &cluster.cluster_config.metadata_database_connection_details,
-        cluster.cluster_config.s3_connection_spec.as_ref(),
-        cluster.cluster_config.hive_opa_config.as_ref(),
-        cluster_info,
         hive_site_overrides,
     )
     .context(BuildHiveSiteSnafu)?;
@@ -97,12 +89,12 @@ pub fn build_metastore_rolegroup_config_map(
     cm_builder
         .metadata(
             ObjectMetaBuilder::new()
-                .name_and_namespace(hive)
+                .name_and_namespace(owner)
                 .name(rolegroup.object_name())
-                .ownerreference_from_resource(hive, None, Some(true))
+                .ownerreference_from_resource(owner, None, Some(true))
                 .context(ObjectMissingMetadataForOwnerRefSnafu)?
                 .with_recommended_labels(&build_recommended_labels(
-                    hive,
+                    owner,
                     &cluster.image.app_version_label_value,
                     &rolegroup.role,
                     &rolegroup.role_group,
@@ -118,7 +110,7 @@ pub fn build_metastore_rolegroup_config_map(
         );
 
     // core-site.xml is only required when Kerberos is enabled without an HDFS backend.
-    if let Some(core_site_data) = core_site::build(hive) {
+    if let Some(core_site_data) = core_site::build(&cluster.cluster_config) {
         cm_builder.add_data(CORE_SITE_XML, to_hadoop_xml(core_site_data.iter()));
     }
 

rust/operator-binary/src/controller/build/properties.rs

@@ -17,3 +17,59 @@ pub(crate) fn resolved_overrides(overrides: KeyValueConfigOverrides) -> BTreeMap
         .filter_map(|(key, value)| value.map(|value| (key, value)))
         .collect()
 }
+
+#[cfg(test)]
+pub(crate) mod test_support {
+    use std::collections::BTreeMap;
+
+    use crate::{
+        controller::ValidatedClusterConfig,
+        crd::{
+            databases::{MetadataDatabaseConnection, derby_driver_class},
+            v1alpha1,
+        },
+    };
+
+    pub const DERBY_YAML: &str = r#"
+        apiVersion: hive.stackable.tech/v1alpha1
+        kind: HiveCluster
+        metadata:
+          name: simple-hive
+          namespace: default
+        spec:
+          image:
+            productVersion: "4.0.0"
+          clusterConfig:
+            metadataDatabase:
+              derby: {}
+          metastore:
+            roleGroups:
+              default:
+                replicas: 1
+        "#;
+
+    /// Build a minimal Derby-backed [`ValidatedClusterConfig`] for builder tests.
+    pub fn derby_cluster_config() -> ValidatedClusterConfig {
+        let hive: v1alpha1::HiveCluster =
+            stackable_operator::utils::yaml_from_str_singleton_map(DERBY_YAML)
+                .expect("valid HiveCluster YAML");
+        let metadata_database_connection_details = hive
+            .spec
+            .cluster_config
+            .metadata_database
+            .jdbc_connection_details("METADATA")
+            .expect("derby connection details");
+        let connection_driver = match &hive.spec.cluster_config.metadata_database {
+            MetadataDatabaseConnection::Derby(_) => derby_driver_class("4.0.0").to_owned(),
+            _ => metadata_database_connection_details.driver.clone(),
+        };
+        ValidatedClusterConfig {
+            metadata_database_connection_details,
+            connection_driver,
+            s3_connection_spec: None,
+            hive_opa_config: None,
+            kerberos_config: BTreeMap::new(),
+            needs_kerberos_core_site: false,
+        }
+    }
+}

rust/operator-binary/src/controller/build/properties/core_site.rs

@@ -1,17 +1,18 @@
 //! Builder for `core-site.xml`.
 //!
-//! Only emitted when Kerberos is enabled and there is no HDFS backend (i.e. S3),
-//! in which case `hadoop.security.authentication=kerberos` is required.
+//! Only emitted when Kerberos is enabled without an HDFS backend (resolved during
+//! validation as [`ValidatedClusterConfig::needs_kerberos_core_site`]), in which case
+//! `hadoop.security.authentication=kerberos` is required.
 
 use std::collections::BTreeMap;
 
-use crate::crd::v1alpha1;
+use crate::controller::ValidatedClusterConfig;
 
 const HADOOP_SECURITY_AUTHENTICATION: &str = "hadoop.security.authentication";
 
 /// Returns the `core-site.xml` properties, or `None` if the file should be omitted.
-pub fn build(hive: &v1alpha1::HiveCluster) -> Option<BTreeMap<String, Option<String>>> {
-    if hive.has_kerberos_enabled() && hive.spec.cluster_config.hdfs.is_none() {
+pub fn build(cluster_config: &ValidatedClusterConfig) -> Option<BTreeMap<String, Option<String>>> {
+    if cluster_config.needs_kerberos_core_site {
         let mut data = BTreeMap::new();
         data.insert(
             HADOOP_SECURITY_AUTHENTICATION.to_string(),
@@ -26,93 +27,22 @@ pub fn build(hive: &v1alpha1::HiveCluster) -> Option<BTreeMap<String, Option<Str
 #[cfg(test)]
 mod tests {
     use super::*;
-
-    fn hive_cluster(yaml: &str) -> v1alpha1::HiveCluster {
-        stackable_operator::utils::yaml_from_str_singleton_map(yaml)
-            .expect("valid HiveCluster YAML")
-    }
-
-    const NO_KERBEROS_YAML: &str = r#"
-        apiVersion: hive.stackable.tech/v1alpha1
-        kind: HiveCluster
-        metadata:
-          name: simple-hive
-          namespace: default
-        spec:
-          image:
-            productVersion: "4.0.0"
-          clusterConfig:
-            metadataDatabase:
-              derby: {}
-          metastore:
-            roleGroups:
-              default:
-                replicas: 1
-        "#;
-
-    const KERBEROS_S3_YAML: &str = r#"
-        apiVersion: hive.stackable.tech/v1alpha1
-        kind: HiveCluster
-        metadata:
-          name: simple-hive
-          namespace: default
-        spec:
-          image:
-            productVersion: "4.0.0"
-          clusterConfig:
-            authentication:
-              kerberos:
-                secretClass: kerberos
-            metadataDatabase:
-              derby: {}
-          metastore:
-            roleGroups:
-              default:
-                replicas: 1
-        "#;
-
-    const KERBEROS_HDFS_YAML: &str = r#"
-        apiVersion: hive.stackable.tech/v1alpha1
-        kind: HiveCluster
-        metadata:
-          name: simple-hive
-          namespace: default
-        spec:
-          image:
-            productVersion: "4.0.0"
-          clusterConfig:
-            authentication:
-              kerberos:
-                secretClass: kerberos
-            metadataDatabase:
-              derby: {}
-            hdfs:
-              configMap: hdfs
-          metastore:
-            roleGroups:
-              default:
-                replicas: 1
-        "#;
+    use crate::controller::build::properties::test_support::derby_cluster_config;
 
     #[test]
-    fn omitted_without_kerberos() {
-        let hive = hive_cluster(NO_KERBEROS_YAML);
-        assert!(build(&hive).is_none());
+    fn omitted_when_not_required() {
+        let cluster_config = derby_cluster_config();
+        assert!(build(&cluster_config).is_none());
     }
 
     #[test]
-    fn emitted_with_kerberos_and_no_hdfs() {
-        let hive = hive_cluster(KERBEROS_S3_YAML);
-        let data = build(&hive).expect("core-site present");
+    fn emitted_when_required() {
+        let mut cluster_config = derby_cluster_config();
+        cluster_config.needs_kerberos_core_site = true;
+        let data = build(&cluster_config).expect("core-site present");
         assert_eq!(
             data.get("hadoop.security.authentication"),
             Some(&Some("kerberos".to_string()))
         );
     }
-
-    #[test]
-    fn omitted_with_kerberos_but_hdfs_backend() {
-        let hive = hive_cluster(KERBEROS_HDFS_YAML);
-        assert!(build(&hive).is_none());
-    }
 }