refactor: remove remaining raw cluster references in resource builders

Author: maltesander

rust/operator-binary/src/controller.rs

@@ -50,7 +50,7 @@ use crate::{
             service::{build_rolegroup_headless_service, build_rolegroup_metrics_service},
         },
     },
-    crd::{APP_NAME, HiveClusterStatus, HiveRole, MetaStoreConfig, v1alpha1},
+    crd::{APP_NAME, HdfsConnection, HiveClusterStatus, HiveRole, MetaStoreConfig, v1alpha1},
 };
 
 pub const HIVE_CONTROLLER_NAME: &str = "hivecluster";
@@ -284,6 +284,14 @@ impl ValidatedCluster {
         role_group_selector(self, &product_name(), &Self::role_name(), role_group_name)
     }
 
+    /// Whether Kerberos is enabled for this cluster (a Kerberos `SecretClass` was configured).
+    ///
+    /// Mirrors [`v1alpha1::HiveCluster::has_kerberos_enabled`], derived here from the validated
+    /// config so build steps don't have to re-read the raw cluster.
+    pub fn has_kerberos_enabled(&self) -> bool {
+        self.cluster_config.kerberos_secret_class.is_some()
+    }
+
     /// The name of the per-role [`Listener`] object.
     ///
     /// Must stay in sync with [`v1alpha1::HiveCluster::role_listener_name`], which derives the
@@ -392,8 +400,14 @@ pub struct ValidatedClusterConfig {
     pub metadata_database_connection_details: JdbcDatabaseConnectionDetails,
     /// The resolved JDBC driver class (Derby version special-casing already applied).
     pub connection_driver: String,
+    /// The database type passed to Hive via the `--db-type` CLI argument (e.g. `derby`).
+    pub db_type: String,
+    /// The HDFS connection (discovery ConfigMap reference), if an HDFS backend is configured.
+    pub hdfs: Option<HdfsConnection>,
     pub s3_connection_spec: Option<s3::v1alpha1::ConnectionSpec>,
     pub hive_opa_config: Option<HiveOpaConfig>,
+    /// The Kerberos `SecretClass` name, if Kerberos is enabled.
+    pub kerberos_secret_class: Option<String>,
     /// Kerberos-related `hive-site.xml` entries (empty when Kerberos is disabled).
     pub kerberos_config: BTreeMap<String, String>,
     /// Whether a `core-site.xml` with `hadoop.security.authentication=kerberos` is
@@ -492,7 +506,6 @@ pub async fn reconcile_hive(
 
             let rg_statefulset =
                 build::resource::statefulset::build_metastore_rolegroup_statefulset(
-                    hive,
                     hive_role,
                     &validated_cluster,
                     role_group_name,

rust/operator-binary/src/controller/build/command.rs

@@ -3,13 +3,16 @@ use stackable_operator::crd::s3;
 use super::{
     opa::HiveOpaConfig, properties::ConfigFileName, resource::statefulset::HDFS_CONFIG_MOUNT_DIR,
 };
-use crate::crd::{
-    STACKABLE_CONFIG_DIR, STACKABLE_CONFIG_MOUNT_DIR, STACKABLE_LOG_CONFIG_MOUNT_DIR,
-    STACKABLE_TRUST_STORE, STACKABLE_TRUST_STORE_PASSWORD, v1alpha1,
+use crate::{
+    controller::ValidatedCluster,
+    crd::{
+        STACKABLE_CONFIG_DIR, STACKABLE_CONFIG_MOUNT_DIR, STACKABLE_LOG_CONFIG_MOUNT_DIR,
+        STACKABLE_TRUST_STORE, STACKABLE_TRUST_STORE_PASSWORD,
+    },
 };
 
 pub fn build_container_command_args(
-    hive: &v1alpha1::HiveCluster,
+    cluster: &ValidatedCluster,
     start_command: String,
     s3_connection_spec: Option<&s3::v1alpha1::ConnectionSpec>,
     hive_opa_config: Option<&HiveOpaConfig>,
@@ -40,7 +43,7 @@ pub fn build_container_command_args(
         ),
     ];
 
-    if hive.spec.cluster_config.hdfs.is_some() {
+    if cluster.cluster_config.hdfs.is_some() {
         args.extend([
             format!("echo copying {HDFS_CONFIG_MOUNT_DIR} to {STACKABLE_CONFIG_DIR}"),
             format!("cp -RL {HDFS_CONFIG_MOUNT_DIR}/* {STACKABLE_CONFIG_DIR}"),

rust/operator-binary/src/controller/build/jvm.rs

@@ -3,10 +3,10 @@ use stackable_operator::memory::{BinaryMultiple, MemoryQuantity};
 
 use super::{kerberos::STACKABLE_KERBEROS_DIR, properties::ConfigFileName};
 use crate::{
-    controller::HiveRoleGroupConfig,
+    controller::{HiveRoleGroupConfig, ValidatedCluster},
     crd::{
         METRICS_PORT, MetaStoreConfig, STACKABLE_CONFIG_DIR, STACKABLE_TRUST_STORE,
-        STACKABLE_TRUST_STORE_PASSWORD, v1alpha1::HiveCluster,
+        STACKABLE_TRUST_STORE_PASSWORD,
     },
 };
 
@@ -24,7 +24,7 @@ pub enum Error {
 }
 
 /// All JVM arguments.
-fn construct_jvm_args(hive: &HiveCluster, rg: &HiveRoleGroupConfig) -> Vec<String> {
+fn construct_jvm_args(cluster: &ValidatedCluster, rg: &HiveRoleGroupConfig) -> Vec<String> {
     let security_properties = ConfigFileName::Security;
     let mut jvm_args = vec![
         format!("-Djava.security.properties={STACKABLE_CONFIG_DIR}/{security_properties}"),
@@ -36,7 +36,7 @@ fn construct_jvm_args(hive: &HiveCluster, rg: &HiveRoleGroupConfig) -> Vec<Strin
         format!("-Djavax.net.ssl.trustStoreType=pkcs12"),
     ];
 
-    if hive.has_kerberos_enabled() {
+    if cluster.has_kerberos_enabled() {
         jvm_args.push(format!(
             "-Djava.security.krb5.conf={STACKABLE_KERBEROS_DIR}/krb5.conf"
         ));
@@ -49,8 +49,8 @@ fn construct_jvm_args(hive: &HiveCluster, rg: &HiveRoleGroupConfig) -> Vec<Strin
 
 /// Arguments that go into `HADOOP_OPTS`, so *not* the heap settings (which you can get using
 /// [`construct_hadoop_heapsize_env`]).
-pub fn construct_non_heap_jvm_args(hive: &HiveCluster, rg: &HiveRoleGroupConfig) -> String {
-    let mut jvm_args = construct_jvm_args(hive, rg);
+pub fn construct_non_heap_jvm_args(cluster: &ValidatedCluster, rg: &HiveRoleGroupConfig) -> String {
+    let mut jvm_args = construct_jvm_args(cluster, rg);
     jvm_args.retain(|arg| !is_heap_jvm_argument(arg));
 
     jvm_args.join(" ")
@@ -88,14 +88,17 @@ mod tests {
         crd::HiveRole,
     };
 
-    fn metastore_default(hive: &crate::crd::v1alpha1::HiveCluster) -> HiveRoleGroupConfig {
+    fn metastore_default(
+        hive: &crate::crd::v1alpha1::HiveCluster,
+    ) -> (ValidatedCluster, HiveRoleGroupConfig) {
         let validated = validated_cluster(hive);
-        validated
+        let rg = validated
             .role_group_configs
             .get(&HiveRole::MetaStore)
             .and_then(|groups| groups.get(&"default".parse().expect("valid role group name")))
             .expect("metastore default role group should exist")
-            .clone()
+            .clone();
+        (validated, rg)
     }
 
     #[test]
@@ -119,8 +122,8 @@ mod tests {
                 replicas: 1
         "#;
         let hive = minimal_hive(input);
-        let rg = metastore_default(&hive);
-        let non_heap_jvm_args = construct_non_heap_jvm_args(&hive, &rg);
+        let (cluster, rg) = metastore_default(&hive);
+        let non_heap_jvm_args = construct_non_heap_jvm_args(&cluster, &rg);
         let hadoop_heapsize_env = construct_hadoop_heapsize_env(&rg.config).unwrap();
 
         assert_eq!(
@@ -174,8 +177,8 @@ mod tests {
                     - -Dhttps.proxyPort=1234
         "#;
         let hive = minimal_hive(input);
-        let rg = metastore_default(&hive);
-        let non_heap_jvm_args = construct_non_heap_jvm_args(&hive, &rg);
+        let (cluster, rg) = metastore_default(&hive);
+        let non_heap_jvm_args = construct_non_heap_jvm_args(&cluster, &rg);
         let hadoop_heapsize_env = construct_hadoop_heapsize_env(&rg.config).unwrap();
 
         assert_eq!(

rust/operator-binary/src/controller/build/kerberos.rs

@@ -15,13 +15,15 @@ use stackable_operator::{
         },
     },
     commons::secret_class::SecretClassVolumeProvisionParts,
-    kube::ResourceExt,
     utils::cluster_info::KubernetesClusterInfo,
     v2::types::kubernetes::VolumeName,
 };
 
 use super::properties::ConfigFileName;
-use crate::crd::{HiveRole, STACKABLE_CONFIG_DIR, v1alpha1};
+use crate::{
+    controller::ValidatedCluster,
+    crd::{HiveRole, STACKABLE_CONFIG_DIR},
+};
 
 // Typed name for the Kerberos secret-operator volume, reusing the existing `"kerberos"` string
 // value so the produced volume/mount name is unchanged.
@@ -49,19 +51,19 @@ pub enum Error {
 }
 
 pub fn add_kerberos_pod_config(
-    hive: &v1alpha1::HiveCluster,
+    cluster: &ValidatedCluster,
     role: &HiveRole,
     cb: &mut ContainerBuilder,
     pb: &mut PodBuilder,
 ) -> Result<(), Error> {
-    if let Some(kerberos_secret_class) = hive.kerberos_secret_class() {
+    if let Some(kerberos_secret_class) = &cluster.cluster_config.kerberos_secret_class {
         // Mount keytab
         let kerberos_secret_operator_volume = SecretOperatorVolumeSourceBuilder::new(
-            kerberos_secret_class,
+            kerberos_secret_class.clone(),
             // We need both public (krb5.conf) and private (keytab) parts.
             SecretClassVolumeProvisionParts::PublicPrivate,
         )
-        .with_service_scope(hive.name_any())
+        .with_service_scope(cluster.name.to_string())
         .with_kerberos_service_name(role.kerberos_service_name())
         .build()
         .context(AddKerberosSecretVolumeSnafu)?;
@@ -115,8 +117,8 @@ pub fn kerberos_config_properties(
     ])
 }
 
-pub fn kerberos_container_start_commands(hive: &v1alpha1::HiveCluster) -> String {
-    if !hive.has_kerberos_enabled() {
+pub fn kerberos_container_start_commands(cluster: &ValidatedCluster) -> String {
+    if !cluster.has_kerberos_enabled() {
         return String::new();
     }
 
@@ -126,7 +128,7 @@ pub fn kerberos_container_start_commands(hive: &v1alpha1::HiveCluster) -> String
         sed -i -e 's/${{env.KERBEROS_REALM}}/'\"$KERBEROS_REALM/g\" {STACKABLE_CONFIG_DIR}/{hive_site_xml}",
     }];
 
-    if hive.spec.cluster_config.hdfs.is_some() {
+    if cluster.cluster_config.hdfs.is_some() {
         let core_site_xml = ConfigFileName::CoreSite;
         let hdfs_site_xml = ConfigFileName::HdfsSite;
         args.extend([

rust/operator-binary/src/controller/build/properties/mod.rs

@@ -64,11 +64,20 @@ pub(crate) mod test_support {
             MetadataDatabaseConnection::Derby(_) => derby_driver_class("4.0.0").to_owned(),
             _ => metadata_database_connection_details.driver.clone(),
         };
+        let db_type = hive
+            .spec
+            .cluster_config
+            .metadata_database
+            .as_hive_db_type()
+            .to_owned();
         ValidatedClusterConfig {
             metadata_database_connection_details,
             connection_driver,
+            db_type,
+            hdfs: None,
             s3_connection_spec: None,
             hive_opa_config: None,
+            kerberos_secret_class: None,
             kerberos_config: BTreeMap::new(),
             needs_kerberos_core_site: false,
         }

rust/operator-binary/src/controller/build/resource/statefulset.rs

@@ -61,7 +61,7 @@ use crate::{
         HIVE_PORT, HIVE_PORT_NAME, HiveRole, METRICS_PORT, METRICS_PORT_NAME, STACKABLE_CONFIG_DIR,
         STACKABLE_CONFIG_DIR_NAME, STACKABLE_CONFIG_MOUNT_DIR, STACKABLE_CONFIG_MOUNT_DIR_NAME,
         STACKABLE_LOG_CONFIG_MOUNT_DIR, STACKABLE_LOG_CONFIG_MOUNT_DIR_NAME,
-        STACKABLE_LOG_DIR_NAME, v1alpha1,
+        STACKABLE_LOG_DIR_NAME,
     },
 };
 
@@ -144,7 +144,6 @@ pub(crate) const HDFS_CONFIG_MOUNT_DIR: &str = "/stackable/mount/hdfs-config";
 /// The [`Pod`](`stackable_operator::k8s_openapi::api::core::v1::Pod`)s are accessible through the
 /// corresponding [`Service`](`stackable_operator::k8s_openapi::api::core::v1::Service`) (via [`build_rolegroup_headless_service`](super::service::build_rolegroup_headless_service) and metrics from [`build_rolegroup_metrics_service`](super::service::build_rolegroup_metrics_service)).
 pub(crate) fn build_metastore_rolegroup_statefulset(
-    hive: &v1alpha1::HiveCluster,
     hive_role: &HiveRole,
     cluster: &ValidatedCluster,
     role_group_name: &RoleGroupName,
@@ -165,7 +164,7 @@ pub(crate) fn build_metastore_rolegroup_statefulset(
             "HADOOP_HEAPSIZE",
             construct_hadoop_heapsize_env(merged_config).context(ConstructJvmArgumentsSnafu)?,
         )
-        .add_env_var("HADOOP_OPTS", construct_non_heap_jvm_args(hive, rg))
+        .add_env_var("HADOOP_OPTS", construct_non_heap_jvm_args(cluster, rg))
         .add_env_var(
             "CONTAINERDEBUG_LOG_DIRECTORY",
             format!("{STACKABLE_LOG_DIR}/containerdebug"),
@@ -178,7 +177,7 @@ pub(crate) fn build_metastore_rolegroup_statefulset(
 
     let mut pod_builder = PodBuilder::new();
 
-    if let Some(hdfs) = &hive.spec.cluster_config.hdfs {
+    if let Some(hdfs) = &cluster.cluster_config.hdfs {
         pod_builder
             .add_volume(
                 VolumeBuilder::new(&*HDFS_DISCOVERY_VOLUME_NAME)
@@ -230,7 +229,7 @@ pub(crate) fn build_metastore_rolegroup_statefulset(
             .context(AddVolumeSnafu)?;
     }
 
-    let db_type = hive.spec.cluster_config.metadata_database.as_hive_db_type();
+    let db_type = &cluster.cluster_config.db_type;
     let start_command = if resolved_product_image.product_version.starts_with("3.") {
         // The schematool version in 3.1.x does *not* support the `-initOrUpgradeSchema` flag yet, so we can not use that.
         // As we *only* support HMS 3.1.x (or newer) since SDP release 23.11, we can safely assume we are always coming
@@ -262,7 +261,7 @@ pub(crate) fn build_metastore_rolegroup_statefulset(
             "-c".to_string(),
         ])
         .args(build_container_command_args(
-            hive,
+            cluster,
             formatdoc! {"
             {kerberos_container_start_commands}
 
@@ -274,7 +273,7 @@ pub(crate) fn build_metastore_rolegroup_statefulset(
             wait_for_termination $!
             {create_vector_shutdown_file_command}
             ",
-                kerberos_container_start_commands = kerberos_container_start_commands(hive),
+                kerberos_container_start_commands = kerberos_container_start_commands(cluster),
                 remove_vector_shutdown_file_command =
                     remove_vector_shutdown_file_command(STACKABLE_LOG_DIR),
                 create_vector_shutdown_file_command =
@@ -403,8 +402,8 @@ pub(crate) fn build_metastore_rolegroup_statefulset(
 
     add_graceful_shutdown_config(merged_config, &mut pod_builder).context(GracefulShutdownSnafu)?;
 
-    if hive.has_kerberos_enabled() {
-        add_kerberos_pod_config(hive, hive_role, container_builder, &mut pod_builder)
+    if cluster.has_kerberos_enabled() {
+        add_kerberos_pod_config(cluster, hive_role, container_builder, &mut pod_builder)
             .context(AddKerberosConfigSnafu)?;
     }
 

rust/operator-binary/src/controller/validate.rs

@@ -228,17 +228,28 @@ pub fn validate_cluster(
         _ => metadata_database_connection_details.driver.clone(),
     };
 
+    // The database type passed to Hive via the `--db-type` CLI argument.
+    let db_type = hive
+        .spec
+        .cluster_config
+        .metadata_database
+        .as_hive_db_type()
+        .to_owned();
+
+    let hdfs = hive.spec.cluster_config.hdfs.clone();
+
+    let kerberos_secret_class = hive.kerberos_secret_class();
+
     // Kerberos-related `hive-site.xml` entries (empty when Kerberos is disabled).
-    let kerberos_config = if hive.has_kerberos_enabled() {
+    let kerberos_config = if kerberos_secret_class.is_some() {
         kerberos_config_properties(name.as_ref(), namespace.as_ref(), cluster_info)
     } else {
         BTreeMap::new()
     };
 
     // A `core-site.xml` with `hadoop.security.authentication=kerberos` is required when
     // Kerberos is enabled and there is no HDFS backend (i.e. S3).
-    let needs_kerberos_core_site =
-        hive.has_kerberos_enabled() && hive.spec.cluster_config.hdfs.is_none();
+    let needs_kerberos_core_site = kerberos_secret_class.is_some() && hdfs.is_none();
 
     Ok(ValidatedCluster::new(
         name,
@@ -249,8 +260,11 @@ pub fn validate_cluster(
         ValidatedClusterConfig {
             metadata_database_connection_details,
             connection_driver,
+            db_type,
+            hdfs,
             s3_connection_spec: dereferenced_objects.s3_connection_spec,
             hive_opa_config: dereferenced_objects.hive_opa_config,
+            kerberos_secret_class,
             kerberos_config,
             needs_kerberos_core_site,
         },