chore: Comment the usages of SecretClassVolumeProvisionParts

Author: siegfriedweber

rust/operator-binary/src/config/jvm.rs

@@ -27,11 +27,14 @@ pub enum Error {
 }
 
 /// All JVM arguments.
-fn construct_jvm_args<ConfigFragment, ConfigOverrides: Default + JsonSchema + Serialize>(
+fn construct_jvm_args<ConfigFragment, ConfigOverrides>(
     merged_config: &AnyConfig,
     role: &Role<ConfigFragment, ConfigOverrides, GenericRoleConfig, JavaCommonConfig>,
     role_group: &str,
-) -> Result<Vec<String>, Error> {
+) -> Result<Vec<String>, Error>
+where
+    ConfigOverrides: Default + JsonSchema + Serialize,
+{
     let heap_size = MemoryQuantity::try_from(
         merged_config
             .resources()
@@ -69,14 +72,14 @@ fn construct_jvm_args<ConfigFragment, ConfigOverrides: Default + JsonSchema + Se
 
 /// Arguments that go into `EXTRA_ARGS`, so *not* the heap settings (which you can get using
 /// [`construct_heap_jvm_args`]).
-pub fn construct_non_heap_jvm_args<
-    ConfigFragment,
-    ConfigOverrides: Default + JsonSchema + Serialize,
->(
+pub fn construct_non_heap_jvm_args<ConfigFragment, ConfigOverrides>(
     merged_config: &AnyConfig,
     role: &Role<ConfigFragment, ConfigOverrides, GenericRoleConfig, JavaCommonConfig>,
     role_group: &str,
-) -> Result<String, Error> {
+) -> Result<String, Error>
+where
+    ConfigOverrides: Default + JsonSchema + Serialize,
+{
     let mut jvm_args = construct_jvm_args(merged_config, role, role_group)?;
     jvm_args.retain(|arg| !is_heap_jvm_argument(arg));
 

rust/operator-binary/src/crd/role/mod.rs

@@ -23,7 +23,7 @@ use strum::{Display, EnumIter, EnumString, IntoEnumIterator};
 use crate::{
     config::jvm::{construct_heap_jvm_args, construct_non_heap_jvm_args},
     crd::role::{
-        broker::{BROKER_PROPERTIES_FILE, BrokerConfig, BrokerConfigFragment},
+        broker::{BROKER_PROPERTIES_FILE, BrokerConfig},
         commons::{CommonConfig, Storage},
         controller::{CONTROLLER_PROPERTIES_FILE, ControllerConfig},
     },
@@ -226,10 +226,7 @@ impl KafkaRole {
         rolegroup: &str,
     ) -> Result<String, Error> {
         match self {
-            Self::Broker => construct_non_heap_jvm_args::<
-                BrokerConfigFragment,
-                v1alpha1::KafkaBrokerConfigOverrides,
-            >(
+            Self::Broker => construct_non_heap_jvm_args(
                 merged_config,
                 kafka.broker_role().with_context(|_| MissingRoleSnafu {
                     role: self.to_string(),
@@ -255,10 +252,7 @@ impl KafkaRole {
         rolegroup: &str,
     ) -> Result<String, Error> {
         match self {
-            Self::Broker => construct_heap_jvm_args::<
-                BrokerConfigFragment,
-                v1alpha1::KafkaBrokerConfigOverrides,
-            >(
+            Self::Broker => construct_heap_jvm_args(
                 merged_config,
                 kafka.broker_role().with_context(|_| MissingRoleSnafu {
                     role: self.to_string(),

rust/operator-binary/src/crd/security.rs

@@ -527,6 +527,7 @@ impl KafkaTlsSecurity {
                         .ephemeral(
                             SecretOperatorVolumeSourceBuilder::new(
                                 secret_class,
+                                // Only the truststore is required to connect to OPA.
                                 SecretClassVolumeProvisionParts::Public,
                             )
                             .build()
@@ -555,6 +556,8 @@ impl KafkaTlsSecurity {
                         .ephemeral(
                             SecretOperatorVolumeSourceBuilder::new(
                                 tls_internal_secret_class,
+                                // Kafka needs both the public certificate and the private key for
+                                // the internal communication.
                                 SecretClassVolumeProvisionParts::PublicPrivate,
                             )
                             .with_pod_scope()
@@ -854,6 +857,8 @@ impl KafkaTlsSecurity {
             .ephemeral(
                 SecretOperatorVolumeSourceBuilder::new(
                     secret_class_name,
+                    // Both the public certificate and the private key are required for the kcat
+                    // client authentication.
                     SecretClassVolumeProvisionParts::PublicPrivate,
                 )
                 .with_pod_scope()
@@ -875,6 +880,7 @@ impl KafkaTlsSecurity {
             .ephemeral(
                 SecretOperatorVolumeSourceBuilder::new(
                     secret_class_name,
+                    // Both the keystore and truststore are required for keystore volume.
                     SecretClassVolumeProvisionParts::PublicPrivate,
                 )
                 .with_pod_scope()

rust/operator-binary/src/kerberos.rs

@@ -46,6 +46,7 @@ pub fn add_kerberos_pod_config(
         // Mount keytab
         let kerberos_secret_operator_volume = SecretOperatorVolumeSourceBuilder::new(
             kerberos_secret_class,
+            // We need both public (krb5.conf) and private (keytab) parts.
             SecretClassVolumeProvisionParts::PublicPrivate,
         )
         .with_listener_volume_scope(LISTENER_BROKER_VOLUME_NAME)