refactor: remove raw cluster references

Author: maltesander

rust/operator-binary/src/controller/build/properties.rs

@@ -83,8 +83,8 @@ pub(crate) mod test_support {
 
     use crate::{
         controller::{
-            ValidatedCluster, ValidatedClusterConfig, ValidatedRoleGroupConfig,
-            validate::build_role_group_configs,
+            ValidatedCluster, ValidatedClusterConfig, ValidatedRoleConfig,
+            ValidatedRoleGroupConfig, validate::build_role_group_configs,
         },
         crd::{NifiRole, v1alpha1},
         security::{
@@ -141,6 +141,14 @@ pub(crate) mod test_support {
         let role_group_configs = build_role_group_configs(&nifi, &image, &None)
             .expect("role group configs should merge for minimal fixture");
 
+        let role_config = nifi
+            .role_config(&NifiRole::Node)
+            .map(|role_config| ValidatedRoleConfig {
+                pdb: role_config.common.pod_disruption_budget.clone(),
+                listener_class: role_config.listener_class.clone(),
+            })
+            .expect("the minimal fixture defines the nodes role");
+
         let name = ClusterName::from_str("simple-nifi").expect("valid cluster name");
         let namespace = NamespaceName::from_str("default").expect("valid namespace");
         let uid = Uid::from_str("e6ac237d-a6d4-43a1-8135-f36506110912").expect("valid uid");
@@ -153,6 +161,7 @@ pub(crate) mod test_support {
             uid,
             image,
             product_version,
+            role_config,
             role_group_configs,
             ValidatedClusterConfig {
                 authentication: NifiAuthenticationConfig::SingleUser {

rust/operator-binary/src/controller/validate.rs

@@ -115,8 +115,10 @@ pub fn validate(
         )
         .context(ResolveProductImageSnafu)?;
 
+    let name = get_cluster_name(nifi).context(GetClusterNameSnafu)?;
+
     let authentication_config =
-        NifiAuthenticationConfig::validate(nifi, &dereferenced_objects.authentication_classes)
+        NifiAuthenticationConfig::validate(&name, &dereferenced_objects.authentication_classes)
             .context(InvalidAuthenticationConfigSnafu)?;
 
     let authorization_config = ResolvedNifiAuthorizationConfig::validate(
@@ -157,7 +159,6 @@ pub fn validate(
         })
         .context(NoNodesDefinedSnafu)?;
 
-    let name = get_cluster_name(nifi).context(GetClusterNameSnafu)?;
     let namespace = dereferenced_objects.namespace.clone();
     let uid = get_uid(nifi).context(GetUidSnafu)?;
 

rust/operator-binary/src/nifi_controller.rs

@@ -204,9 +204,13 @@ pub async fn reconcile_nifi(
     let authentication_config = &validated_cluster.cluster_config.authentication;
 
     tracing::info!("Checking for sensitive key configuration");
-    check_or_generate_sensitive_key(client, nifi, &validated_cluster.namespace)
-        .await
-        .context(SecuritySnafu)?;
+    check_or_generate_sensitive_key(
+        client,
+        &nifi.spec.cluster_config.sensitive_properties,
+        &validated_cluster.namespace,
+    )
+    .await
+    .context(SecuritySnafu)?;
 
     // If rolling upgrade is supported, kubernetes takes care of the cluster scaling automatically
     // otherwise the operator handles it
@@ -244,9 +248,13 @@ pub async fn reconcile_nifi(
     );
 
     if let NifiAuthenticationConfig::Oidc { .. } = authentication_config {
-        check_or_generate_oidc_admin_password(client, nifi, &validated_cluster.namespace)
-            .await
-            .context(SecuritySnafu)?;
+        check_or_generate_oidc_admin_password(
+            client,
+            &validated_cluster.name,
+            &validated_cluster.namespace,
+        )
+        .await
+        .context(SecuritySnafu)?;
     }
 
     let (rbac_sa, rbac_rolebinding) = build_rbac_resources(

rust/operator-binary/src/security/authentication.rs

@@ -9,6 +9,7 @@ use stackable_operator::{
     crd::authentication::{core as auth_core, ldap, oidc, r#static},
     k8s_openapi::api::core::v1::{KeyToPath, SecretVolumeSource, Volume},
     kube::{ResourceExt, runtime::reflector::ObjectRef},
+    v2::types::operator::ClusterName,
 };
 
 use crate::{crd::v1alpha1, security::oidc::build_oidc_admin_password_secret_name};
@@ -115,7 +116,6 @@ impl DereferencedAuthenticationClasses {
     }
 }
 
-#[allow(clippy::large_enum_variant)]
 #[derive(Clone)]
 pub enum NifiAuthenticationConfig {
     SingleUser {
@@ -127,7 +127,7 @@ pub enum NifiAuthenticationConfig {
     Oidc {
         provider: oidc::v1alpha1::AuthenticationProvider,
         oidc: oidc::v1alpha1::ClientAuthenticationOptions,
-        nifi: v1alpha1::NifiCluster,
+        cluster_name: ClusterName,
     },
 }
 
@@ -243,11 +243,15 @@ impl NifiAuthenticationConfig {
                     .add_volumes_and_mounts(pod_builder, container_builders)
                     .context(AddLdapVolumesSnafu)?;
             }
-            Self::Oidc { provider, nifi, .. } => {
+            Self::Oidc {
+                provider,
+                cluster_name,
+                ..
+            } => {
                 let admin_volume = Volume {
                     name: STACKABLE_ADMIN_USERNAME.to_string(),
                     secret: Some(SecretVolumeSource {
-                        secret_name: Some(build_oidc_admin_password_secret_name(nifi)),
+                        secret_name: Some(build_oidc_admin_password_secret_name(cluster_name)),
                         optional: Some(false),
                         items: Some(vec![KeyToPath {
                             key: STACKABLE_ADMIN_USERNAME.to_string(),
@@ -285,7 +289,7 @@ impl NifiAuthenticationConfig {
     /// * LDAP TLS verification is enabled if TLS is used
     /// * an OIDC client spec is present when the provider is OIDC
     pub fn validate(
-        nifi: &v1alpha1::NifiCluster,
+        cluster_name: &ClusterName,
         dereferenced: &DereferencedAuthenticationClasses,
     ) -> Result<Self> {
         let (entry, auth_class) = match dereferenced.entries.as_slice() {
@@ -321,7 +325,7 @@ impl NifiAuthenticationConfig {
                     .oidc_or_error(&auth_class_name)
                     .context(OidcConfigurationInvalidSnafu)?
                     .clone(),
-                nifi: nifi.clone(),
+                cluster_name: cluster_name.clone(),
             }),
             _ => AuthenticationClassProviderNotSupportedSnafu {
                 authentication_class_provider: auth_class.spec.provider.to_string(),

rust/operator-binary/src/security/mod.rs

@@ -1,10 +1,13 @@
 use snafu::{ResultExt, Snafu};
 use stackable_operator::{
-    builder::pod::volume::SecretFormat, client::Client, k8s_openapi::api::core::v1::Volume,
-    shared::time::Duration, v2::types::kubernetes::NamespaceName,
+    builder::pod::volume::SecretFormat,
+    client::Client,
+    k8s_openapi::api::core::v1::Volume,
+    shared::time::Duration,
+    v2::types::{kubernetes::NamespaceName, operator::ClusterName},
 };
 
-use crate::crd::v1alpha1;
+use crate::crd::sensitive_properties::NifiSensitivePropertiesConfig;
 
 pub mod authentication;
 pub mod authorization;
@@ -28,20 +31,20 @@ pub enum Error {
 
 pub async fn check_or_generate_sensitive_key(
     client: &Client,
-    nifi: &v1alpha1::NifiCluster,
+    sensitive_config: &NifiSensitivePropertiesConfig,
     namespace: &NamespaceName,
 ) -> Result<bool> {
-    sensitive_key::check_or_generate_sensitive_key(client, nifi, namespace)
+    sensitive_key::check_or_generate_sensitive_key(client, sensitive_config, namespace)
         .await
         .context(SensitiveKeySnafu)
 }
 
 pub async fn check_or_generate_oidc_admin_password(
     client: &Client,
-    nifi: &v1alpha1::NifiCluster,
+    cluster_name: &ClusterName,
     namespace: &NamespaceName,
 ) -> Result<bool> {
-    oidc::check_or_generate_oidc_admin_password(client, nifi, namespace)
+    oidc::check_or_generate_oidc_admin_password(client, cluster_name, namespace)
         .await
         .context(OidcAdminPasswordSnafu)
 }

rust/operator-binary/src/security/oidc.rs

@@ -8,11 +8,11 @@ use stackable_operator::{
     commons::tls_verification::{CaCert, TlsServerVerification, TlsVerification},
     crd::authentication::oidc,
     k8s_openapi::api::core::v1::Secret,
-    kube::{ResourceExt, runtime::reflector::ObjectRef},
-    v2::types::kubernetes::NamespaceName,
+    kube::runtime::reflector::ObjectRef,
+    v2::types::{kubernetes::NamespaceName, operator::ClusterName},
 };
 
-use crate::{crd::v1alpha1, security::authentication::STACKABLE_ADMIN_USERNAME};
+use crate::security::authentication::STACKABLE_ADMIN_USERNAME;
 
 type Result<T, E = Error> = std::result::Result<T, E>;
 
@@ -42,13 +42,13 @@ pub enum Error {
 /// This admin user is the same as for SingleUser authentication.
 pub(crate) async fn check_or_generate_oidc_admin_password(
     client: &Client,
-    nifi: &v1alpha1::NifiCluster,
+    cluster_name: &ClusterName,
     namespace: &NamespaceName,
 ) -> Result<bool, Error> {
     tracing::debug!("Checking for OIDC admin password configuration");
     match client
         .get_opt::<Secret>(
-            &build_oidc_admin_password_secret_name(nifi),
+            &build_oidc_admin_password_secret_name(cluster_name),
             namespace.as_ref(),
         )
         .await
@@ -84,7 +84,7 @@ pub(crate) async fn check_or_generate_oidc_admin_password(
             let new_secret = Secret {
                 metadata: ObjectMetaBuilder::new()
                     .namespace(namespace)
-                    .name(build_oidc_admin_password_secret_name(nifi))
+                    .name(build_oidc_admin_password_secret_name(cluster_name))
                     .build(),
                 string_data: Some(secret_data),
                 ..Secret::default()
@@ -98,8 +98,8 @@ pub(crate) async fn check_or_generate_oidc_admin_password(
     }
 }
 
-pub fn build_oidc_admin_password_secret_name(nifi: &v1alpha1::NifiCluster) -> String {
-    format!("{}-oidc-admin-password", nifi.name_any())
+pub fn build_oidc_admin_password_secret_name(cluster_name: &ClusterName) -> String {
+    format!("{cluster_name}-oidc-admin-password")
 }
 
 /// Adds all the required configuration properties to enable OIDC authentication.

rust/operator-binary/src/security/sensitive_key.rs

@@ -7,7 +7,7 @@ use stackable_operator::{
     v2::types::kubernetes::NamespaceName,
 };
 
-use crate::crd::v1alpha1;
+use crate::crd::sensitive_properties::NifiSensitivePropertiesConfig;
 
 type Result<T, E = Error> = std::result::Result<T, E>;
 
@@ -28,11 +28,9 @@ pub enum Error {
 
 pub(crate) async fn check_or_generate_sensitive_key(
     client: &Client,
-    nifi: &v1alpha1::NifiCluster,
+    sensitive_config: &NifiSensitivePropertiesConfig,
     namespace: &NamespaceName,
 ) -> Result<bool, Error> {
-    let sensitive_config = &nifi.spec.cluster_config.sensitive_properties;
-
     match client
         .get_opt::<Secret>(sensitive_config.key_secret.as_ref(), namespace.as_ref())
         .await