refactor: use ConfigMapName, SecretName, ListenerName in CRD

Author: maltesander

extra/crds.yaml

@@ -381,6 +381,9 @@ spec:
                           A reference to a Secret. The Secret needs to contain a key `nifiSensitivePropsKey`.
                           If `autoGenerate` is false and this object is missing, the Operator will raise an error.
                           The encryption key needs to be at least 12 characters long.
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                         type: string
                     required:
                     - keySecret
@@ -396,6 +399,9 @@ spec:
                           This only affects client connections and is used to
                           control which certificate the servers should use to
                           authenticate themselves against the client.
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                         type: string
                     type: object
                   vectorAggregatorConfigMapName:
@@ -404,7 +410,10 @@ spec:
                       It must contain the key `ADDRESS` with the address of the Vector aggregator.
                       Follow the [logging tutorial](https://docs.stackable.tech/home/nightly/tutorials/logging-vector-aggregator)
                       to learn how to configure log aggregation with Vector.
+                    maxLength: 253
+                    minLength: 1
                     nullable: true
+                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                     type: string
                   zookeeperConfigMapName:
                     description: |-
@@ -415,6 +424,9 @@ spec:
 
                       The Kubernetes provider will be used if this field is unset. Kubernetes is only supported for NiFi 2.x and newer,
                       NiFi 1.x requires ZooKeeper.
+                    maxLength: 253
+                    minLength: 1
+                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                     type: string
                 required:
                 - authentication
@@ -1345,6 +1357,9 @@ spec:
                     properties:
                       listenerClass:
                         default: cluster-internal
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                         type: string
                       podDisruptionBudget:
                         default:

rust/operator-binary/src/controller/build/properties.rs

@@ -170,7 +170,7 @@ pub(crate) mod test_support {
                     .cluster_config
                     .sensitive_properties
                     .key_secret
-                    .clone(),
+                    .to_string(),
                 server_tls_secret_class: nifi.server_tls_secret_class().to_string(),
                 extra_volumes: nifi.spec.cluster_config.extra_volumes.clone(),
                 reporting_task_pod_overrides: nifi

rust/operator-binary/src/controller/build/properties/state_management_xml.rs

@@ -43,6 +43,10 @@ pub fn build(clustering_backend: &NifiClusteringBackend) -> String {
 
 #[cfg(test)]
 mod tests {
+    use std::str::FromStr;
+
+    use stackable_operator::v2::types::kubernetes::ConfigMapName;
+
     use super::*;
 
     #[test]
@@ -57,7 +61,8 @@ mod tests {
     #[test]
     fn test_build_state_management_xml_zookeeper() {
         let xml = build(&NifiClusteringBackend::ZooKeeper {
-            zookeeper_config_map_name: "my-zk".to_string(),
+            zookeeper_config_map_name: ConfigMapName::from_str("my-zk")
+                .expect("'my-zk' is a valid ConfigMap name"),
         });
         assert!(xml.contains("zk-provider"));
         assert!(xml.contains("ZooKeeperStateProvider"));

rust/operator-binary/src/controller/build/resource/listener.rs

@@ -7,7 +7,7 @@ use stackable_operator::{
     crd::listener::v1alpha1::{Listener, ListenerPort, ListenerSpec},
     k8s_openapi::api::core::v1::PersistentVolumeClaim,
     kvp::Labels,
-    v2::builder::meta::ownerreference_from_resource,
+    v2::{builder::meta::ownerreference_from_resource, types::kubernetes::ListenerClassName},
 };
 
 use crate::{
@@ -28,7 +28,7 @@ pub enum Error {
 
 pub fn build_group_listener(
     cluster: &ValidatedCluster,
-    listener_class: String,
+    listener_class: ListenerClassName,
     listener_group_name: String,
 ) -> Result<Listener, Error> {
     Ok(Listener {
@@ -39,7 +39,7 @@ pub fn build_group_listener(
             .with_labels(cluster.recommended_labels_role_level())
             .build(),
         spec: ListenerSpec {
-            class_name: Some(listener_class),
+            class_name: Some(listener_class.to_string()),
             ports: Some(vec![ListenerPort {
                 name: HTTPS_PORT_NAME.into(),
                 port: HTTPS_PORT.into(),

rust/operator-binary/src/controller/validate.rs

@@ -84,11 +84,6 @@ pub enum Error {
         source: crate::controller::build::git_sync::Error,
     },
 
-    #[snafu(display("invalid Vector aggregator discovery ConfigMap name"))]
-    ParseVectorAggregatorConfigMapName {
-        source: stackable_operator::v2::macros::attributed_string_type::Error,
-    },
-
     #[snafu(display(
         "the Vector aggregator discovery ConfigMap name is required when the Vector agent is enabled"
     ))]
@@ -138,16 +133,13 @@ pub fn validate(
         .check_for_nifi_version(&image.product_version)
         .context(InvalidSensitivePropertiesAlgorithmSnafu)?;
 
-    // The Vector aggregator discovery ConfigMap name is validated here so an invalid name fails
-    // up-front. It is only required when the Vector agent is enabled for a role group.
+    // The Vector aggregator discovery ConfigMap name is validated by the CRD's typed field. It is
+    // only required when the Vector agent is enabled for a role group.
     let vector_aggregator_config_map_name = nifi
         .spec
         .cluster_config
         .vector_aggregator_config_map_name
-        .as_deref()
-        .map(ConfigMapName::from_str)
-        .transpose()
-        .context(ParseVectorAggregatorConfigMapNameSnafu)?;
+        .clone();
 
     let role_group_configs =
         build_role_group_configs(nifi, &image, &vector_aggregator_config_map_name)?;
@@ -178,7 +170,7 @@ pub fn validate(
                 .cluster_config
                 .sensitive_properties
                 .key_secret
-                .clone(),
+                .to_string(),
             server_tls_secret_class: nifi.server_tls_secret_class().to_string(),
             extra_volumes: nifi.spec.cluster_config.extra_volumes.clone(),
             reporting_task_pod_overrides: nifi

rust/operator-binary/src/crd/mod.rs

@@ -5,6 +5,8 @@ pub mod sensitive_properties;
 pub mod storage;
 pub mod tls;
 
+use std::str::FromStr;
+
 use affinity::get_affinity;
 use authorization::NifiAuthorization;
 use sensitive_properties::NifiSensitivePropertiesConfig;
@@ -34,7 +36,11 @@ use stackable_operator::{
     shared::time::Duration,
     status::condition::{ClusterCondition, HasStatusCondition},
     utils::crds::{raw_object_list_schema, raw_object_schema},
-    v2::{config_overrides::KeyValueConfigOverrides, role_utils::JavaCommonConfig},
+    v2::{
+        config_overrides::KeyValueConfigOverrides,
+        role_utils::JavaCommonConfig,
+        types::kubernetes::{ConfigMapName, ListenerClassName, SecretClassName},
+    },
     versioned::versioned,
 };
 use tls::NifiTls;
@@ -133,7 +139,7 @@ pub mod versioned {
         /// Follow the [logging tutorial](DOCS_BASE_URL_PLACEHOLDER/tutorials/logging-vector-aggregator)
         /// to learn how to configure log aggregation with Vector.
         #[serde(skip_serializing_if = "Option::is_none")]
-        pub vector_aggregator_config_map_name: Option<String>,
+        pub vector_aggregator_config_map_name: Option<ConfigMapName>,
 
         #[serde(flatten)]
         pub clustering_backend: NifiClusteringBackend,
@@ -171,7 +177,7 @@ pub mod versioned {
             ///
             /// The Kubernetes provider will be used if this field is unset. Kubernetes is only supported for NiFi 2.x and newer,
             /// NiFi 1.x requires ZooKeeper.
-            zookeeper_config_map_name: String,
+            zookeeper_config_map_name: ConfigMapName,
         },
         Kubernetes {},
     }
@@ -207,7 +213,7 @@ impl v1alpha1::NifiCluster {
     }
 
     /// Return user provided server TLS settings
-    pub fn server_tls_secret_class(&self) -> &str {
+    pub fn server_tls_secret_class(&self) -> &SecretClassName {
         &self.spec.cluster_config.tls.server_secret_class
     }
 }
@@ -465,7 +471,7 @@ pub struct NifiNodeRoleConfig {
     pub common: GenericRoleConfig,
 
     #[serde(default = "node_default_listener_class")]
-    pub listener_class: String,
+    pub listener_class: ListenerClassName,
 }
 
 impl Default for NifiNodeRoleConfig {
@@ -477,8 +483,9 @@ impl Default for NifiNodeRoleConfig {
     }
 }
 
-fn node_default_listener_class() -> String {
-    "cluster-internal".to_string()
+fn node_default_listener_class() -> ListenerClassName {
+    ListenerClassName::from_str("cluster-internal")
+        .expect("'cluster-internal' is a valid listener class name")
 }
 
 #[cfg(test)]

rust/operator-binary/src/crd/sensitive_properties.rs

@@ -1,6 +1,9 @@
 use serde::{Deserialize, Serialize};
 use snafu::Snafu;
-use stackable_operator::schemars::{self, JsonSchema};
+use stackable_operator::{
+    schemars::{self, JsonSchema},
+    v2::types::kubernetes::SecretName,
+};
 
 #[derive(Snafu, Debug)]
 pub enum Error {
@@ -14,13 +17,13 @@ pub enum Error {
 /// NiFi supports encrypting sensitive properties in processors as they are written to disk.
 /// You can configure the encryption algorithm and the key to use.
 /// You can also let the operator generate an encryption key for you.
-#[derive(Clone, Debug, Default, Deserialize, Eq, JsonSchema, PartialEq, Serialize)]
+#[derive(Clone, Debug, Deserialize, Eq, JsonSchema, PartialEq, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct NifiSensitivePropertiesConfig {
     /// A reference to a Secret. The Secret needs to contain a key `nifiSensitivePropsKey`.
     /// If `autoGenerate` is false and this object is missing, the Operator will raise an error.
     /// The encryption key needs to be at least 12 characters long.
-    pub key_secret: String,
+    pub key_secret: SecretName,
 
     /// Whether to generate the `keySecret` if it is missing.
     /// Defaults to `false`.

rust/operator-binary/src/crd/tls.rs

@@ -1,5 +1,10 @@
+use std::str::FromStr;
+
 use serde::{Deserialize, Serialize};
-use stackable_operator::schemars::{self, JsonSchema};
+use stackable_operator::{
+    schemars::{self, JsonSchema},
+    v2::types::kubernetes::SecretClassName,
+};
 
 #[derive(Clone, Debug, Deserialize, Eq, JsonSchema, PartialEq, Serialize)]
 #[serde(rename_all = "camelCase")]
@@ -8,7 +13,7 @@ pub struct NifiTls {
     /// control which certificate the servers should use to
     /// authenticate themselves against the client.
     #[serde(default = "NifiTls::default_server_secret_class")]
-    pub server_secret_class: String,
+    pub server_secret_class: SecretClassName,
 }
 
 impl Default for NifiTls {
@@ -20,7 +25,7 @@ impl Default for NifiTls {
 }
 
 impl NifiTls {
-    fn default_server_secret_class() -> String {
-        "tls".to_owned()
+    fn default_server_secret_class() -> SecretClassName {
+        SecretClassName::from_str("tls").expect("'tls' is a valid secret class name")
     }
 }

rust/operator-binary/src/main.rs

@@ -216,7 +216,7 @@ fn references_config_map(
     let references_zookeeper_config_map = match &nifi.spec.cluster_config.clustering_backend {
         NifiClusteringBackend::ZooKeeper {
             zookeeper_config_map_name,
-        } => *zookeeper_config_map_name == config_map.name_any(),
+        } => zookeeper_config_map_name.to_string() == config_map.name_any(),
         NifiClusteringBackend::Kubernetes {} => false,
     };
     let references_authorization_config_map = references_authorization_config_map(nifi, config_map);

rust/operator-binary/src/security/sensitive_key.rs

@@ -34,15 +34,15 @@ pub(crate) async fn check_or_generate_sensitive_key(
     let sensitive_config = &nifi.spec.cluster_config.sensitive_properties;
 
     match client
-        .get_opt::<Secret>(&sensitive_config.key_secret, namespace.as_ref())
+        .get_opt::<Secret>(sensitive_config.key_secret.as_ref(), namespace.as_ref())
         .await
         .context(SensitiveKeySecretSnafu)?
     {
         Some(_) => Ok(false),
         None => {
             if !sensitive_config.auto_generate {
                 return Err(Error::SensitiveKeySecretMissing {
-                    name: sensitive_config.key_secret.clone(),
+                    name: sensitive_config.key_secret.to_string(),
                     namespace: namespace.to_string(),
                 });
             }