refactor(1): use NamespaceName and remove optional namespaces

Author: maltesander

Cargo.nix

@@ -57,6 +57,7 @@ use stackable_operator::{
         statefulset::StatefulSetConditionBuilder,
     },
     utils::{COMMON_BASH_TRAP_FUNCTIONS, cluster_info::KubernetesClusterInfo},
+    v2::types::kubernetes::NamespaceName,
 };
 use strum::{EnumDiscriminants, IntoStaticStr};
 use tracing::Instrument;
@@ -123,9 +124,6 @@ pub enum Error {
     #[snafu(display("object defines no name"))]
     ObjectHasNoName,
 
-    #[snafu(display("object defines no namespace"))]
-    ObjectHasNoNamespace,
-
     #[snafu(display("failed to dereference resources"))]
     Dereference { source: dereference::Error },
 
@@ -332,7 +330,7 @@ pub async fn reconcile_nifi(
     let authorization_config = &validated_cluster.cluster_config.authorization;
 
     tracing::info!("Checking for sensitive key configuration");
-    check_or_generate_sensitive_key(client, nifi)
+    check_or_generate_sensitive_key(client, nifi, &validated_cluster.namespace)
         .await
         .context(SecuritySnafu)?;
 
@@ -352,6 +350,7 @@ pub async fn reconcile_nifi(
         cluster_version_update_state = upgrade::cluster_version_update_state(
             nifi,
             client,
+            &validated_cluster.namespace,
             &resolved_product_image.product_version,
             deployed_version,
         )
@@ -375,7 +374,7 @@ pub async fn reconcile_nifi(
     .context(CreateClusterResourcesSnafu)?;
 
     if let NifiAuthenticationConfig::Oidc { .. } = authentication_config {
-        check_or_generate_oidc_admin_password(client, nifi)
+        check_or_generate_oidc_admin_password(client, nifi, &validated_cluster.namespace)
             .await
             .context(SecuritySnafu)?;
     }
@@ -470,6 +469,7 @@ pub async fn reconcile_nifi(
                 nifi,
                 resolved_product_image,
                 &client.kubernetes_cluster_info,
+                &validated_cluster.namespace,
                 &rolegroup,
                 role,
                 rg,
@@ -568,6 +568,7 @@ pub async fn reconcile_nifi(
             nifi,
             resolved_product_image,
             &client.kubernetes_cluster_info,
+            &validated_cluster.namespace,
             authentication_config,
             &rbac_sa.name_any(),
         )
@@ -648,6 +649,7 @@ async fn build_node_rolegroup_statefulset(
     nifi: &v1alpha1::NifiCluster,
     resolved_product_image: &ResolvedProductImage,
     cluster_info: &KubernetesClusterInfo,
+    namespace: &NamespaceName,
     rolegroup_ref: &RoleGroupRef<v1alpha1::NifiCluster>,
     role: &NifiRoleType,
     rg: &NifiRoleGroupConfig,
@@ -723,11 +725,6 @@ async fn build_node_rolegroup_statefulset(
     let node_address = format!(
         "$POD_NAME.{service_name}.{namespace}.svc.{cluster_domain}",
         service_name = rolegroup_ref.rolegroup_headless_service_name(),
-        namespace = &nifi
-            .metadata
-            .namespace
-            .as_ref()
-            .context(ObjectHasNoNamespaceSnafu)?,
         cluster_domain = cluster_info.cluster_domain,
     );
 

rust/operator-binary/src/controller.rs

@@ -79,7 +79,7 @@ pub(crate) fn resolved_overrides_for(
 /// self-contained.
 #[cfg(test)]
 pub(crate) mod test_support {
-    use std::collections::BTreeMap;
+    use std::{collections::BTreeMap, str::FromStr as _};
 
     use stackable_operator::{
         commons::product_image_selection::ResolvedProductImage,
@@ -88,6 +88,7 @@ pub(crate) mod test_support {
         },
         kube::ResourceExt as _,
         kvp::LabelValue,
+        v2::types::kubernetes::NamespaceName,
     };
 
     use crate::{
@@ -161,6 +162,7 @@ pub(crate) mod test_support {
 
         ValidatedCluster {
             name: "simple-nifi".to_string(),
+            namespace: NamespaceName::from_str("default").expect("valid namespace"),
             image,
             role_group_configs,
             git_sync_resources: Default::default(),

rust/operator-binary/src/controller/build/properties.rs

@@ -3,8 +3,14 @@
 //! Fetches all Kubernetes objects referenced by the NifiCluster spec and returns
 //! them in [`DereferencedObjects`].
 
-use snafu::{OptionExt, ResultExt, Snafu};
-use stackable_operator::client::Client;
+use snafu::{ResultExt, Snafu};
+use stackable_operator::{
+    client::Client,
+    v2::{
+        controller_utils::{self, get_namespace},
+        types::kubernetes::NamespaceName,
+    },
+};
 
 use crate::{
     crd::v1alpha1,
@@ -16,8 +22,8 @@ use crate::{
 
 #[derive(Snafu, Debug)]
 pub enum Error {
-    #[snafu(display("object defines no namespace"))]
-    ObjectHasNoNamespace,
+    #[snafu(display("failed to get the namespace"))]
+    GetNamespace { source: controller_utils::Error },
 
     #[snafu(display("failed to dereference NiFi authentication classes"))]
     DereferenceAuthenticationClasses { source: authentication::Error },
@@ -30,6 +36,8 @@ type Result<T, E = Error> = std::result::Result<T, E>;
 
 /// Kubernetes objects referenced from the [`v1alpha1::NifiCluster`] spec, already fetched.
 pub struct DereferencedObjects {
+    /// The namespace of the [`v1alpha1::NifiCluster`], parsed once here and reused everywhere.
+    pub namespace: NamespaceName,
     pub authentication_classes: DereferencedAuthenticationClasses,
     pub authorization: DereferencedAuthorization,
 }
@@ -39,11 +47,7 @@ pub async fn dereference(
     client: &Client,
     nifi: &v1alpha1::NifiCluster,
 ) -> Result<DereferencedObjects> {
-    let namespace = nifi
-        .metadata
-        .namespace
-        .as_deref()
-        .context(ObjectHasNoNamespaceSnafu)?;
+    let namespace = get_namespace(nifi).context(GetNamespaceSnafu)?;
 
     let authentication_classes = DereferencedAuthenticationClasses::dereference(nifi, client)
         .await
@@ -52,12 +56,13 @@ pub async fn dereference(
     let authorization = DereferencedAuthorization::dereference(
         &nifi.spec.cluster_config.authorization,
         client,
-        namespace,
+        namespace.as_ref(),
     )
     .await
     .context(DereferenceAuthorizationSnafu)?;
 
     Ok(DereferencedObjects {
+        namespace,
         authentication_classes,
         authorization,
     })

rust/operator-binary/src/controller/dereference.rs

@@ -13,6 +13,7 @@ use stackable_operator::{
     kube::ResourceExt as _,
     role_utils::JavaCommonConfig,
     utils::cluster_info::KubernetesClusterInfo,
+    v2::types::kubernetes::NamespaceName,
 };
 use strum::{EnumDiscriminants, IntoStaticStr};
 
@@ -45,11 +46,6 @@ pub enum Error {
     #[snafu(display("invalid NiFi authentication configuration"))]
     InvalidAuthenticationConfig { source: authentication::Error },
 
-    #[snafu(display("failed to build reporting task service name"))]
-    ReportingTask {
-        source: crate::reporting_task::Error,
-    },
-
     #[snafu(display("failed to validate config fragment for a rolegroup"))]
     InvalidConfigFragment {
         source: stackable_operator::config::fragment::ValidationError,
@@ -76,6 +72,8 @@ type Result<T, E = Error> = std::result::Result<T, E>;
 pub struct ValidatedCluster {
     #[allow(dead_code)]
     pub name: String,
+    /// The namespace of the NifiCluster, parsed once in the dereference step and reused everywhere.
+    pub namespace: NamespaceName,
     pub image: ResolvedProductImage,
     pub role_group_configs: BTreeMap<NifiRole, BTreeMap<String, NifiRoleGroupConfig>>,
     /// The git-sync resources (volumes, mounts, containers) for each Node rolegroup,
@@ -122,7 +120,7 @@ pub fn validate(
         &dereferenced_objects.authorization,
     );
 
-    let proxy_hosts = compute_proxy_hosts(nifi, cluster_info)?;
+    let proxy_hosts = compute_proxy_hosts(nifi, cluster_info, &dereferenced_objects.namespace);
 
     let sensitive_properties_algorithm = nifi
         .spec
@@ -140,6 +138,7 @@ pub fn validate(
 
     Ok(ValidatedCluster {
         name: nifi.name_any(),
+        namespace: dereferenced_objects.namespace.clone(),
         image,
         role_group_configs,
         git_sync_resources,
@@ -203,7 +202,8 @@ fn build_git_sync_resources(
 fn compute_proxy_hosts(
     nifi: &v1alpha1::NifiCluster,
     cluster_info: &KubernetesClusterInfo,
-) -> Result<String> {
+    namespace: &NamespaceName,
+) -> String {
     let host_header_check = &nifi.spec.cluster_config.host_header_check;
 
     if host_header_check.allow_all {
@@ -215,7 +215,7 @@ fn compute_proxy_hosts(
                 "spec.clusterConfig.hostHeaderCheck.additionalAllowedHosts is ignored and only '*' is added to the allow-list."
             )
         }
-        return Ok("*".to_string());
+        return "*".to_string();
     }
 
     // Address and port are injected from the listener volume during the prepare container
@@ -227,14 +227,13 @@ fn compute_proxy_hosts(
     // Reporting task only exists for NiFi 1.x
     if nifi.spec.image.product_version().starts_with("1.") {
         let reporting_task_service_name =
-            reporting_task::build_reporting_task_fqdn_service_name(nifi, cluster_info)
-                .context(ReportingTaskSnafu)?;
+            reporting_task::build_reporting_task_fqdn_service_name(nifi, cluster_info, namespace);
 
         proxy_hosts.insert(format!("{reporting_task_service_name}:{HTTPS_PORT}"));
     }
 
     let mut proxy_hosts = Vec::from_iter(proxy_hosts);
     proxy_hosts.sort();
 
-    Ok(proxy_hosts.join(","))
+    proxy_hosts.join(",")
 }

rust/operator-binary/src/controller/validate.rs

@@ -1,20 +1,18 @@
 // TODO: This module can be removed once we don't support NiFi 1.x versions anymore
 // It manages the version upgrade procedure for NiFi versions prior to NiFi 2, since rolling upgrade is not supported there yet
 
-use snafu::{OptionExt, ResultExt, Snafu};
+use snafu::{ResultExt, Snafu};
 use stackable_operator::{
     client::Client,
     k8s_openapi::{api::apps::v1::StatefulSet, apimachinery::pkg::apis::meta::v1::LabelSelector},
     kvp::Labels,
+    v2::types::kubernetes::NamespaceName,
 };
 
 use crate::crd::{APP_NAME, NifiRole, v1alpha1};
 
 #[derive(Snafu, Debug)]
 pub enum Error {
-    #[snafu(display("object defines no namespace"))]
-    ObjectHasNoNamespace,
-
     #[snafu(display("failed to fetch deployed StatefulSets"))]
     FetchStatefulsets {
         source: stackable_operator::client::Error,
@@ -41,15 +39,10 @@ pub enum ClusterVersionUpdateState {
 pub async fn cluster_version_update_state(
     nifi: &v1alpha1::NifiCluster,
     client: &Client,
+    namespace: &NamespaceName,
     resolved_version: &String,
     deployed_version: Option<&String>,
 ) -> Result<ClusterVersionUpdateState> {
-    let namespace = &nifi
-        .metadata
-        .namespace
-        .clone()
-        .with_context(|| ObjectHasNoNamespaceSnafu {})?;
-
     // Handle full restarts for a version change
     match deployed_version {
         Some(deployed_version) => {
@@ -66,7 +59,7 @@ pub async fn cluster_version_update_state(
 
                 // Retrieve the deployed statefulsets to check on the current status of the restart
                 let deployed_statefulsets = client
-                    .list_with_label_selector::<StatefulSet>(namespace, &selector)
+                    .list_with_label_selector::<StatefulSet>(namespace.as_ref(), &selector)
                     .await
                     .context(FetchStatefulsetsSnafu)?;