refactor: consolidate ValidatedReportingTask & ValidatedSensitiveProperties

Author: maltesander

rust/operator-binary/src/controller/build/properties.rs

@@ -94,8 +94,8 @@ pub(crate) mod test_support {
 
     use crate::{
         controller::{
-            NifiRoleGroupConfig, ValidatedCluster, ValidatedClusterConfig, ValidatedRoleConfig,
-            validate::build_role_group_configs,
+            NifiRoleGroupConfig, ValidatedCluster, ValidatedClusterConfig, ValidatedReportingTask,
+            ValidatedRoleConfig, ValidatedSensitiveProperties, validate::build_role_group_configs,
         },
         crd::{NifiRole, v1alpha1},
         security::{
@@ -184,21 +184,27 @@ pub(crate) mod test_support {
                 },
                 authorization: ResolvedNifiAuthorizationConfig::SingleUser,
                 clustering_backend: v1alpha1::NifiClusteringBackend::Kubernetes {},
-                sensitive_properties_algorithm: Default::default(), // NifiArgon2AesGcm256
-                sensitive_key_secret: nifi
-                    .spec
-                    .cluster_config
-                    .sensitive_properties
-                    .key_secret
-                    .clone(),
+                sensitive_properties: ValidatedSensitiveProperties {
+                    algorithm: Default::default(), // NifiArgon2AesGcm256
+                    key_secret: nifi
+                        .spec
+                        .cluster_config
+                        .sensitive_properties
+                        .key_secret
+                        .clone(),
+                    auto_generate: nifi.spec.cluster_config.sensitive_properties.auto_generate,
+                },
                 server_tls_secret_class: nifi.server_tls_secret_class().clone(),
                 extra_volumes: nifi.spec.cluster_config.extra_volumes.clone(),
-                reporting_task_pod_overrides: nifi
-                    .spec
-                    .cluster_config
-                    .create_reporting_task_job
-                    .pod_overrides
-                    .clone(),
+                reporting_task: ValidatedReportingTask {
+                    enabled: nifi.spec.cluster_config.create_reporting_task_job.enabled,
+                    pod_overrides: nifi
+                        .spec
+                        .cluster_config
+                        .create_reporting_task_job
+                        .pod_overrides
+                        .clone(),
+                },
                 host_header_check: nifi.spec.cluster_config.host_header_check.clone(),
             },
         )

rust/operator-binary/src/controller/build/properties/nifi_properties.rs

@@ -451,7 +451,8 @@ pub fn build(
         "nifi.sensitive.props.algorithm".to_string(),
         cluster
             .cluster_config
-            .sensitive_properties_algorithm
+            .sensitive_properties
+            .algorithm
             .to_string(),
     );
 

rust/operator-binary/src/controller/build/resource/reporting_task.rs

@@ -323,7 +323,7 @@ fn build_reporting_task_job(
         .context(AddVolumeSnafu)?
         .build_template();
 
-    pod_template.merge_from(cluster.cluster_config.reporting_task_pod_overrides.clone());
+    pod_template.merge_from(cluster.cluster_config.reporting_task.pod_overrides.clone());
 
     let job = Job {
         metadata: cluster

rust/operator-binary/src/controller/build/resource/statefulset.rs

@@ -64,7 +64,7 @@ use crate::{
         },
     },
     crd::{
-        NifiRole, NifiRoleType,
+        NifiRole,
         authorization::NifiAccessPolicyProvider,
         storage::{NifiRepository, PERSISTENT_REPOSITORIES},
         v1alpha1,
@@ -162,7 +162,6 @@ stackable_operator::constant!(VECTOR_LOG_VOLUME_NAME: VolumeName = "log");
 pub(crate) async fn build_node_rolegroup_statefulset(
     cluster: &ValidatedCluster,
     cluster_info: &KubernetesClusterInfo,
-    role: &NifiRoleType,
     role_group_name: &RoleGroupName,
     rg: &NifiRoleGroupConfig,
     rolling_update_supported: bool,
@@ -250,7 +249,7 @@ pub(crate) async fn build_node_rolegroup_statefulset(
         cluster_domain = cluster_info.cluster_domain,
     );
 
-    let sensitive_key_secret = &cluster.cluster_config.sensitive_key_secret;
+    let sensitive_key_secret = &cluster.cluster_config.sensitive_properties.key_secret;
 
     let prepare_container_name = PREPARE_CONTAINER_NAME.to_string();
     let mut prepare_args = vec![];
@@ -475,7 +474,7 @@ pub(crate) async fn build_node_rolegroup_statefulset(
         tracing::info!(
             ?volume_name,
             ?mount_point,
-            ?role,
+            role = %NifiRole::Node,
             "Adding user specified extra volume",
         );
         pod_builder

rust/operator-binary/src/controller/mod.rs

@@ -170,16 +170,32 @@ pub struct ValidatedClusterConfig {
     pub clustering_backend: v1alpha1::NifiClusteringBackend,
     /// The host-header-check config, resolved into the proxy hosts allow-list at build time.
     pub host_header_check: HostHeaderCheckConfig,
-    /// The validated sensitive properties algorithm.
-    pub sensitive_properties_algorithm: NifiSensitiveKeyAlgorithm,
-    /// The name of the Secret holding the sensitive-properties key, mounted into the NiFi Pods.
-    pub sensitive_key_secret: SecretName,
+    /// The resolved sensitive-properties configuration.
+    pub sensitive_properties: ValidatedSensitiveProperties,
     /// The SecretClass providing the server TLS certificates.
     pub server_tls_secret_class: SecretClassName,
     /// User-provided extra volumes, mounted into every container under `/stackable/userdata/`.
     pub extra_volumes: Vec<Volume>,
-    /// Pod overrides for the (NiFi 1.x-only) create-reporting-task Job.
-    pub reporting_task_pod_overrides: PodTemplateSpec,
+    /// The resolved (NiFi 1.x-only) create-reporting-task Job configuration.
+    pub reporting_task: ValidatedReportingTask,
+}
+
+/// The resolved `spec.clusterConfig.sensitiveProperties`.
+pub struct ValidatedSensitiveProperties {
+    /// The validated sensitive-properties encryption algorithm.
+    pub algorithm: NifiSensitiveKeyAlgorithm,
+    /// The name of the Secret holding the sensitive-properties key, mounted into the NiFi Pods.
+    pub key_secret: SecretName,
+    /// Whether to generate the key Secret if it is missing.
+    pub auto_generate: bool,
+}
+
+/// The resolved `spec.clusterConfig.createReportingTaskJob` (NiFi 1.x only).
+pub struct ValidatedReportingTask {
+    /// Whether the reporting-task Job should be created.
+    pub enabled: bool,
+    /// Pod overrides for the reporting-task Job.
+    pub pod_overrides: PodTemplateSpec,
 }
 
 /// Per-role configuration extracted during validation.

rust/operator-binary/src/controller/validate.rs

@@ -30,7 +30,7 @@ use strum::{EnumDiscriminants, IntoStaticStr};
 
 use super::{
     NifiRoleGroupConfig, ValidatedCluster, ValidatedClusterConfig, ValidatedLogging,
-    ValidatedNifiConfig, ValidatedRoleConfig,
+    ValidatedNifiConfig, ValidatedReportingTask, ValidatedRoleConfig, ValidatedSensitiveProperties,
 };
 use crate::{
     controller::{build::git_sync::build_git_sync_resources, dereference::DereferencedObjects},
@@ -181,21 +181,27 @@ pub fn validate(
             authentication: authentication_config,
             authorization: authorization_config,
             clustering_backend: nifi.spec.cluster_config.clustering_backend.clone(),
-            sensitive_properties_algorithm,
-            sensitive_key_secret: nifi
-                .spec
-                .cluster_config
-                .sensitive_properties
-                .key_secret
-                .clone(),
+            sensitive_properties: ValidatedSensitiveProperties {
+                algorithm: sensitive_properties_algorithm,
+                key_secret: nifi
+                    .spec
+                    .cluster_config
+                    .sensitive_properties
+                    .key_secret
+                    .clone(),
+                auto_generate: nifi.spec.cluster_config.sensitive_properties.auto_generate,
+            },
             server_tls_secret_class: nifi.server_tls_secret_class().clone(),
             extra_volumes: nifi.spec.cluster_config.extra_volumes.clone(),
-            reporting_task_pod_overrides: nifi
-                .spec
-                .cluster_config
-                .create_reporting_task_job
-                .pod_overrides
-                .clone(),
+            reporting_task: ValidatedReportingTask {
+                enabled: nifi.spec.cluster_config.create_reporting_task_job.enabled,
+                pod_overrides: nifi
+                    .spec
+                    .cluster_config
+                    .create_reporting_task_job
+                    .pod_overrides
+                    .clone(),
+            },
             host_header_check: nifi.spec.cluster_config.host_header_check.clone(),
         },
     ))

rust/operator-binary/src/nifi_controller.rs

@@ -206,7 +206,7 @@ pub async fn reconcile_nifi(
     tracing::info!("Checking for sensitive key configuration");
     check_or_generate_sensitive_key(
         client,
-        &nifi.spec.cluster_config.sensitive_properties,
+        &validated_cluster.cluster_config.sensitive_properties,
         &validated_cluster.namespace,
     )
     .await
@@ -291,8 +291,6 @@ pub async fn reconcile_nifi(
             let rg_headless_service =
                 build_rolegroup_headless_service(&validated_cluster, role_group_name);
 
-            let role = nifi.spec.nodes.as_ref().context(NoNodesDefinedSnafu)?;
-
             let rg_configmap = build::resource::config_map::build_rolegroup_config_map(
                 &validated_cluster,
                 role_group_name,
@@ -315,7 +313,6 @@ pub async fn reconcile_nifi(
             let rg_statefulset = build_node_rolegroup_statefulset(
                 &validated_cluster,
                 &client.kubernetes_cluster_info,
-                role,
                 role_group_name,
                 rg,
                 rolling_upgrade_supported,
@@ -389,7 +386,7 @@ pub async fn reconcile_nifi(
         .context(ApplyGroupListenerSnafu)?;
 
     // Only add the reporting task in case it is enabled.
-    if nifi.spec.cluster_config.create_reporting_task_job.enabled {
+    if validated_cluster.cluster_config.reporting_task.enabled {
         if let Some((reporting_task_job, reporting_task_service)) = build_maybe_reporting_task(
             &validated_cluster,
             &client.kubernetes_cluster_info,

rust/operator-binary/src/security/mod.rs

@@ -10,7 +10,7 @@ use stackable_operator::{
     },
 };
 
-use crate::crd::sensitive_properties::NifiSensitivePropertiesConfig;
+use crate::controller::ValidatedSensitiveProperties;
 
 pub mod authentication;
 pub mod authorization;
@@ -34,10 +34,10 @@ pub enum Error {
 
 pub async fn check_or_generate_sensitive_key(
     client: &Client,
-    sensitive_config: &NifiSensitivePropertiesConfig,
+    sensitive_properties: &ValidatedSensitiveProperties,
     namespace: &NamespaceName,
 ) -> Result<bool> {
-    sensitive_key::check_or_generate_sensitive_key(client, sensitive_config, namespace)
+    sensitive_key::check_or_generate_sensitive_key(client, sensitive_properties, namespace)
         .await
         .context(SensitiveKeySnafu)
 }

rust/operator-binary/src/security/sensitive_key.rs

@@ -7,7 +7,7 @@ use stackable_operator::{
     v2::types::kubernetes::NamespaceName,
 };
 
-use crate::crd::sensitive_properties::NifiSensitivePropertiesConfig;
+use crate::controller::ValidatedSensitiveProperties;
 
 /// The key under which the generated sensitive-properties key is stored in the Secret. The
 /// `nifi.properties` builder references the mounted file by this same name, so the two must agree.
@@ -33,19 +33,20 @@ pub enum Error {
 
 pub(crate) async fn check_or_generate_sensitive_key(
     client: &Client,
-    sensitive_config: &NifiSensitivePropertiesConfig,
+    sensitive_properties: &ValidatedSensitiveProperties,
     namespace: &NamespaceName,
 ) -> Result<bool, Error> {
+    let key_secret = &sensitive_properties.key_secret;
     match client
-        .get_opt::<Secret>(sensitive_config.key_secret.as_ref(), namespace.as_ref())
+        .get_opt::<Secret>(key_secret.as_ref(), namespace.as_ref())
         .await
         .context(SensitiveKeySecretSnafu)?
     {
         Some(_) => Ok(false),
         None => {
-            if !sensitive_config.auto_generate {
+            if !sensitive_properties.auto_generate {
                 return Err(Error::SensitiveKeySecretMissing {
-                    name: sensitive_config.key_secret.to_string(),
+                    name: key_secret.to_string(),
                     namespace: namespace.to_string(),
                 });
             }
@@ -62,7 +63,7 @@ pub(crate) async fn check_or_generate_sensitive_key(
             let new_secret = Secret {
                 metadata: ObjectMetaBuilder::new()
                     .namespace(namespace)
-                    .name(sensitive_config.key_secret.to_string())
+                    .name(key_secret.to_string())
                     .build(),
                 string_data: Some(secret_data),
                 ..Secret::default()