refactor(2): use uid and metadata.

Author: maltesander

rust/operator-binary/src/controller.rs

@@ -196,8 +196,8 @@ pub enum Error {
     #[snafu(display("failed to resolve and merge config for role and role group"))]
     FailedToResolveConfig { source: crate::crd::Error },
 
-    #[snafu(display("missing git-sync resources for rolegroup [{rolegroup}]"))]
-    MissingGitSyncResources { rolegroup: String },
+    #[snafu(display("failed to build git-sync resources"))]
+    BuildGitSyncResources { source: build::git_sync::Error },
 
     #[snafu(display("vector agent is enabled but vector aggregator ConfigMap is missing"))]
     VectorAggregatorConfigMapMissing,
@@ -317,13 +317,9 @@ pub async fn reconcile_nifi(
         .context(DereferenceSnafu)?;
 
     // validate (no Kubernetes API calls required)
-    let validated_cluster = validate::validate(
-        nifi,
-        &dereferenced_objects,
-        &ctx.operator_environment,
-        &client.kubernetes_cluster_info,
-    )
-    .context(ValidateClusterSnafu)?;
+    let validated_cluster =
+        validate::validate(nifi, &dereferenced_objects, &ctx.operator_environment)
+            .context(ValidateClusterSnafu)?;
 
     let resolved_product_image = &validated_cluster.image;
     let authentication_config = &validated_cluster.cluster_config.authentication;
@@ -416,12 +412,10 @@ pub async fn reconcile_nifi(
                 .merged_config(&nifi_role, rolegroup_name)
                 .context(FailedToResolveConfigSnafu)?;
 
-            let git_sync_resources = validated_cluster
-                .git_sync_resources
-                .get(rolegroup_name)
-                .context(MissingGitSyncResourcesSnafu {
-                    rolegroup: rolegroup_name.clone(),
-                })?;
+            // Computed here for the StatefulSet; the ConfigMap builder computes its own copy.
+            let git_sync_resources =
+                build::git_sync::build_git_sync_resources(&validated_cluster, rg)
+                    .context(BuildGitSyncResourcesSnafu)?;
 
             let role_group_service_recommended_labels = build_recommended_labels(
                 nifi,
@@ -444,14 +438,11 @@ pub async fn reconcile_nifi(
 
             let role = nifi.spec.nodes.as_ref().context(NoNodesDefinedSnafu)?;
 
-            // The proxy hosts allow-list lets external users access NiFi via addresses we cannot
-            // predict, so all of them are added to the setting.
-            // For more information see <https://nifi.apache.org/docs/nifi-docs/html/administration-guide.html#proxy_configuration>
             let rg_configmap = build::config_map::build_rolegroup_config_map(
                 &validated_cluster,
                 &rolegroup,
                 &role_group_service_recommended_labels,
-                nifi,
+                &client.kubernetes_cluster_info,
             )
             .context(BuildRoleGroupConfigMapSnafu {
                 rolegroup: rolegroup.clone(),
@@ -479,7 +470,7 @@ pub async fn reconcile_nifi(
                 rolling_upgrade_supported,
                 replicas,
                 &rbac_sa.name_any(),
-                git_sync_resources,
+                &git_sync_resources,
             )
             .await?;
 

rust/operator-binary/src/controller/build.rs

@@ -3,4 +3,6 @@
 //! [`ValidatedCluster`]: crate::controller::validate::ValidatedCluster
 
 pub mod config_map;
+pub mod git_sync;
 pub mod properties;
+pub mod proxy_hosts;

rust/operator-binary/src/controller/build/config_map.rs

@@ -7,13 +7,19 @@ use stackable_operator::{
     kvp::ObjectLabels,
     product_logging::framework::VECTOR_CONFIG_FILE,
     role_utils::RoleGroupRef,
+    utils::cluster_info::KubernetesClusterInfo,
+    v2::builder::meta::ownerreference_from_resource,
 };
 
 use crate::{
     controller::{
-        build::properties::{
-            ConfigFileName, authorizers, bootstrap_conf, logging, login_identity_providers,
-            nifi_properties, security_properties, state_management_xml,
+        build::{
+            git_sync,
+            properties::{
+                ConfigFileName, authorizers, bootstrap_conf, logging, login_identity_providers,
+                nifi_properties, security_properties, state_management_xml,
+            },
+            proxy_hosts,
         },
         validate::ValidatedCluster,
     },
@@ -22,11 +28,6 @@ use crate::{
 
 #[derive(Debug, Snafu)]
 pub enum Error {
-    #[snafu(display("object is missing metadata to build owner reference"))]
-    ObjectMissingMetadataForOwnerRef {
-        source: stackable_operator::builder::meta::Error,
-    },
-
     #[snafu(display("failed to build metadata"))]
     MetadataBuild {
         source: stackable_operator::builder::meta::Error,
@@ -62,30 +63,25 @@ pub enum Error {
         source: crate::security::authentication::Error,
     },
 
-    #[snafu(display("object has no nodes defined"))]
-    NoNodesDefined,
-
     #[snafu(display("the cluster has no rolegroup [{role_group}] in role [{role}]"))]
     MissingRoleGroup { role: String, role_group: String },
 
-    #[snafu(display("missing git-sync resources for rolegroup [{role_group}]"))]
-    MissingGitSyncResources { role_group: String },
+    #[snafu(display("failed to build git-sync resources"))]
+    BuildGitSyncResources { source: git_sync::Error },
 }
 
 type Result<T, E = Error> = std::result::Result<T, E>;
 
 /// Build the rolegroup [`ConfigMap`] configuring the rolegroup based on the
 /// resolved cluster configuration.
 ///
-/// All NiFi configuration is sourced from `cluster`. The only use of `owner` is for
-/// the OwnerReference, `name_and_namespace`, and the raw role spec used for JVM
-/// argument merging. `recommended_labels` must be built by the caller (typically via
-/// `build_recommended_labels`).
+/// All NiFi configuration is sourced from `cluster`. `recommended_labels` must be built by the
+/// caller (typically via `build_recommended_labels`).
 pub fn build_rolegroup_config_map(
     cluster: &ValidatedCluster,
     rolegroup: &RoleGroupRef<v1alpha1::NifiCluster>,
     recommended_labels: &ObjectLabels<'_, v1alpha1::NifiCluster>,
-    owner: &v1alpha1::NifiCluster,
+    cluster_info: &KubernetesClusterInfo,
 ) -> Result<ConfigMap> {
     tracing::debug!("building rolegroup ConfigMap");
 
@@ -99,24 +95,20 @@ pub fn build_rolegroup_config_map(
         })?;
 
     // The raw role spec is only needed for JVM argument merging in `bootstrap_conf`.
-    let role = owner.spec.nodes.as_ref().context(NoNodesDefinedSnafu)?;
+    let role = &cluster.nodes;
 
-    let git_sync_resources = cluster
-        .git_sync_resources
-        .get(&rolegroup.role_group)
-        .with_context(|| MissingGitSyncResourcesSnafu {
-            role_group: rolegroup.role_group.clone(),
-        })?;
+    let proxy_hosts = proxy_hosts::compute_proxy_hosts(cluster, cluster_info);
+    let git_sync_resources =
+        git_sync::build_git_sync_resources(cluster, rg).context(BuildGitSyncResourcesSnafu)?;
 
     let mut cm_builder = ConfigMapBuilder::new();
 
     cm_builder
         .metadata(
             ObjectMetaBuilder::new()
-                .name_and_namespace(owner)
+                .namespace(&cluster.namespace)
                 .name(rolegroup.object_name())
-                .ownerreference_from_resource(owner, None, Some(true))
-                .context(ObjectMissingMetadataForOwnerRefSnafu)?
+                .ownerreference(ownerreference_from_resource(cluster, None, Some(true)))
                 .with_recommended_labels(recommended_labels)
                 .context(MetadataBuildSnafu)?
                 .build(),
@@ -133,11 +125,11 @@ pub fn build_rolegroup_config_map(
         )
         .add_data(
             ConfigFileName::NifiProperties.to_string(),
-            nifi_properties::build(cluster, rg, git_sync_resources).with_context(|_| {
-                BuildNifiPropertiesSnafu {
+            nifi_properties::build(cluster, rg, &proxy_hosts, &git_sync_resources).with_context(
+                |_| BuildNifiPropertiesSnafu {
                     rolegroup: rolegroup.clone(),
-                }
-            })?,
+                },
+            )?,
         )
         .add_data(
             ConfigFileName::StateManagementXml.to_string(),
@@ -150,9 +142,7 @@ pub fn build_rolegroup_config_map(
         )
         .add_data(
             ConfigFileName::Authorizers.to_string(),
-            // TODO: authorizers::build currently takes a raw &NifiCluster; once migrated
-            // to ValidatedCluster this `owner` arg can be removed.
-            authorizers::build(cluster, owner),
+            authorizers::build(cluster),
         )
         .add_data(
             ConfigFileName::SecurityProperties.to_string(),

rust/operator-binary/src/controller/build/git_sync.rs

@@ -0,0 +1,38 @@
+//! Builds the git-sync resources (volumes, mounts, containers) for a NiFi Node rolegroup.
+
+use snafu::{ResultExt, Snafu};
+use stackable_operator::crd::git_sync;
+
+use crate::{
+    controller::{
+        LOG_VOLUME_NAME, env_vars_from_overrides,
+        validate::{NifiRoleGroupConfig, ValidatedCluster},
+    },
+    crd::Container,
+};
+
+#[derive(Snafu, Debug)]
+pub enum Error {
+    #[snafu(display("invalid git-sync specification"))]
+    InvalidGitSyncSpec { source: git_sync::v1alpha2::Error },
+}
+
+type Result<T, E = Error> = std::result::Result<T, E>;
+
+/// Builds the [`git_sync::v1alpha2::GitSyncResources`] for a single Node rolegroup. The env vars
+/// and logging configuration differ per rolegroup, so the resources are computed per rolegroup
+/// rather than once for the whole cluster.
+pub fn build_git_sync_resources(
+    cluster: &ValidatedCluster,
+    rg: &NifiRoleGroupConfig,
+) -> Result<git_sync::v1alpha2::GitSyncResources> {
+    git_sync::v1alpha2::GitSyncResources::new(
+        &cluster.cluster_config.custom_components_git_sync,
+        &cluster.image,
+        &env_vars_from_overrides(&rg.env_overrides),
+        &[],
+        LOG_VOLUME_NAME,
+        &rg.config.logging.for_container(&Container::GitSync),
+    )
+    .context(InvalidGitSyncSpecSnafu)
+}

rust/operator-binary/src/controller/build/properties.rs

@@ -88,7 +88,10 @@ pub(crate) mod test_support {
         },
         kube::ResourceExt as _,
         kvp::LabelValue,
-        v2::types::kubernetes::NamespaceName,
+        v2::types::{
+            kubernetes::{NamespaceName, Uid},
+            operator::ClusterName,
+        },
     };
 
     use crate::{
@@ -160,13 +163,18 @@ pub(crate) mod test_support {
             pull_secrets: None,
         };
 
-        ValidatedCluster {
-            name: "simple-nifi".to_string(),
-            namespace: NamespaceName::from_str("default").expect("valid namespace"),
+        let name = ClusterName::from_str("simple-nifi").expect("valid cluster name");
+        let namespace = NamespaceName::from_str("default").expect("valid namespace");
+        let uid = Uid::from_str("e6ac237d-a6d4-43a1-8135-f36506110912").expect("valid uid");
+
+        ValidatedCluster::new(
+            name,
+            namespace,
+            uid,
             image,
+            nifi.spec.nodes.clone().expect("minimal fixture has nodes"),
             role_group_configs,
-            git_sync_resources: Default::default(),
-            cluster_config: ValidatedClusterConfig {
+            ValidatedClusterConfig {
                 authentication: NifiAuthenticationConfig::SingleUser {
                     provider: StaticAuthProvider {
                         user_credentials_secret: UserCredentialsSecretRef {
@@ -175,11 +183,16 @@ pub(crate) mod test_support {
                     },
                 },
                 authorization: ResolvedNifiAuthorizationConfig::SingleUser,
-                proxy_hosts: "*".to_string(),
                 clustering_backend: v1alpha1::NifiClusteringBackend::Kubernetes {},
                 sensitive_properties_algorithm: Default::default(), // NifiArgon2AesGcm256
+                host_header_check: nifi.spec.cluster_config.host_header_check.clone(),
+                custom_components_git_sync: nifi
+                    .spec
+                    .cluster_config
+                    .custom_components_git_sync
+                    .clone(),
             },
-        }
+        )
     }
 
     /// Return the "default" role-group config from a [`ValidatedCluster`].

rust/operator-binary/src/controller/build/properties/authorizers.rs

@@ -1,29 +1,24 @@
 //! Builder for `authorizers.xml`.
 
-use crate::{controller::validate::ValidatedCluster, crd::v1alpha1};
+use crate::controller::validate::ValidatedCluster;
 
-pub fn build(cluster: &ValidatedCluster, nifi: &v1alpha1::NifiCluster) -> String {
-    // TODO(follow-up PR): narrow get_authorizers_config to resolved fields on ValidatedCluster instead of taking the full NifiCluster.
+pub fn build(cluster: &ValidatedCluster) -> String {
     cluster
         .cluster_config
         .authorization
-        .get_authorizers_config(nifi)
+        .get_authorizers_config(cluster.name.as_ref())
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::controller::build::properties::test_support::{
-        MINIMAL_NIFI_YAML, minimal_validated_cluster,
-    };
+    use crate::controller::build::properties::test_support::minimal_validated_cluster;
 
     #[test]
     fn test_build_returns_non_empty_xml_with_authorizers_root() {
         let cluster = minimal_validated_cluster();
-        let nifi: v1alpha1::NifiCluster =
-            serde_yaml::from_str(MINIMAL_NIFI_YAML).expect("invalid test YAML");
 
-        let xml = build(&cluster, &nifi);
+        let xml = build(&cluster);
 
         assert!(!xml.is_empty(), "authorizers.xml should not be empty");
         assert!(

rust/operator-binary/src/controller/build/properties/nifi_properties.rs

@@ -28,10 +28,10 @@ const STORAGE_CONTENT_ARCHIVE_UTILIZATION_FACTOR: f32 = 0.5;
 pub fn build(
     cluster: &ValidatedCluster,
     rg: &NifiRoleGroupConfig,
+    proxy_hosts: &str,
     git_sync_resources: &git_sync::v1alpha2::GitSyncResources,
 ) -> Result<String, Error> {
     let product_version = &cluster.image.product_version;
-    let proxy_hosts = &cluster.cluster_config.proxy_hosts;
     let auth_config = &cluster.cluster_config.authentication;
     let resource_config = &rg.config.resources;
 
@@ -603,7 +603,7 @@ mod tests {
         let rg = default_rg(&cluster);
         let git_sync = empty_git_sync_resources();
 
-        let props = build(&cluster, rg, &git_sync).expect("build should succeed");
+        let props = build(&cluster, rg, "*", &git_sync).expect("build should succeed");
 
         // HTTPS port
         assert!(
@@ -690,7 +690,8 @@ mod tests {
             .insert("default".to_string(), rg.clone());
 
         let git_sync = empty_git_sync_resources();
-        let props = build(&cluster, &rg, &git_sync).expect("build with override should succeed");
+        let props =
+            build(&cluster, &rg, "*", &git_sync).expect("build with override should succeed");
 
         assert!(
             props.contains("some.custom.key=some-custom-value"),