fix: introduce ValidatedRoleConfig

Author: maltesander

rust/operator-binary/src/controller/mod.rs

@@ -21,7 +21,7 @@ use stackable_operator::{
         role_group_utils::ResourceNames,
         role_utils::JavaCommonConfig,
         types::{
-            kubernetes::{NamespaceName, Uid},
+            kubernetes::{ListenerClassName, NamespaceName, Uid},
             operator::{
                 ClusterName, ControllerName, OperatorName, ProductName, ProductVersion,
                 RoleGroupName, RoleName,
@@ -103,6 +103,9 @@ pub struct ValidatedCluster {
     /// The product version as a type-safe label value, used for the `app.kubernetes.io/version`
     /// label on built resources.
     pub product_version: ProductVersion,
+    /// Per-role configuration (PodDisruptionBudget and listener class). The `nodes` role is
+    /// mandatory, so this is always present.
+    pub role_config: ValidatedRoleConfig,
     /// Cluster wide settings.
     pub cluster_config: ValidatedClusterConfig,
     /// Collected configuration per rolegroup.
@@ -131,6 +134,13 @@ pub struct ValidatedClusterConfig {
     pub reporting_task_pod_overrides: PodTemplateSpec,
 }
 
+/// Per-role configuration extracted during validation.
+#[derive(Clone, Debug)]
+pub struct ValidatedRoleConfig {
+    pub pdb: stackable_operator::commons::pdb::PdbConfig,
+    pub listener_class: ListenerClassName,
+}
+
 impl ValidatedCluster {
     /// Builds a [`ValidatedCluster`], deriving the synthetic [`ObjectMeta`] from name, namespace
     /// and uid so the struct can implement [`Resource`].
@@ -141,6 +151,7 @@ impl ValidatedCluster {
         uid: Uid,
         image: ResolvedProductImage,
         product_version: ProductVersion,
+        role_config: ValidatedRoleConfig,
         role_group_configs: BTreeMap<NifiRole, BTreeMap<RoleGroupName, ValidatedRoleGroupConfig>>,
         cluster_config: ValidatedClusterConfig,
     ) -> Self {
@@ -158,6 +169,7 @@ impl ValidatedCluster {
             uid,
             image,
             product_version,
+            role_config,
             role_group_configs,
             cluster_config,
         }

rust/operator-binary/src/controller/validate.rs

@@ -27,7 +27,9 @@ use stackable_operator::{
 };
 use strum::{EnumDiscriminants, IntoStaticStr};
 
-use super::{ValidatedCluster, ValidatedClusterConfig, ValidatedRoleGroupConfig};
+use super::{
+    ValidatedCluster, ValidatedClusterConfig, ValidatedRoleConfig, ValidatedRoleGroupConfig,
+};
 use crate::{
     controller::{build::git_sync::build_git_sync_resources, dereference::DereferencedObjects},
     crd::{Container, NifiConfig, NifiRole, sensitive_properties, v1alpha1},
@@ -144,6 +146,17 @@ pub fn validate(
     let role_group_configs =
         build_role_group_configs(nifi, &image, &vector_aggregator_config_map_name)?;
 
+    // Per-role config (PDB + listener class), extracted here so downstream builders source it from
+    // the `ValidatedCluster` rather than the raw `NifiCluster`. The `nodes` role is mandatory
+    // (already enforced by `build_role_group_configs` above), so this is always present.
+    let role_config = nifi
+        .role_config(&NifiRole::Node)
+        .map(|role_config| ValidatedRoleConfig {
+            pdb: role_config.common.pod_disruption_budget.clone(),
+            listener_class: role_config.listener_class.clone(),
+        })
+        .context(NoNodesDefinedSnafu)?;
+
     let name = get_cluster_name(nifi).context(GetClusterNameSnafu)?;
     let namespace = dereferenced_objects.namespace.clone();
     let uid = get_uid(nifi).context(GetUidSnafu)?;
@@ -159,6 +172,7 @@ pub fn validate(
         uid,
         image,
         product_version,
+        role_config,
         role_group_configs,
         ValidatedClusterConfig {
             authentication: authentication_config,

rust/operator-binary/src/nifi_controller.rs

@@ -15,7 +15,6 @@ use stackable_operator::{
         runtime::controller::Action,
     },
     logging::controller::ReconcilerError,
-    role_utils::GenericRoleConfig,
     shared::time::Duration,
     status::condition::{
         compute_conditions, operations::ClusterOperationsConditionBuilder,
@@ -44,7 +43,7 @@ use crate::{
         upgrade::{self, ClusterVersionUpdateState},
         validate,
     },
-    crd::{APP_NAME, NifiNodeRoleConfig, NifiRole, NifiStatus, v1alpha1},
+    crd::{APP_NAME, NifiRole, NifiStatus, v1alpha1},
     security::{
         authentication::NifiAuthenticationConfig, check_or_generate_oidc_admin_password,
         check_or_generate_sensitive_key,
@@ -359,33 +358,25 @@ pub async fn reconcile_nifi(
         .await?
     }
 
-    let role_config = nifi.role_config(&nifi_role);
-    if let Some(NifiNodeRoleConfig {
-        common: GenericRoleConfig {
-            pod_disruption_budget: pdb,
-        },
-        listener_class,
-    }) = role_config
-    {
-        if let Some(pdb) = build_pdb(pdb, &validated_cluster, &nifi_role) {
-            cluster_resources
-                .add(client, pdb)
-                .await
-                .context(ApplyPdbSnafu)?;
-        }
-
-        let role_group_listener = build_group_listener(
-            &validated_cluster,
-            listener_class.to_owned(),
-            group_listener_name(&validated_cluster, &nifi_role.to_string()),
-        );
-
+    let role_config = &validated_cluster.role_config;
+    if let Some(pdb) = build_pdb(&role_config.pdb, &validated_cluster, &nifi_role) {
         cluster_resources
-            .add(client, role_group_listener)
+            .add(client, pdb)
             .await
-            .context(ApplyGroupListenerSnafu)?;
+            .context(ApplyPdbSnafu)?;
     }
 
+    let role_group_listener = build_group_listener(
+        &validated_cluster,
+        role_config.listener_class.clone(),
+        group_listener_name(&validated_cluster, &nifi_role.to_string()),
+    );
+
+    cluster_resources
+        .add(client, role_group_listener)
+        .await
+        .context(ApplyGroupListenerSnafu)?;
+
     // Only add the reporting task in case it is enabled.
     if nifi.spec.cluster_config.create_reporting_task_job.enabled {
         if let Some((reporting_task_job, reporting_task_service)) = build_maybe_reporting_task(