refactor: streamline TLS configuration checks and add tls_enabled method

Author: dervoeti

rust/operator-binary/src/controller.rs

@@ -830,8 +830,6 @@ fn build_server_rolegroup_daemonset(
         &v1alpha1::Container::BundleBuilder,
     );
 
-    let opa_tls_config = opa.spec.cluster_config.tls.as_ref();
-
     cb_opa
         .image_from_product_image(resolved_product_image)
         .command(vec![
@@ -844,7 +842,7 @@ fn build_server_rolegroup_daemonset(
         .args(vec![build_opa_start_command(
             merged_config,
             &opa_container_name,
-            opa_tls_config,
+            opa.spec.cluster_config.tls_enabled(),
         )])
         .add_env_vars(env)
         .add_env_var(
@@ -858,7 +856,7 @@ fn build_server_rolegroup_daemonset(
     // .spec.template.spec.containers[name="opa"].ports: duplicate entries for key [containerPort=8081,protocol="TCP"]
     //
     // So we don't do that
-    if opa_tls_config.is_some() {
+    if opa.spec.cluster_config.tls_enabled() {
         cb_opa.add_container_port(service::APP_TLS_PORT_NAME, service::APP_TLS_PORT.into());
         cb_opa
             .add_volume_mount(TLS_VOLUME_NAME, TLS_STORE_DIR)
@@ -874,7 +872,7 @@ fn build_server_rolegroup_daemonset(
         .context(AddVolumeMountSnafu)?
         .resources(merged_config.resources.to_owned().into());
 
-    let (probe_port_name, probe_scheme) = if opa_tls_config.is_some() {
+    let (probe_port_name, probe_scheme) = if opa.spec.cluster_config.tls_enabled() {
         (service::APP_TLS_PORT_NAME, Some("HTTPS".to_string()))
     } else {
         (APP_PORT_NAME, Some("HTTP".to_string()))
@@ -949,7 +947,7 @@ fn build_server_rolegroup_daemonset(
         .service_account_name(service_account.name_any())
         .security_context(PodSecurityContextBuilder::new().fs_group(1000).build());
 
-    if let Some(tls) = opa_tls_config {
+    if let Some(tls) = &opa.spec.cluster_config.tls {
         pb.add_volume(
             VolumeBuilder::new(TLS_VOLUME_NAME)
                 .ephemeral(
@@ -1196,7 +1194,7 @@ fn build_config_file(merged_config: &v1alpha1::OpaConfig) -> String {
 fn build_opa_start_command(
     merged_config: &v1alpha1::OpaConfig,
     container_name: &str,
-    tls_config: Option<&v1alpha1::OpaTls>,
+    tls_enabled: bool,
 ) -> String {
     let mut file_log_level = DEFAULT_FILE_LOG_LEVEL;
     let mut console_log_level = DEFAULT_CONSOLE_LOG_LEVEL;
@@ -1238,7 +1236,7 @@ fn build_opa_start_command(
         }
     }
 
-    let (bind_port, tls_flags) = if tls_config.is_some() {
+    let (bind_port, tls_flags) = if tls_enabled {
         (
             service::APP_TLS_PORT,
             format!(

rust/operator-binary/src/crd/mod.rs

@@ -251,6 +251,13 @@ impl v1alpha1::CurrentlySupportedListenerClasses {
     }
 }
 
+impl v1alpha1::OpaClusterConfig {
+    /// Returns whether TLS encryption is enabled for the OPA server.
+    pub fn tls_enabled(&self) -> bool {
+        self.tls.is_some()
+    }
+}
+
 impl v1alpha1::OpaConfig {
     fn default_config() -> v1alpha1::OpaConfigFragment {
         v1alpha1::OpaConfigFragment {

rust/operator-binary/src/discovery.rs

@@ -66,8 +66,7 @@ fn build_discovery_configmap(
     svc: &Service,
     cluster_info: &KubernetesClusterInfo,
 ) -> Result<ConfigMap, Error> {
-    let tls_config = opa.spec.cluster_config.tls.as_ref();
-    let (scheme, port) = if tls_config.is_some() {
+    let (scheme, port) = if opa.spec.cluster_config.tls_enabled() {
         ("https", APP_TLS_PORT)
     } else {
         ("http", APP_PORT)
@@ -104,7 +103,7 @@ fn build_discovery_configmap(
 
     cm_builder.metadata(metadata).add_data("OPA", url);
 
-    if let Some(tls) = tls_config {
+    if let Some(tls) = opa.spec.cluster_config.tls.as_ref() {
         cm_builder.add_data("OPA_SECRET_CLASS", &tls.server_secret_class);
     }
 

rust/operator-binary/src/service.rs

@@ -59,7 +59,7 @@ pub(crate) fn build_server_role_service(
 
     let service_spec = ServiceSpec {
         type_: Some(opa.spec.cluster_config.listener_class.k8s_service_type()),
-        ports: Some(data_service_ports(opa.spec.cluster_config.tls.is_some())),
+        ports: Some(data_service_ports(opa.spec.cluster_config.tls_enabled())),
         selector: Some(service_selector_labels.into()),
         internal_traffic_policy: Some("Local".to_string()),
         ..ServiceSpec::default()
@@ -104,7 +104,7 @@ pub(crate) fn build_rolegroup_headless_service(
         // options there are non-existent (mTLS still opens plain port) or suck (Kerberos).
         type_: Some("ClusterIP".to_string()),
         cluster_ip: Some("None".to_string()),
-        ports: Some(data_service_ports(opa.spec.cluster_config.tls.is_some())),
+        ports: Some(data_service_ports(opa.spec.cluster_config.tls_enabled())),
         selector: Some(role_group_selector_labels(opa, rolegroup)?.into()),
         publish_not_ready_addresses: Some(true),
         ..ServiceSpec::default()
@@ -138,15 +138,15 @@ pub(crate) fn build_rolegroup_metrics_service(
         .context(ObjectMetaSnafu)?
         .with_labels(prometheus_labels())
         .with_annotations(prometheus_annotations(
-            opa.spec.cluster_config.tls.is_some(),
+            opa.spec.cluster_config.tls_enabled(),
         ))
         .build();
 
     let service_spec = ServiceSpec {
         type_: Some("ClusterIP".to_string()),
         cluster_ip: Some("None".to_string()),
         ports: Some(vec![metrics_service_port(
-            opa.spec.cluster_config.tls.is_some(),
+            opa.spec.cluster_config.tls_enabled(),
         )]),
         selector: Some(role_group_selector_labels(opa, rolegroup)?.into()),
         ..ServiceSpec::default()