refactor: Fold discovery into the build step (ValidatedCluster)

Move discovery.rs into controller/build/discovery.rs and refactor
build_discovery_config_map to take the ValidatedCluster + role Service +
cluster_info, reading the TLS scheme/port and secret class from
cluster_config and the app version from the resolved image. The owner object
is used only for the owner reference and object metadata.

ValidatedClusterConfig gains a `tls` field (alongside `user_info`), mirroring
trino/hdfs. The discovery ConfigMap name now comes from `cluster.name`, which
finally consumes that field and removes its `#[allow(dead_code)]`.

Adds unit tests asserting the discovery URL (http/https + port) and the
OPA_SECRET_CLASS entry with and without TLS.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: maltesander

rust/operator-binary/src/controller.rs

@@ -72,7 +72,6 @@ use crate::{
         OpaClusterStatus, OpaConfig, OpaRole, user_info_fetcher, v1alpha2,
     },
     controller::build::properties::logging::BundleBuilderLogLevel,
-    discovery::{self, build_discovery_configmaps},
     operations::graceful_shutdown::add_graceful_shutdown_config,
     service::{
         self, APP_PORT, APP_PORT_NAME, build_rolegroup_headless_service,
@@ -228,7 +227,7 @@ pub enum Error {
     },
 
     #[snafu(display("failed to build discovery ConfigMap"))]
-    BuildDiscoveryConfig { source: discovery::Error },
+    BuildDiscoveryConfig { source: build::discovery::Error },
 
     #[snafu(display("failed to apply discovery ConfigMap"))]
     ApplyDiscoveryConfig {
@@ -473,20 +472,17 @@ pub async fn reconcile_opa(
             .context(ApplyPatchRoleGroupDaemonSetSnafu { rolegroup })?;
     }
 
-    for discovery_cm in build_discovery_configmaps(
-        opa,
-        opa,
-        &validated.image,
+    let discovery_cm = build::discovery::build_discovery_config_map(
+        &validated,
         &server_role_service,
         &client.kubernetes_cluster_info,
+        opa,
     )
-    .context(BuildDiscoveryConfigSnafu)?
-    {
-        cluster_resources
-            .add(client, discovery_cm)
-            .await
-            .context(ApplyDiscoveryConfigSnafu)?;
-    }
+    .context(BuildDiscoveryConfigSnafu)?;
+    cluster_resources
+        .add(client, discovery_cm)
+        .await
+        .context(ApplyDiscoveryConfigSnafu)?;
 
     let cluster_operation_cond_builder =
         ClusterOperationsConditionBuilder::new(&opa.spec.cluster_operation);

rust/operator-binary/src/controller/build.rs

@@ -2,4 +2,5 @@
 //! Kubernetes resource specifications.
 
 pub mod config_map;
+pub mod discovery;
 pub mod properties;

rust/operator-binary/src/controller/build/discovery.rs

@@ -0,0 +1,167 @@
+//! Builds the discovery [`ConfigMap`] clients use to connect to an `OpaCluster`.
+//!
+//! The content comes entirely from the [`ValidatedCluster`] (plus the externally-resolved role
+//! [`Service`] and `cluster_info`); the owner object is only used for the owner reference and
+//! object metadata.
+
+use snafu::{OptionExt, ResultExt, Snafu};
+use stackable_operator::{
+    builder::{configmap::ConfigMapBuilder, meta::ObjectMetaBuilder},
+    k8s_openapi::api::core::v1::{ConfigMap, Service},
+    kube::runtime::reflector::ObjectRef,
+    utils::cluster_info::KubernetesClusterInfo,
+};
+
+use crate::{
+    controller::{build_recommended_labels, validate::ValidatedCluster},
+    crd::{OpaRole, v1alpha2},
+    service::{APP_PORT, APP_TLS_PORT},
+};
+
+#[derive(Snafu, Debug)]
+pub enum Error {
+    #[snafu(display("object {} is missing metadata to build owner reference", opa))]
+    ObjectMissingMetadataForOwnerRef {
+        source: stackable_operator::builder::meta::Error,
+        opa: ObjectRef<v1alpha2::OpaCluster>,
+    },
+
+    #[snafu(display("the role Service has no name associated"))]
+    NoServiceName,
+
+    #[snafu(display("the role Service has no namespace associated"))]
+    NoServiceNamespace,
+
+    #[snafu(display("failed to build ConfigMap"))]
+    BuildConfigMap {
+        source: stackable_operator::builder::configmap::Error,
+    },
+
+    #[snafu(display("failed to build object meta data"))]
+    ObjectMeta {
+        source: stackable_operator::builder::meta::Error,
+    },
+}
+
+type Result<T, E = Error> = std::result::Result<T, E>;
+
+/// Builds the discovery [`ConfigMap`] containing the URL (and, when TLS is enabled, the secret
+/// class) clients need to connect to the cluster.
+pub fn build_discovery_config_map(
+    cluster: &ValidatedCluster,
+    svc: &Service,
+    cluster_info: &KubernetesClusterInfo,
+    owner: &v1alpha2::OpaCluster,
+) -> Result<ConfigMap> {
+    let name = cluster.name.to_string();
+
+    let (scheme, port) = if cluster.cluster_config.tls.is_some() {
+        ("https", APP_TLS_PORT)
+    } else {
+        ("http", APP_PORT)
+    };
+
+    let url = format!(
+        "{scheme}://{service_name}.{namespace}.svc.{cluster_domain}:{port}/",
+        service_name = svc.metadata.name.as_deref().context(NoServiceNameSnafu)?,
+        namespace = svc
+            .metadata
+            .namespace
+            .as_deref()
+            .context(NoServiceNamespaceSnafu)?,
+        cluster_domain = cluster_info.cluster_domain,
+    );
+
+    let metadata = ObjectMetaBuilder::new()
+        .name_and_namespace(owner)
+        .name(&name)
+        .ownerreference_from_resource(owner, None, Some(true))
+        .with_context(|_| ObjectMissingMetadataForOwnerRefSnafu {
+            opa: ObjectRef::from_obj(owner),
+        })?
+        .with_recommended_labels(&build_recommended_labels(
+            owner,
+            &cluster.image.app_version_label_value,
+            &OpaRole::Server.to_string(),
+            "discovery",
+        ))
+        .context(ObjectMetaSnafu)?
+        .build();
+
+    let mut cm_builder = ConfigMapBuilder::new();
+    cm_builder.metadata(metadata).add_data("OPA", url);
+
+    if let Some(tls) = &cluster.cluster_config.tls {
+        cm_builder.add_data("OPA_SECRET_CLASS", &tls.server_secret_class);
+    }
+
+    cm_builder.build().context(BuildConfigMapSnafu)
+}
+
+#[cfg(test)]
+mod tests {
+    use stackable_operator::{
+        commons::networking::DomainName,
+        k8s_openapi::api::core::v1::{Service, ServiceSpec},
+        kube::api::ObjectMeta,
+        utils::cluster_info::KubernetesClusterInfo,
+    };
+
+    use super::*;
+    use crate::controller::build::properties::test_support::validated_cluster_from_spec;
+
+    fn role_service() -> Service {
+        Service {
+            metadata: ObjectMeta {
+                name: Some("test-opa-server".to_owned()),
+                namespace: Some("default".to_owned()),
+                ..ObjectMeta::default()
+            },
+            spec: Some(ServiceSpec::default()),
+            status: None,
+        }
+    }
+
+    fn cluster_info() -> KubernetesClusterInfo {
+        KubernetesClusterInfo {
+            cluster_domain: DomainName::try_from("cluster.local").unwrap(),
+        }
+    }
+
+    #[test]
+    fn renders_http_url_without_tls() {
+        let (opa, validated) = validated_cluster_from_spec(serde_json::json!({
+            "image": { "productVersion": "1.2.3" },
+            "servers": { "roleGroups": { "default": {} } },
+        }));
+
+        let cm =
+            build_discovery_config_map(&validated, &role_service(), &cluster_info(), &opa).unwrap();
+        let data = cm.data.unwrap();
+
+        assert_eq!(
+            data.get("OPA").map(String::as_str),
+            Some("http://test-opa-server.default.svc.cluster.local:8081/")
+        );
+        assert!(!data.contains_key("OPA_SECRET_CLASS"));
+    }
+
+    #[test]
+    fn renders_https_url_and_secret_class_with_tls() {
+        let (opa, validated) = validated_cluster_from_spec(serde_json::json!({
+            "image": { "productVersion": "1.2.3" },
+            "clusterConfig": { "tls": { "serverSecretClass": "tls" } },
+            "servers": { "roleGroups": { "default": {} } },
+        }));
+
+        let cm =
+            build_discovery_config_map(&validated, &role_service(), &cluster_info(), &opa).unwrap();
+        let data = cm.data.unwrap();
+
+        assert_eq!(
+            data.get("OPA").map(String::as_str),
+            Some("https://test-opa-server.default.svc.cluster.local:8443/")
+        );
+        assert_eq!(data.get("OPA_SECRET_CLASS").map(String::as_str), Some("tls"));
+    }
+}

rust/operator-binary/src/controller/validate.rs

@@ -17,7 +17,10 @@ use stackable_operator::{
 };
 use strum::IntoEnumIterator;
 
-use crate::crd::{OpaConfig, OpaConfigOverrides, OpaRole, user_info_fetcher, v1alpha2};
+use crate::crd::{
+    OpaConfig, OpaConfigOverrides, OpaRole, user_info_fetcher,
+    v1alpha2::{self, OpaTls},
+};
 
 #[derive(Snafu, Debug)]
 pub enum Error {
@@ -43,8 +46,6 @@ type Result<T, E = Error> = std::result::Result<T, E>;
 /// for every role group, ready to be turned into Kubernetes resources without touching the raw
 /// `OpaCluster` spec again (except for owner references).
 pub struct ValidatedCluster {
-    // TODO: consumed by the Service / StatefulSet build steps in the follow-up PR.
-    #[allow(dead_code)]
     pub name: ClusterName,
     pub image: ResolvedProductImage,
     pub cluster_config: ValidatedClusterConfig,
@@ -55,6 +56,7 @@ pub struct ValidatedCluster {
 /// raw `OpaCluster` to render config (except for owner references).
 pub struct ValidatedClusterConfig {
     pub user_info: Option<user_info_fetcher::v1alpha2::Config>,
+    pub tls: Option<OpaTls>,
 }
 
 /// The validated configuration of a single role group.
@@ -118,6 +120,7 @@ pub fn validate(
         image,
         cluster_config: ValidatedClusterConfig {
             user_info: opa.spec.cluster_config.user_info.clone(),
+            tls: opa.spec.cluster_config.tls.clone(),
         },
         role_group_configs,
     })

rust/operator-binary/src/discovery.rs

@@ -38,7 +38,6 @@ use crate::{
 
 mod controller;
 mod crd;
-mod discovery;
 mod operations;
 mod service;
 mod webhooks;