refactor: remove raw opacluster dependencies

Author: maltesander

rust/operator-binary/src/controller/build/properties/config_json.rs

@@ -146,7 +146,7 @@ mod tests {
     /// Renders `config.json` for the `default` server role group of an `OpaCluster` built from
     /// `spec`, and parses it back into a [`Value`].
     fn config_json_for(spec: Value) -> Value {
-        let (_, validated) = validated_cluster_from_spec(spec);
+        let validated = validated_cluster_from_spec(spec);
         let rg = validated.role_group_configs[&OpaRole::Server]
             .values()
             .next()

rust/operator-binary/src/controller/build/properties/mod.rs

@@ -26,9 +26,9 @@ pub(crate) mod test_support {
         crd::v1alpha2,
     };
 
-    /// Builds an `OpaCluster` from the given `spec` JSON and runs the validate step, returning both
-    /// the raw cluster (for owner references) and the [`ValidatedCluster`].
-    pub fn validated_cluster_from_spec(spec: Value) -> (v1alpha2::OpaCluster, ValidatedCluster) {
+    /// Builds an `OpaCluster` from the given `spec` JSON and runs the validate step, returning the
+    /// resulting [`ValidatedCluster`].
+    pub fn validated_cluster_from_spec(spec: Value) -> ValidatedCluster {
         let opa: v1alpha2::OpaCluster = serde_json::from_value(json!({
             "apiVersion": "opa.stackable.tech/v1alpha2",
             "kind": "OpaCluster",
@@ -47,8 +47,6 @@ pub(crate) mod test_support {
             image_repository: "oci.stackable.tech/sdp".to_string(),
         };
 
-        let validated = validate(&opa, &operator_environment)
-            .expect("validation should succeed for the fixture");
-        (opa, validated)
+        validate(&opa, &operator_environment).expect("validation should succeed for the fixture")
     }
 }

rust/operator-binary/src/controller/build/resource/config_map.rs

@@ -89,7 +89,7 @@ mod tests {
 
     /// Renders the ConfigMap of the `default` server role group of an `OpaCluster` built from `spec`.
     fn build_config_map(spec: Value) -> ConfigMap {
-        let (_opa, validated) = validated_cluster_from_spec(spec);
+        let validated = validated_cluster_from_spec(spec);
 
         let role = OpaRole::Server;
         let (role_group_name, rg) = validated.role_group_configs[&role]

rust/operator-binary/src/controller/build/resource/daemonset.rs

@@ -18,7 +18,6 @@ use stackable_operator::{
         },
     },
     commons::{
-        product_image_selection::ResolvedProductImage,
         secret_class::{
             SecretClassVolume, SecretClassVolumeProvisionParts, SecretClassVolumeScope,
         },
@@ -60,9 +59,7 @@ use stackable_operator::{
 use super::service::{self, APP_PORT, APP_PORT_NAME};
 use crate::{
     controller::{RoleGroupName, ValidatedCluster, ValidatedRoleGroup, build},
-    crd::{
-        Container, DEFAULT_SERVER_GRACEFUL_SHUTDOWN_TIMEOUT, OpaConfig, user_info_fetcher, v1alpha2,
-    },
+    crd::{Container, DEFAULT_SERVER_GRACEFUL_SHUTDOWN_TIMEOUT, OpaConfig, user_info_fetcher},
     operations::graceful_shutdown::add_graceful_shutdown_config,
 };
 
@@ -234,16 +231,15 @@ fn http_status_liveness_probe(port: IntOrString, scheme: Option<String>) -> Prob
 /// policy queries (which are often chained in serial, and block other tasks in the products).
 #[allow(clippy::too_many_arguments)]
 pub fn build_server_rolegroup_daemonset(
-    opa: &v1alpha2::OpaCluster,
     cluster: &ValidatedCluster,
-    resolved_product_image: &ResolvedProductImage,
     role_group_name: &RoleGroupName,
     role_group: &ValidatedRoleGroup,
     opa_bundle_builder_image: &str,
     user_info_fetcher_image: &str,
     service_account: &ServiceAccount,
     cluster_info: &KubernetesClusterInfo,
 ) -> Result<DaemonSet> {
+    let resolved_product_image = &cluster.image;
     let rolegroup_config = &role_group.config;
     // All overrides were already merged (role group over role over defaults) in the validate step.
     let merged_config = &rolegroup_config.config;
@@ -314,7 +310,7 @@ pub fn build_server_rolegroup_daemonset(
         .args(vec![build_opa_start_command(
             merged_config,
             opa_container_name.as_ref(),
-            opa.spec.cluster_config.tls_enabled(),
+            cluster.cluster_config.tls.is_some(),
             &rolegroup_config.cli_overrides,
         )])
         .add_env_vars(rolegroup_config.env_overrides.clone())
@@ -329,7 +325,7 @@ pub fn build_server_rolegroup_daemonset(
     // .spec.template.spec.containers[name="opa"].ports: duplicate entries for key [containerPort=8081,protocol="TCP"]
     //
     // So we don't do that
-    if opa.spec.cluster_config.tls_enabled() {
+    if cluster.cluster_config.tls.is_some() {
         cb_opa.add_container_port(service::APP_TLS_PORT_NAME, service::APP_TLS_PORT.into());
         cb_opa
             .add_volume_mount(TLS_VOLUME_NAME.as_ref(), TLS_STORE_DIR)
@@ -345,7 +341,7 @@ pub fn build_server_rolegroup_daemonset(
         .context(AddVolumeMountSnafu)?
         .resources(merged_config.resources.to_owned().into());
 
-    let (probe_port_name, probe_scheme) = if opa.spec.cluster_config.tls_enabled() {
+    let (probe_port_name, probe_scheme) = if cluster.cluster_config.tls.is_some() {
         (service::APP_TLS_PORT_NAME, Some("HTTPS".to_string()))
     } else {
         (APP_PORT_NAME, Some("HTTP".to_string()))
@@ -406,7 +402,7 @@ pub fn build_server_rolegroup_daemonset(
         .service_account_name(service_account.name_any())
         .security_context(PodSecurityContextBuilder::new().fs_group(1000).build());
 
-    if let Some(tls) = &opa.spec.cluster_config.tls {
+    if let Some(tls) = &cluster.cluster_config.tls {
         pb.add_volume(
             VolumeBuilder::new(TLS_VOLUME_NAME.as_ref())
                 .ephemeral(
@@ -431,7 +427,7 @@ pub fn build_server_rolegroup_daemonset(
         .context(AddVolumeSnafu)?;
     }
 
-    if let Some(user_info) = &opa.spec.cluster_config.user_info {
+    if let Some(user_info) = &cluster.cluster_config.user_info {
         let user_info_fetcher_container_name = container_name(&Container::UserInfoFetcher);
         let mut cb_user_info_fetcher = new_container_builder(&user_info_fetcher_container_name);
 

rust/operator-binary/src/controller/build/resource/discovery.rs

@@ -82,7 +82,7 @@ mod tests {
 
     #[test]
     fn renders_http_url_without_tls() {
-        let (_opa, validated) = validated_cluster_from_spec(serde_json::json!({
+        let validated = validated_cluster_from_spec(serde_json::json!({
             "image": { "productVersion": "1.2.3" },
             "servers": { "roleGroups": { "default": {} } },
         }));
@@ -99,7 +99,7 @@ mod tests {
 
     #[test]
     fn renders_https_url_and_secret_class_with_tls() {
-        let (_opa, validated) = validated_cluster_from_spec(serde_json::json!({
+        let validated = validated_cluster_from_spec(serde_json::json!({
             "image": { "productVersion": "1.2.3" },
             "clusterConfig": { "tls": { "serverSecretClass": "tls" } },
             "servers": { "roleGroups": { "default": {} } },

rust/operator-binary/src/controller/build/resource/service.rs

@@ -7,10 +7,7 @@ use stackable_operator::{
     v2::builder::meta::ownerreference_from_resource,
 };
 
-use crate::{
-    controller::{RoleGroupName, ValidatedCluster},
-    crd::v1alpha2,
-};
+use crate::controller::{RoleGroupName, ValidatedCluster};
 
 pub const APP_PORT: u16 = 8081;
 pub const APP_TLS_PORT: u16 = 8443;
@@ -27,10 +24,7 @@ fn role_level_role_group_name() -> RoleGroupName {
 
 /// The server-role service is the primary endpoint that should be used by clients that do not perform internal load balancing,
 /// including targets outside of the cluster.
-pub(crate) fn build_server_role_service(
-    opa: &v1alpha2::OpaCluster,
-    cluster: &ValidatedCluster,
-) -> Service {
+pub(crate) fn build_server_role_service(cluster: &ValidatedCluster) -> Service {
     let metadata = ObjectMetaBuilder::new()
         .name_and_namespace(cluster)
         .name(cluster.server_role_service_name())
@@ -39,7 +33,7 @@ pub(crate) fn build_server_role_service(
         .build();
 
     let service_spec = ServiceSpec {
-        type_: Some(opa.spec.cluster_config.listener_class.k8s_service_type()),
+        type_: Some(cluster.cluster_config.listener_class.k8s_service_type()),
         ports: Some(data_service_ports(cluster.cluster_config.tls.is_some())),
         selector: Some(cluster.role_selector().into()),
         // This ensures that products (e.g. Trino) on a node always talk to the OPA pod on the

rust/operator-binary/src/controller/mod.rs

@@ -202,6 +202,7 @@ impl KubeResource for ValidatedCluster {
 pub struct ValidatedClusterConfig {
     pub user_info: Option<user_info_fetcher::v1alpha2::Config>,
     pub tls: Option<v1alpha2::OpaTls>,
+    pub listener_class: v1alpha2::CurrentlySupportedListenerClasses,
 }
 
 /// The validated configuration of a single role group.

rust/operator-binary/src/controller/validate.rs

@@ -227,6 +227,7 @@ pub fn validate(
         ValidatedClusterConfig {
             user_info: opa.spec.cluster_config.user_info.clone(),
             tls: opa.spec.cluster_config.tls.clone(),
+            listener_class: opa.spec.cluster_config.listener_class.clone(),
         },
         role_group_configs,
     ))

rust/operator-binary/src/crd/mod.rs

@@ -268,13 +268,6 @@ impl v1alpha2::CurrentlySupportedListenerClasses {
     }
 }
 
-impl v1alpha2::OpaClusterConfig {
-    /// Returns whether TLS encryption is enabled for the OPA server.
-    pub fn tls_enabled(&self) -> bool {
-        self.tls.is_some()
-    }
-}
-
 impl OpaConfig {
     pub fn default_config() -> OpaConfigFragment {
         OpaConfigFragment {

rust/operator-binary/src/opa_controller.rs

@@ -170,7 +170,7 @@ pub async fn reconcile_opa(
 
     // NOTE(@maltesander): There currently is no dereference (client required) step for OPA.
     // validate (no client required)
-    let validated =
+    let validated_cluster =
         validate::validate(opa, &ctx.operator_environment).context(ValidateClusterSnafu)?;
 
     let opa_role = OpaRole::Server;
@@ -186,12 +186,12 @@ pub async fn reconcile_opa(
     .context(FailedToCreateClusterResourcesSnafu)?;
 
     let empty_role_group_configs = BTreeMap::new();
-    let role_group_configs = validated
+    let role_group_configs = validated_cluster
         .role_group_configs
         .get(&opa_role)
         .unwrap_or(&empty_role_group_configs);
 
-    let server_role_service = build_server_role_service(opa, &validated);
+    let server_role_service = build_server_role_service(&validated_cluster);
     cluster_resources
         .add(client, server_role_service)
         .await
@@ -225,20 +225,19 @@ pub async fn reconcile_opa(
             .map(|_| build::properties::product_logging::vector_config_file_content());
 
         let rg_configmap = build::resource::config_map::build_rolegroup_config_map(
-            &validated,
+            &validated_cluster,
             rolegroup_name,
             &rolegroup.config,
             vector_config,
         )
         .with_context(|_| BuildRoleGroupConfigSnafu {
             rolegroup: rolegroup_name.clone(),
         })?;
-        let rg_service = build_rolegroup_headless_service(&validated, rolegroup_name);
-        let rg_metrics_service = build_rolegroup_metrics_service(&validated, rolegroup_name);
+        let rg_service = build_rolegroup_headless_service(&validated_cluster, rolegroup_name);
+        let rg_metrics_service =
+            build_rolegroup_metrics_service(&validated_cluster, rolegroup_name);
         let rg_daemonset = build::resource::daemonset::build_server_rolegroup_daemonset(
-            opa,
-            &validated,
-            &validated.image,
+            &validated_cluster,
             rolegroup_name,
             rolegroup,
             &ctx.opa_bundle_builder_image,
@@ -302,7 +301,7 @@ pub async fn reconcile_opa(
     }
 
     let discovery_cm = build::resource::discovery::build_discovery_config_map(
-        &validated,
+        &validated_cluster,
         &client.kubernetes_cluster_info,
     )
     .context(BuildDiscoveryConfigSnafu)?;