refactor: use v2 ConfigMapName, SecretName, ListenerName

Author: maltesander

extra/crds.yaml

@@ -57,6 +57,9 @@ spec:
                     properties:
                       serverSecretClass:
                         description: Name of the SecretClass which will provide TLS certificates for the OPA server.
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                         type: string
                     required:
                     - serverSecretClass
@@ -94,6 +97,9 @@ spec:
                                   permissions `User.ReadAll` and `GroupMemberShip.ReadAll`.
 
                                   Must contain the fields `clientId` and `clientSecret`.
+                                maxLength: 253
+                                minLength: 1
+                                pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                 type: string
                               port:
                                 description: Port of the identity provider. If TLS is used defaults to `443`, otherwise to `80`.
@@ -191,6 +197,9 @@ spec:
                                 type: object
                               kerberosSecretClassName:
                                 description: The name of the Kerberos SecretClass.
+                                maxLength: 253
+                                minLength: 1
+                                pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                 type: string
                               ldapServer:
                                 description: Hostname of the domain controller, e.g. `ad-ds-1.contoso.com`.
@@ -422,6 +431,9 @@ spec:
                                   Name of a Secret that contains client credentials of a Keycloak account with permission to read user metadata.
 
                                   Must contain the fields `clientId` and `clientSecret`.
+                                maxLength: 253
+                                minLength: 1
+                                pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                 type: string
                               hostname:
                                 description: Hostname of the identity provider, e.g. `my.keycloak.corp`.
@@ -510,7 +522,10 @@ spec:
                     description: |-
                       Name of the Vector aggregator discovery ConfigMap.
                       It must contain the key `ADDRESS` with the address of the Vector aggregator.
+                    maxLength: 253
+                    minLength: 1
                     nullable: true
+                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                     type: string
                 type: object
               clusterOperation:
@@ -1834,6 +1849,9 @@ spec:
                     properties:
                       serverSecretClass:
                         description: Name of the SecretClass which will provide TLS certificates for the OPA server.
+                        maxLength: 253
+                        minLength: 1
+                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                         type: string
                     required:
                     - serverSecretClass
@@ -1886,6 +1904,9 @@ spec:
                                 type: object
                               kerberosSecretClassName:
                                 description: The name of the Kerberos SecretClass.
+                                maxLength: 253
+                                minLength: 1
+                                pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                 type: string
                               ldapServer:
                                 description: Hostname of the domain controller, e.g. `ad-ds-1.contoso.com`.
@@ -1949,6 +1970,9 @@ spec:
                                   permissions `User.ReadAll` and `GroupMemberShip.ReadAll`.
 
                                   Must contain the fields `clientId` and `clientSecret`.
+                                maxLength: 253
+                                minLength: 1
+                                pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                 type: string
                               port:
                                 description: Port of the identity provider. If TLS is used defaults to `443`, otherwise to `80`.
@@ -2199,6 +2223,9 @@ spec:
                                   Name of a Secret that contains client credentials of a Keycloak account with permission to read user metadata.
 
                                   Must contain the fields `clientId` and `clientSecret`.
+                                maxLength: 253
+                                minLength: 1
+                                pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                 type: string
                               hostname:
                                 description: Hostname of the identity provider, e.g. `my.keycloak.corp`.
@@ -2287,7 +2314,10 @@ spec:
                     description: |-
                       Name of the Vector aggregator discovery ConfigMap.
                       It must contain the key `ADDRESS` with the address of the Vector aggregator.
+                    maxLength: 253
+                    minLength: 1
                     nullable: true
+                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                     type: string
                 type: object
               clusterOperation:

rust/operator-binary/src/controller/build/resource/daemonset.rs

@@ -413,7 +413,7 @@ pub fn build_server_rolegroup_daemonset(
             VolumeBuilder::new(TLS_VOLUME_NAME.as_ref())
                 .ephemeral(
                     SecretOperatorVolumeSourceBuilder::new(
-                        &tls.server_secret_class,
+                        tls.server_secret_class.to_string(),
                         // OPA needs the full TLS keypair (public cert + private key) to serve HTTPS.
                         SecretClassVolumeProvisionParts::PublicPrivate,
                     )
@@ -466,7 +466,7 @@ pub fn build_server_rolegroup_daemonset(
             user_info_fetcher::v1alpha2::Backend::ActiveDirectory(ad) => {
                 pb.add_volume(
                     SecretClassVolume::new(
-                        ad.kerberos_secret_class_name.clone(),
+                        ad.kerberos_secret_class_name.to_string(),
                         Some(SecretClassVolumeScope {
                             pod: false,
                             node: false,
@@ -505,7 +505,7 @@ pub fn build_server_rolegroup_daemonset(
                 pb.add_volume(
                     VolumeBuilder::new(USER_INFO_FETCHER_CREDENTIALS_VOLUME_NAME.as_ref())
                         .secret(SecretVolumeSource {
-                            secret_name: Some(keycloak.client_credentials_secret.clone()),
+                            secret_name: Some(keycloak.client_credentials_secret.to_string()),
                             ..Default::default()
                         })
                         .build(),
@@ -526,7 +526,7 @@ pub fn build_server_rolegroup_daemonset(
                 pb.add_volume(
                     VolumeBuilder::new(USER_INFO_FETCHER_CREDENTIALS_VOLUME_NAME.as_ref())
                         .secret(SecretVolumeSource {
-                            secret_name: Some(entra.client_credentials_secret.clone()),
+                            secret_name: Some(entra.client_credentials_secret.to_string()),
                             ..Default::default()
                         })
                         .build(),

rust/operator-binary/src/controller/build/resource/discovery.rs

@@ -59,7 +59,7 @@ pub fn build_discovery_config_map(
     cm_builder.metadata(metadata).add_data("OPA", url);
 
     if let Some(tls) = &cluster.cluster_config.tls {
-        cm_builder.add_data("OPA_SECRET_CLASS", &tls.server_secret_class);
+        cm_builder.add_data("OPA_SECRET_CLASS", tls.server_secret_class.to_string());
     }
 
     cm_builder.build().context(BuildConfigMapSnafu)

rust/operator-binary/src/controller/validate.rs

@@ -76,11 +76,6 @@ pub enum Error {
         "the Vector agent is enabled but no Vector aggregator discovery ConfigMap name is set"
     ))]
     MissingVectorAggregatorConfigMapName,
-
-    #[snafu(display("the Vector aggregator discovery ConfigMap name is invalid"))]
-    ParseVectorAggregatorConfigMapName {
-        source: stackable_operator::v2::macros::attributed_string_type::Error,
-    },
 }
 
 type Result<T, E = Error> = std::result::Result<T, E>;
@@ -144,16 +139,14 @@ pub fn validate(
         )
         .context(ResolveProductImageSnafu)?;
 
-    // The Vector aggregator discovery ConfigMap name (validated here so an invalid name fails
-    // up-front). It is only required when the Vector agent is enabled for a role group.
+    // The Vector aggregator discovery ConfigMap name. Validated at deserialization by the
+    // `ConfigMapName` newtype on the CRD field. It is only required when the Vector agent is
+    // enabled for a role group.
     let vector_aggregator_config_map_name = opa
         .spec
         .cluster_config
         .vector_aggregator_config_map_name
-        .as_deref()
-        .map(ConfigMapName::from_str)
-        .transpose()
-        .context(ParseVectorAggregatorConfigMapNameSnafu)?;
+        .clone();
 
     let mut role_group_configs = BTreeMap::new();
     for opa_role in OpaRole::iter() {

rust/operator-binary/src/crd/mod.rs

@@ -18,7 +18,11 @@ use stackable_operator::{
     schemars::{self, JsonSchema},
     shared::time::Duration,
     status::condition::{ClusterCondition, HasStatusCondition},
-    v2::{config_overrides::JsonOrKeyValueConfigOverrides, role_utils::GenericCommonConfig},
+    v2::{
+        config_overrides::JsonOrKeyValueConfigOverrides,
+        role_utils::GenericCommonConfig,
+        types::kubernetes::{ConfigMapName, SecretClassName},
+    },
     versioned::versioned,
 };
 use strum::{Display, EnumIter, EnumString};
@@ -85,7 +89,7 @@ pub mod versioned {
         /// Name of the Vector aggregator discovery ConfigMap.
         /// It must contain the key `ADDRESS` with the address of the Vector aggregator.
         #[serde(skip_serializing_if = "Option::is_none")]
-        pub vector_aggregator_config_map_name: Option<String>,
+        pub vector_aggregator_config_map_name: Option<ConfigMapName>,
 
         /// This field controls which type of Service the operator creates for this OpaCluster:
         ///
@@ -125,7 +129,7 @@ pub mod versioned {
     #[serde(rename_all = "camelCase")]
     pub struct OpaTls {
         /// Name of the SecretClass which will provide TLS certificates for the OPA server.
-        pub server_secret_class: String,
+        pub server_secret_class: SecretClassName,
     }
 
     // TODO: Temporary solution until listener-operator is finished

rust/operator-binary/src/crd/user_info_fetcher/mod.rs

@@ -9,6 +9,7 @@ use stackable_operator::{
     },
     schemars::{self, JsonSchema},
     shared::time::Duration,
+    v2::types::kubernetes::{SecretClassName, SecretName},
     versioned::versioned,
 };
 
@@ -75,7 +76,7 @@ pub mod versioned {
         /// Name of a Secret that contains client credentials of a Keycloak account with permission to read user metadata.
         ///
         /// Must contain the fields `clientId` and `clientSecret`.
-        pub client_credentials_secret: String,
+        pub client_credentials_secret: SecretName,
 
         /// The Keycloak realm that OPA's Keycloak account (as specified by `credentialsSecretName` exists in).
         ///
@@ -90,7 +91,7 @@ pub mod versioned {
     #[serde(rename_all = "camelCase")]
     pub struct AasBackend {
         /// Hostname of the identity provider, e.g. `my.aas.corp`.
-        pub hostname: String,
+        pub hostname: HostName,
 
         /// Port of the identity provider. Defaults to port 5000.
         #[serde(default = "aas_default_port")]
@@ -101,13 +102,13 @@ pub mod versioned {
     #[serde(rename_all = "camelCase")]
     pub struct ActiveDirectoryBackend {
         /// Hostname of the domain controller, e.g. `ad-ds-1.contoso.com`.
-        pub ldap_server: String,
+        pub ldap_server: HostName,
 
         /// The root Distinguished Name (DN) where users and groups are located.
         pub base_distinguished_name: String,
 
         /// The name of the Kerberos SecretClass.
-        pub kerberos_secret_class_name: String,
+        pub kerberos_secret_class_name: SecretClassName,
 
         /// Use a TLS connection. If not specified then no TLS will be used.
         #[serde(flatten)]
@@ -155,7 +156,7 @@ pub mod versioned {
         /// permissions `User.ReadAll` and `GroupMemberShip.ReadAll`.
         ///
         /// Must contain the fields `clientId` and `clientSecret`.
-        pub client_credentials_secret: String,
+        pub client_credentials_secret: SecretName,
     }
 
     #[derive(Clone, Debug, Deserialize, Eq, JsonSchema, PartialEq, Serialize)]

rust/user-info-fetcher/src/main.rs

@@ -129,7 +129,7 @@ async fn resolve_backend(
             Ok(ResolvedBackend::ExperimentalXfscAas(resolved))
         }
         v1alpha2::Backend::ActiveDirectory(config) => Ok(ResolvedBackend::ActiveDirectory {
-            ldap_server: config.ldap_server,
+            ldap_server: config.ldap_server.to_string(),
             tls: config.tls,
             base_distinguished_name: config.base_distinguished_name,
             custom_attribute_mappings: config.custom_attribute_mappings,