added integration test; use unversioned labels for STS listener volume

Author: adwk67

deploy/helm/opensearch-operator/crds/crds.yaml

@@ -133,6 +133,10 @@ spec:
                           description: Time period Pods have to gracefully shut down, e.g. `30m`, `1h` or `2d`. Consult the operator documentation for details.
                           nullable: true
                           type: string
+                        listenerClass:
+                          description: This field controls which [ListenerClass](https://docs.stackable.tech/home/nightly/listener-operator/listenerclass.html) is used to expose the webserver.
+                          nullable: true
+                          type: string
                         nodeRoles:
                           items:
                             enum:
@@ -325,6 +329,10 @@ spec:
                                 description: Time period Pods have to gracefully shut down, e.g. `30m`, `1h` or `2d`. Consult the operator documentation for details.
                                 nullable: true
                                 type: string
+                              listenerClass:
+                                description: This field controls which [ListenerClass](https://docs.stackable.tech/home/nightly/listener-operator/listenerclass.html) is used to expose the webserver.
+                                nullable: true
+                                type: string
                               nodeRoles:
                                 items:
                                   enum:

rust/operator-binary/src/controller/build/role_group_builder.rs

@@ -1,3 +1,5 @@
+use std::str::FromStr;
+
 use stackable_operator::{
     builder::{
         meta::ObjectMetaBuilder,
@@ -28,7 +30,7 @@ use crate::{
     controller::{ContextNames, OpenSearchRoleGroupConfig, ValidatedCluster},
     crd::v1alpha1,
     framework::{
-        RoleGroupName,
+        ProductVersion, RoleGroupName,
         builder::meta::ownerreference_from_resource,
         kvp::label::{recommended_labels, role_group_selector, role_selector},
         role_group_utils::ResourceNames,
@@ -126,8 +128,8 @@ impl<'a> RoleGroupBuilder<'a> {
         // still be consistent.
         let listener_volume_claim_template = ListenerOperatorVolumeSourceBuilder::new(
             &ListenerReference::ListenerName(listener_group_name),
-            // TODO should be unversioned
-            &self.recommended_labels(),
+            &self
+                .recommended_labels(ProductVersion::from_str("none").expect("version is supplied")),
         )
         .expect("should be a listener group name")
         .build_pvc(LISTENER_VOLUME_NAME.to_string())
@@ -166,7 +168,7 @@ impl<'a> RoleGroupBuilder<'a> {
         }
 
         let metadata = ObjectMetaBuilder::new()
-            .with_labels(self.recommended_labels())
+            .with_labels(self.recommended_labels(self.cluster.product_version.clone()))
             .with_labels(node_role_labels)
             .build();
 
@@ -413,16 +415,16 @@ impl<'a> RoleGroupBuilder<'a> {
                 None,
                 Some(true),
             ))
-            .with_labels(self.recommended_labels())
+            .with_labels(self.recommended_labels(self.cluster.product_version.clone()))
             .with_labels(extra_labels)
             .build()
     }
 
-    fn recommended_labels(&self) -> Labels {
+    fn recommended_labels(&self, product_version: ProductVersion) -> Labels {
         recommended_labels(
             &self.cluster,
             &self.context_names.product_name,
-            &self.cluster.product_version,
+            &product_version,
             &self.context_names.operator_name,
             &self.context_names.controller_name,
             &ValidatedCluster::role_name(),

tests/templates/kuttl/external-access/00-patch-ns.yaml

@@ -0,0 +1,15 @@
+# see https://github.com/stackabletech/issues/issues/566
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+commands:
+  - script: |
+      kubectl patch namespace $NAMESPACE --patch='
+        {
+          "metadata": {
+            "labels": {
+              "pod-security.kubernetes.io/enforce": "privileged"
+            }
+          }
+        }'
+    timeout: 120

tests/templates/kuttl/external-access/01-rbac.yaml

@@ -0,0 +1,31 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: test-service-account
+---
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: test-role
+rules:
+  - apiGroups:
+      - security.openshift.io
+    resources:
+      - securitycontextconstraints
+    resourceNames:
+      - privileged
+    verbs:
+      - use
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: test-role-binding
+subjects:
+  - kind: ServiceAccount
+    name: test-service-account
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: test-role

tests/templates/kuttl/external-access/10-listener-classes.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+commands:
+  - script: |
+      envsubst < listener-classes.yaml | kubectl apply -n $NAMESPACE -f -

tests/templates/kuttl/external-access/20-assert.yaml

@@ -0,0 +1,49 @@
+# All fields are checked that are set by the operator.
+# This helps to detect unintentional changes.
+# The maintenance effort should be okay as long as it is only done in the smoke test.
+# TODO  Check individual field in unit tests
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+timeout: 600
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: opensearch-nodes-cluster-manager
+spec:
+  replicas: 1
+status:
+  readyReplicas: 1
+  replicas: 1
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: opensearch-nodes-data
+spec:
+  replicas: 1
+status:
+  readyReplicas: 1
+  replicas: 1
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: opensearch-nodes-cluster-manager
+spec:
+  type: NodePort # external-stable
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: opensearch-nodes-data
+spec:
+  type: NodePort # external-unstable
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: opensearch
+spec:
+  type: ClusterIP

tests/templates/kuttl/external-access/20-install-opensearch.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+timeout: 600
+commands:
+  - script: >
+      envsubst < opensearch.yaml |
+      kubectl apply -n $NAMESPACE -f -

tests/templates/kuttl/external-access/listener-classes.yaml

@@ -0,0 +1,21 @@
+---
+apiVersion: listeners.stackable.tech/v1alpha1
+kind: ListenerClass
+metadata:
+  name: test-cluster-internal-$NAMESPACE
+spec:
+  serviceType: ClusterIP
+---
+apiVersion: listeners.stackable.tech/v1alpha1
+kind: ListenerClass
+metadata:
+  name: test-external-stable-$NAMESPACE
+spec:
+  serviceType: NodePort
+---
+apiVersion: listeners.stackable.tech/v1alpha1
+kind: ListenerClass
+metadata:
+  name: test-external-unstable-$NAMESPACE
+spec:
+  serviceType: NodePort