Do not use overrides to determine if TLS is enabled

Author: siegfriedweber

rust/operator-binary/src/controller.rs

@@ -281,6 +281,14 @@ impl ValidatedCluster {
             .filter(|c| c.1.config.node_roles.contains(node_role))
             .collect()
     }
+
+    /// Whether security is enabled and a server TLS class is defined or not.
+    pub fn is_server_tls_enabled(&self) -> bool {
+        self.security
+            .as_ref()
+            .and_then(|security| security.tls.server_secret_class.as_ref())
+            .is_some()
+    }
 }
 
 impl HasName for ValidatedCluster {

rust/operator-binary/src/controller/build/node_config.rs

@@ -1,11 +1,10 @@
 //! Configuration of an OpenSearch node
 
-use std::str::FromStr;
-
 use serde_json::{Value, json};
 use stackable_operator::{
     builder::pod::container::FieldPathEnvVar, commons::networking::DomainName,
 };
+use tracing::warn;
 
 use super::ValidatedCluster;
 use crate::{
@@ -184,7 +183,12 @@ impl NodeConfig {
             .into_iter()
             .flatten()
         {
-            config.insert(setting.to_owned(), json!(value));
+            let old_value = config.insert(setting.to_owned(), json!(value));
+            if let Some(old_value) = old_value {
+                warn!(
+                    "configOverrides: Configuration setting {setting:?} changed from {old_value} to {value:?}."
+                );
+            }
         }
 
         // Ensure a deterministic result
@@ -310,26 +314,6 @@ impl NodeConfig {
         config
     }
 
-    // TODO Obsolete or should configOverrides be the truth?
-    /// Returns `true` if TLS is enabled on the HTTP port
-    pub fn tls_on_http_port_enabled(&self) -> bool {
-        self.opensearch_config()
-            .get(CONFIG_OPTION_PLUGINS_SECURITY_SSL_HTTP_ENABLED)
-            .and_then(Self::value_as_bool)
-            == Some(true)
-    }
-
-    /// Converts the given JSON value to [`bool`] if possible
-    pub fn value_as_bool(value: &Value) -> Option<bool> {
-        value.as_bool().or(
-            // OpenSearch parses the strings "true" and "false" as boolean, see
-            // https://github.com/opensearch-project/OpenSearch/blob/3.4.0/libs/common/src/main/java/org/opensearch/common/Booleans.java#L45-L84
-            value
-                .as_str()
-                .and_then(|value| FromStr::from_str(value).ok()),
-        )
-    }
-
     /// Creates environment variables for the OpenSearch configurations
     ///
     /// The environment variables should only contain node-specific configuration options.

rust/operator-binary/src/controller/build/role_builder.rs

@@ -171,14 +171,7 @@ impl<'a> RoleBuilder<'a> {
 
         let metadata = self.common_metadata(discovery_config_map_name(&self.cluster.name));
 
-        let tls_server_secret_class_defined = self
-            .cluster
-            .security
-            .as_ref()
-            .and_then(|security| security.tls.server_secret_class.as_ref())
-            .is_some();
-
-        let protocol = if tls_server_secret_class_defined {
+        let protocol = if self.cluster.is_server_tls_enabled() {
             "https"
         } else {
             "http"

rust/operator-binary/src/controller/build/role_group_builder.rs

@@ -948,7 +948,7 @@ cp --archive config/opensearch.keystore {OPENSEARCH_INITIALIZED_KEYSTORE_DIRECTO
             .common_metadata(self.resource_names.headless_service_name())
             .with_labels(Self::prometheus_labels())
             .with_annotations(Self::prometheus_annotations(
-                self.node_config.tls_on_http_port_enabled(),
+                self.cluster.is_server_tls_enabled(),
             ))
             .build();