chore: Improve comments and unit tests

Author: siegfriedweber

rust/operator-binary/src/controller/build.rs

@@ -93,7 +93,7 @@ mod tests {
             role_utils::GenericProductSpecificCommonConfig,
             types::{
                 common::Port,
-                kubernetes::{Hostname, ListenerClassName, NamespaceName},
+                kubernetes::{Hostname, ListenerClassName, NamespaceName, SecretClassName},
                 operator::{
                     ClusterName, ControllerName, OperatorName, ProductName, ProductVersion,
                     RoleGroupName,
@@ -137,7 +137,8 @@ mod tests {
                 "my-opensearch",
                 "my-opensearch-nodes-cluster-manager",
                 "my-opensearch-nodes-coordinating",
-                "my-opensearch-nodes-data"
+                "my-opensearch-nodes-data",
+                "my-opensearch-security-config"
             ],
             extract_resource_names(&resources.config_maps)
         );
@@ -212,7 +213,11 @@ mod tests {
                 ),
             ]
             .into(),
-            ValidatedSecurity::Disabled,
+            ValidatedSecurity::ManagedByApi {
+                settings: v1alpha1::SecuritySettings::default(),
+                tls_server_secret_class: None,
+                tls_internal_secret_class: SecretClassName::from_str_unsafe("tls"),
+            },
             vec![],
             Some(ValidatedDiscoveryEndpoint {
                 hostname: Hostname::from_str_unsafe("1.2.3.4"),

rust/operator-binary/src/controller/build/role_group_builder.rs

@@ -715,6 +715,9 @@ impl<'a> RoleGroupBuilder<'a> {
         };
 
         if let RoleGroupSecurityMode::Initializing { settings, .. } = &self.security_mode {
+            // Mount the security configuration files using `subPath`, because the configuration
+            // files are only used for initializing the security index and hot-reloading is not
+            // required.
             volume_mounts.extend(self.security_config_volume_mounts(settings, true));
         };
 
@@ -778,6 +781,13 @@ impl<'a> RoleGroupBuilder<'a> {
 
     /// Builds the security settings volume mounts for the [`v1alpha1::Container::OpenSearch`]
     /// container or the [`v1alpha1::Container::UpdateSecurityConfig`] container
+    ///
+    /// If `use_sub_path` is set to `true`, then the configuration files are directly mounted via
+    /// `subPath` into the opensearch-security configuration directory. If it is set to `false`,
+    /// then they are mounted into sub directories of the opensearch-security configuration
+    /// directory without using `subPath`. Files mounted via `subPath` are not updated on changes
+    /// in the ConfigMap or Secret volume. Therefore, hot-reloading works only without `subPath`,
+    /// but links from the configuration directory into the sub directories are required.
     fn security_config_volume_mounts(
         &self,
         settings: &v1alpha1::SecuritySettings,
@@ -882,6 +892,9 @@ impl<'a> RoleGroupBuilder<'a> {
                 ..VolumeMount::default()
             },
         ];
+
+        // Mount the security configuration files without using `subPath`, so that hot-reloading
+        // works.
         volume_mounts.extend(self.security_config_volume_mounts(settings, false));
 
         let mut env_vars = EnvVarSet::new()

rust/operator-binary/src/controller/build/scripts/update-security-config.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 #
-# Expected environment variables:
+# Required environment variables:
 # - OPENSEARCH_PATH_CONF
 # - POD_NAME
 # - MANAGE_ACTIONGROUPS
@@ -13,8 +13,6 @@
 # - MANAGE_ROLESMAPPING
 # - MANAGE_TENANTS
 
-# TODO config_files vs. configuration_files
-
 set -u -o pipefail
 
 VECTOR_CONTROL_DIR=/stackable/log/_vector
@@ -80,6 +78,7 @@ function config_file () {
     echo "$SECURITY_CONFIG_DIR/${CONFIG_FILENAME[$filetype]}"
 }
 
+# Create link for every configuration file in SECURITY_CONFIG_DIR
 function symlink_config_files () {
     for filetype in "${CONFIG_FILETYPES[@]}"
     do
@@ -89,14 +88,13 @@ function symlink_config_files () {
     done
 }
 
-function initialize_managed_configuration_filetypes () {
+function initialize_managed_config_filetypes () {
     for filetype in "${CONFIG_FILETYPES[@]}"
     do
         envvar="MANAGE_${filetype^^}"
         if test "${!envvar}" = "true"
         then
             info "Watch managed configuration type \"$filetype\"."
-
             managed_filetypes+=("$filetype")
         else
             info "Skip unmanaged configuration type \"$filetype\"."
@@ -250,7 +248,7 @@ mkdir --parents "$VECTOR_CONTROL_DIR"
 
 check_pod
 symlink_config_files
-initialize_managed_configuration_filetypes
+initialize_managed_config_filetypes
 
 while true
 do

rust/operator-binary/src/framework/builder/meta.rs

@@ -137,7 +137,7 @@ mod tests {
 
     #[test]
     fn test_annotation_ignore_restarter() {
-        // Test that the functions do not panic
+        // Test that the function does not panic
         annotation_ignore_restarter();
     }
 }