replace fields with enum

Author: adwk67

crates/stackable-operator/crds/DummyCluster.yaml

@@ -76,6 +76,11 @@ spec:
                 description: A validated domain name type conforming to RFC 1123, so e.g. not an IP address
                 type: string
               gitSync:
+                anyOf:
+                - required:
+                  - credentialsSecret
+                - required:
+                  - sshSecret
                 properties:
                   branch:
                     default: main
@@ -91,10 +96,8 @@ spec:
                       The referenced Secret must include two fields: `user` and `password`.
                       The `password` field can either be an actual password (not recommended) or a GitHub token,
                       as described in the git-sync [documentation].
-                      This cannot be provided if `ssh_secret` is also provided.
 
                       [documentation]: https://github.com/kubernetes/git-sync/tree/v4.2.4?tab=readme-ov-file#manual
-                    nullable: true
                     type: string
                   depth:
                     default: 1
@@ -131,10 +134,8 @@ spec:
                       The name of the Secret used for SSH access to the repository.
 
                       The referenced Secret must include two fields: `key` and `knownHosts`.
-                      This cannot be provided if `credentials_secret` is also provided.
 
                       [documentation]: https://github.com/kubernetes/git-sync/tree/v4.2.4?tab=readme-ov-file#manual
-                    nullable: true
                     type: string
                   wait:
                     default: 20s

crates/stackable-operator/src/crd/git_sync/mod.rs

@@ -46,16 +46,6 @@ pub mod versioned {
         #[serde(default = "GitSync::default_wait")]
         pub wait: Duration,
 
-        /// The name of the Secret used to access the repository if it is not public.
-        ///
-        /// The referenced Secret must include two fields: `user` and `password`.
-        /// The `password` field can either be an actual password (not recommended) or a GitHub token,
-        /// as described in the git-sync [documentation].
-        /// This cannot be provided if `ssh_secret` is also provided.
-        ///
-        /// [documentation]: https://github.com/kubernetes/git-sync/tree/v4.2.4?tab=readme-ov-file#manual
-        pub credentials_secret: Option<String>,
-
         /// A map of optional configuration settings that are listed in the git-sync [documentation].
         ///
         /// Also read the git-sync [example] in our documentation. These settings are not verified.
@@ -65,12 +55,36 @@ pub mod versioned {
         #[serde(default)]
         pub git_sync_conf: BTreeMap<String, String>,
 
-        /// The name of the Secret used for SSH access to the repository.
-        ///
-        /// The referenced Secret must include two fields: `key` and `knownHosts`.
-        /// This cannot be provided if `credentials_secret` is also provided.
-        ///
-        /// [documentation]: https://github.com/kubernetes/git-sync/tree/v4.2.4?tab=readme-ov-file#manual
-        pub ssh_secret: Option<String>,
+        #[serde(flatten)]
+        pub access_secret: Option<AccessSecret>,
+    }
+
+    #[derive(strum::Display, Clone, Debug, Deserialize, Eq, JsonSchema, PartialEq, Serialize)]
+    #[serde(untagged)]
+    #[serde(rename_all = "camelCase")]
+    #[schemars(rename_all = "camelCase")]
+    pub enum AccessSecret {
+        Credentials {
+            /// The name of the Secret used to access the repository if it is not public.
+            ///
+            /// The referenced Secret must include two fields: `user` and `password`.
+            /// The `password` field can either be an actual password (not recommended) or a GitHub token,
+            /// as described in the git-sync [documentation].
+            ///
+            /// [documentation]: https://github.com/kubernetes/git-sync/tree/v4.2.4?tab=readme-ov-file#manual
+            #[serde(rename = "credentialsSecret")]
+            #[schemars(rename = "credentialsSecret")]
+            credentials_secret: String,
+        },
+        Ssh {
+            /// The name of the Secret used for SSH access to the repository.
+            ///
+            /// The referenced Secret must include two fields: `key` and `knownHosts`.
+            ///
+            /// [documentation]: https://github.com/kubernetes/git-sync/tree/v4.2.4?tab=readme-ov-file#manual
+            #[serde(rename = "sshSecret")]
+            #[schemars(rename = "sshSecret")]
+            ssh_secret: String,
+        },
     }
 }

crates/stackable-operator/src/crd/git_sync/v1alpha1_impl.rs

@@ -14,7 +14,7 @@ use crate::{
         volume::{VolumeBuilder, VolumeMountBuilder},
     },
     commons::product_image_selection::ResolvedProductImage,
-    crd::git_sync::v1alpha1::GitSync,
+    crd::git_sync::v1alpha1::{AccessSecret, GitSync},
     product_config_utils::insert_or_update_env_vars,
     product_logging::{
         framework::capture_shell_output,
@@ -117,25 +117,22 @@ impl GitSyncResources {
         let mut resources = GitSyncResources::default();
 
         for (i, git_sync) in git_syncs.iter().enumerate() {
-            if git_sync.credentials_secret.is_some() && git_sync.ssh_secret.is_some() {
-                // Gitsync will not allow the declaration of both ssh-key and password/token credentials
-                return Err(Error::MultipleCredentials);
-            }
-
             let mut env_vars = vec![];
-            if let Some(git_credentials_secret) = &git_sync.credentials_secret {
+
+            if let Some(AccessSecret::Credentials { credentials_secret }) = &git_sync.access_secret
+            {
                 env_vars.push(GitSyncResources::env_var_from_secret(
                     "GITSYNC_USERNAME",
-                    git_credentials_secret,
+                    credentials_secret,
                     "user",
                 ));
                 env_vars.push(GitSyncResources::env_var_from_secret(
                     "GITSYNC_PASSWORD",
-                    git_credentials_secret,
+                    credentials_secret,
                     "password",
                 ));
             }
-            if git_sync.ssh_secret.is_some() {
+            if matches!(git_sync.access_secret, Some(AccessSecret::Ssh { .. })) {
                 env_vars.push(EnvVar {
                     name: "GITSYNC_SSH_KEY_FILE".to_owned(),
                     value: Some(format!("{SSH_MOUNT_PATH_PREFIX}-{i}/key").to_owned()),
@@ -170,7 +167,7 @@ impl GitSyncResources {
 
             git_sync_container_volume_mounts.extend_from_slice(extra_volume_mounts);
 
-            if git_sync.ssh_secret.is_some() {
+            if matches!(git_sync.access_secret, Some(AccessSecret::Ssh { .. })) {
                 let ssh_mount_path = format!("{SSH_MOUNT_PATH_PREFIX}-{i}");
                 let ssh_volume_name = format!("{SSH_VOLUME_NAME_PREFIX}-{i}");
 
@@ -225,11 +222,11 @@ impl GitSyncResources {
                 .push(git_content_volume_mount);
             resources.git_content_folders.push(git_content_folder);
 
-            if let Some(get_ssh_secret) = &git_sync.ssh_secret {
+            if let Some(AccessSecret::Ssh { ssh_secret }) = &git_sync.access_secret {
                 let ssh_volume_name = format!("{SSH_VOLUME_NAME_PREFIX}-{i}");
 
                 let ssh_secret_volume = VolumeBuilder::new(&ssh_volume_name)
-                    .with_secret(get_ssh_secret, false)
+                    .with_secret(ssh_secret, false)
                     .build();
                 resources.git_ssh_volumes.push(ssh_secret_volume);
             }