add optional authentication class reference

Author: razvan

crates/stackable-operator/crds/OpenLineageConnection.yaml

@@ -24,6 +24,15 @@ spec:
               OpenLineage connection definition as a resource.
               Learn more about [OpenLineage](https://openlineage.io/).
             properties:
+              authenticationClassRef:
+                description: |-
+                  Name of an [`AuthenticationClass`](https://docs.stackable.tech/home/nightly/concepts/authentication) used
+                  to authenticate against the OpenLineage backend. The `AuthenticationClass` is cluster-scoped
+                  and referenced by name; it is resolved at runtime via
+                  [`OpenLineageConnectionSpec::resolve_authentication_class`]. If not specified, no
+                  authentication is used.
+                nullable: true
+                type: string
               host:
                 description: 'Host of the OpenLineage backend without any protocol or port. For example: `marquez`.'
                 type: string

crates/stackable-operator/src/crd/openlineage/mod.rs

@@ -46,6 +46,14 @@ pub mod versioned {
         /// When TLS server verification is configured, the transport uses `https` instead of `http`.
         #[serde(flatten)]
         pub tls: TlsClientDetails,
+
+        /// Name of an [`AuthenticationClass`](DOCS_BASE_URL_PLACEHOLDER/concepts/authentication) used
+        /// to authenticate against the OpenLineage backend. The `AuthenticationClass` is cluster-scoped
+        /// and referenced by name; it is resolved at runtime via
+        /// [`OpenLineageConnectionSpec::resolve_authentication_class`]. If not specified, no
+        /// authentication is used.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        pub authentication_class_ref: Option<String>,
     }
 
     /// An OpenLineage connection, either inlined or referenced by the name of an
@@ -98,6 +106,9 @@ impl stackable_versioned::test_utils::RoundtripTestData for v1alpha1::OpenLineag
                   server:
                     caCert:
                       secretClass: openlineage-cert
+            - host: marquez
+              port: 5000
+              authenticationClassRef: openlineage-auth
         "})
         .expect("Failed to parse OpenLineageConnectionSpec YAML")
     }
@@ -118,6 +129,7 @@ mod tests {
             host: "marquez".to_string(),
             port: 5000,
             tls: TlsClientDetails { tls: None },
+            authentication_class_ref: None,
         };
 
         assert_eq!(connection.transport_url(), "http://marquez:5000");
@@ -135,6 +147,7 @@ mod tests {
                     }),
                 }),
             },
+            authentication_class_ref: None,
         };
 
         assert_eq!(connection.transport_url(), "https://marquez:5000");
@@ -150,6 +163,7 @@ mod tests {
                     verification: TlsVerification::None {},
                 }),
             },
+            authentication_class_ref: None,
         };
 
         assert_eq!(connection.transport_url(), "http://marquez:5000");

crates/stackable-operator/src/crd/openlineage/v1alpha1_impl.rs

@@ -2,9 +2,14 @@ use snafu::{ResultExt as _, Snafu};
 
 use crate::{
     client::Client,
-    crd::openlineage::{
-        ResolvedOpenLineageConnection,
-        v1alpha1::{InlineConnectionOrReference, OpenLineageConnection, OpenLineageConnectionSpec},
+    crd::{
+        authentication::core::v1alpha1::AuthenticationClass,
+        openlineage::{
+            ResolvedOpenLineageConnection,
+            v1alpha1::{
+                InlineConnectionOrReference, OpenLineageConnection, OpenLineageConnectionSpec,
+            },
+        },
     },
 };
 
@@ -16,6 +21,13 @@ pub enum OpenLineageError {
         source: Box<crate::client::Error>,
         open_lineage_connection: String,
     },
+
+    #[snafu(display("failed to retrieve AuthenticationClass '{authentication_class}'"))]
+    RetrieveAuthenticationClass {
+        #[snafu(source(from(crate::client::Error, Box::new)))]
+        source: Box<crate::client::Error>,
+        authentication_class: String,
+    },
 }
 
 impl OpenLineageConnectionSpec {
@@ -36,6 +48,27 @@ impl OpenLineageConnectionSpec {
             port = self.port
         )
     }
+
+    /// Resolves the [`AuthenticationClass`] referenced by this connection, if any.
+    ///
+    /// Returns `Ok(None)` when no `authenticationClassRef` is configured. The `AuthenticationClass`
+    /// is cluster-scoped, so no namespace is required.
+    pub async fn resolve_authentication_class(
+        &self,
+        client: &Client,
+    ) -> Result<Option<AuthenticationClass>, OpenLineageError> {
+        let Some(authentication_class_ref) = &self.authentication_class_ref else {
+            return Ok(None);
+        };
+
+        let resolved = AuthenticationClass::resolve(client, authentication_class_ref)
+            .await
+            .context(RetrieveAuthenticationClassSnafu {
+                authentication_class: authentication_class_ref.clone(),
+            })?;
+
+        Ok(Some(resolved))
+    }
 }
 
 impl InlineConnectionOrReference {