feat!: Add mandatory provison_parts argument to SecretOperatorVolumeSourceBuilder::new

Author: sbernauer

crates/stackable-operator/src/builder/pod/volume.rs

@@ -281,17 +281,29 @@ pub struct SecretOperatorVolumeSourceBuilder {
     kerberos_service_names: Vec<String>,
     tls_pkcs12_password: Option<String>,
     auto_tls_cert_lifetime: Option<Duration>,
+    provision_parts: SecretOperatorVolumeProvisionParts,
 }
 
 impl SecretOperatorVolumeSourceBuilder {
-    pub fn new(secret_class: impl Into<String>) -> Self {
+    /// Creates a builder for a secret-operator volume that uses the specified SecretClass to
+    /// request the specified [`SecretOperatorVolumeProvisionParts`].
+    ///
+    /// This function forces the caller to make an explicit choice if the public parts are
+    /// sufficient or if private (e.g. a certificate for the Pod) parts are needed as well.
+    /// This is done to avoid accidentally requesting too much parts. For details see
+    /// [this issue](https://github.com/stackabletech/issues/issues/547).
+    pub fn new(
+        secret_class: impl Into<String>,
+        provision_parts: SecretOperatorVolumeProvisionParts,
+    ) -> Self {
         Self {
             secret_class: secret_class.into(),
             scopes: Vec::new(),
             format: None,
             kerberos_service_names: Vec::new(),
             tls_pkcs12_password: None,
             auto_tls_cert_lifetime: None,
+            provision_parts,
         }
     }
 
@@ -342,6 +354,10 @@ impl SecretOperatorVolumeSourceBuilder {
 
         annotations
             .insert(Annotation::secret_class(&self.secret_class).context(ParseAnnotationSnafu)?);
+        annotations.insert(
+            Annotation::secret_provision_parts(&self.provision_parts)
+                .context(ParseAnnotationSnafu)?,
+        );
 
         if !self.scopes.is_empty() {
             annotations
@@ -417,6 +433,20 @@ pub enum SecretOperatorVolumeScope {
     ListenerVolume { name: String },
 }
 
+/// What parts secret-operator should provision into the requested volume.
+#[derive(Clone, Debug, PartialEq, Eq, strum::AsRefStr)]
+#[strum(serialize_all = "kebab-case")]
+pub enum SecretOperatorVolumeProvisionParts {
+    /// Only provision public parts, such as the CA certificate (either as PEM or truststore) or
+    /// `krb5.conf`.
+    Public,
+
+    /// Provision all parts, which includes all [`Public`](SecretOperatorVolumeProvisionParts::Public)
+    /// ones as well as additional private parts, such as a TLS cert + private key, a keystore or a
+    /// keytab.
+    Full,
+}
+
 /// Reference to a listener class or listener name
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub enum ListenerReference {

crates/stackable-operator/src/commons/secret_class.rs

@@ -4,7 +4,8 @@ use serde::{Deserialize, Serialize};
 use snafu::{ResultExt, Snafu};
 
 use crate::builder::pod::volume::{
-    SecretOperatorVolumeSourceBuilder, SecretOperatorVolumeSourceBuilderError, VolumeBuilder,
+    SecretOperatorVolumeProvisionParts, SecretOperatorVolumeSourceBuilder,
+    SecretOperatorVolumeSourceBuilderError, VolumeBuilder,
 };
 
 #[derive(Debug, PartialEq, Snafu)]
@@ -38,9 +39,10 @@ impl SecretClassVolume {
 
     pub fn to_ephemeral_volume_source(
         &self,
+        provision_parts: SecretOperatorVolumeProvisionParts,
     ) -> Result<EphemeralVolumeSource, SecretClassVolumeError> {
         let mut secret_operator_volume_builder =
-            SecretOperatorVolumeSourceBuilder::new(&self.secret_class);
+            SecretOperatorVolumeSourceBuilder::new(&self.secret_class, provision_parts);
 
         if let Some(scope) = &self.scope {
             if scope.pod {
@@ -62,8 +64,12 @@ impl SecretClassVolume {
             .context(SecretOperatorVolumeSnafu)
     }
 
-    pub fn to_volume(&self, volume_name: &str) -> Result<Volume, SecretClassVolumeError> {
-        let ephemeral = self.to_ephemeral_volume_source()?;
+    pub fn to_volume(
+        &self,
+        volume_name: &str,
+        provision_parts: SecretOperatorVolumeProvisionParts,
+    ) -> Result<Volume, SecretClassVolumeError> {
+        let ephemeral = self.to_ephemeral_volume_source(provision_parts)?;
         Ok(VolumeBuilder::new(volume_name).ephemeral(ephemeral).build())
     }
 }
@@ -111,7 +117,8 @@ mod tests {
                 listener_volumes: vec!["mylistener".to_string()],
             }),
         }
-        .to_ephemeral_volume_source()
+        // Let's assume we need some form of private data (e.g. a certificate or S3 credentials)
+        .to_ephemeral_volume_source(SecretOperatorVolumeProvisionParts::Full)
         .unwrap();
 
         let expected_volume_attributes = BTreeMap::from([
@@ -123,6 +130,10 @@ mod tests {
                 "secrets.stackable.tech/scope".to_string(),
                 "pod,service=myservice,listener-volume=mylistener".to_string(),
             ),
+            (
+                "secrets.stackable.tech/provision-parts".to_string(),
+                "full".to_string(),
+            ),
         ]);
 
         assert_eq!(

crates/stackable-operator/src/commons/tls_verification.rs

@@ -6,7 +6,11 @@ use snafu::{ResultExt, Snafu};
 use crate::{
     builder::{
         self,
-        pod::{PodBuilder, container::ContainerBuilder, volume::VolumeMountBuilder},
+        pod::{
+            PodBuilder,
+            container::ContainerBuilder,
+            volume::{SecretOperatorVolumeProvisionParts, VolumeMountBuilder},
+        },
     },
     commons::secret_class::{SecretClassVolume, SecretClassVolumeError},
     constants::secret::SECRET_BASE_PATH,
@@ -72,7 +76,8 @@ impl TlsClientDetails {
             let volume_name = format!("{secret_class}-ca-cert");
             let secret_class_volume = SecretClassVolume::new(secret_class.clone(), None);
             let volume = secret_class_volume
-                .to_volume(&volume_name)
+                // We only need the public CA cert
+                .to_volume(&volume_name, SecretOperatorVolumeProvisionParts::Public)
                 .context(SecretClassVolumeSnafu)?;
 
             volumes.push(volume);

crates/stackable-operator/src/crd/authentication/ldap/v1alpha1_impl.rs

@@ -5,7 +5,11 @@ use url::Url;
 use crate::{
     builder::{
         self,
-        pod::{PodBuilder, container::ContainerBuilder, volume::VolumeMountBuilder},
+        pod::{
+            PodBuilder,
+            container::ContainerBuilder,
+            volume::{SecretOperatorVolumeProvisionParts, VolumeMountBuilder},
+        },
     },
     commons::{secret_class::SecretClassVolumeError, tls_verification::TlsClientDetailsError},
     constants::secret::SECRET_BASE_PATH,
@@ -94,7 +98,8 @@ impl AuthenticationProvider {
             let secret_class = &bind_credentials.secret_class;
             let volume_name = format!("{secret_class}-bind-credentials");
             let volume = bind_credentials
-                .to_volume(&volume_name)
+                // We need the private LDAP bind credentials
+                .to_volume(&volume_name, SecretOperatorVolumeProvisionParts::Full)
                 .context(BindCredentialsSnafu)?;
 
             volumes.push(volume);
@@ -234,7 +239,10 @@ mod tests {
                     secret_class: "ldap-ca-cert".to_string(),
                     scope: None,
                 }
-                .to_volume("ldap-ca-cert-ca-cert")
+                .to_volume(
+                    "ldap-ca-cert-ca-cert",
+                    SecretOperatorVolumeProvisionParts::Public
+                )
                 .unwrap()
             ]
         );
@@ -263,13 +271,19 @@ mod tests {
                     secret_class: "openldap-bind-credentials".to_string(),
                     scope: None,
                 }
-                .to_volume("openldap-bind-credentials-bind-credentials")
+                .to_volume(
+                    "openldap-bind-credentials-bind-credentials",
+                    SecretOperatorVolumeProvisionParts::Full
+                )
                 .unwrap(),
                 SecretClassVolume {
                     secret_class: "ldap-ca-cert".to_string(),
                     scope: None,
                 }
-                .to_volume("ldap-ca-cert-ca-cert")
+                .to_volume(
+                    "ldap-ca-cert-ca-cert",
+                    SecretOperatorVolumeProvisionParts::Public
+                )
                 .unwrap()
             ]
         );

crates/stackable-operator/src/crd/s3/connection/mod.rs

@@ -174,10 +174,16 @@ mod tests {
                 .unwrap()
                 .annotations
                 .unwrap(),
-            &BTreeMap::from([(
-                "secrets.stackable.tech/class".to_string(),
-                "ionos-s3-credentials".to_string()
-            )]),
+            &BTreeMap::from([
+                (
+                    "secrets.stackable.tech/class".to_string(),
+                    "ionos-s3-credentials".to_string()
+                ),
+                (
+                    "secrets.stackable.tech/provision-parts".to_string(),
+                    "full".to_string()
+                )
+            ]),
         );
 
         assert_eq!(mount.name, volume.name);

crates/stackable-operator/src/crd/s3/connection/v1alpha1_impl.rs

@@ -3,7 +3,11 @@ use snafu::{ResultExt as _, Snafu};
 use url::Url;
 
 use crate::{
-    builder::pod::{PodBuilder, container::ContainerBuilder, volume::VolumeMountBuilder},
+    builder::pod::{
+        PodBuilder,
+        container::ContainerBuilder,
+        volume::{SecretOperatorVolumeProvisionParts, VolumeMountBuilder},
+    },
     client::Client,
     commons::{secret_class::SecretClassVolumeError, tls_verification::TlsClientDetailsError},
     constants::secret::SECRET_BASE_PATH,
@@ -110,7 +114,8 @@ impl ConnectionSpec {
 
             volumes.push(
                 credentials
-                    .to_volume(&volume_name)
+                    // We need the private S3 credentials
+                    .to_volume(&volume_name, SecretOperatorVolumeProvisionParts::Full)
                     .context(AddS3CredentialVolumesSnafu)?,
             );
             mounts.push(

crates/stackable-operator/src/kvp/annotation/mod.rs

@@ -18,7 +18,7 @@ use std::{
 use delegate::delegate;
 
 use crate::{
-    builder::pod::volume::SecretOperatorVolumeScope,
+    builder::pod::volume::{SecretOperatorVolumeProvisionParts, SecretOperatorVolumeScope},
     iter::TryFromIterator,
     kvp::{Key, KeyValuePair, KeyValuePairError, KeyValuePairs, KeyValuePairsError},
 };
@@ -80,6 +80,15 @@ impl Annotation {
         self.0
     }
 
+    /// Constructs a `secrets.stackable.tech/provision-parts` annotation.
+    pub fn secret_provision_parts(
+        provision_parts: &SecretOperatorVolumeProvisionParts,
+    ) -> Result<Self, AnnotationError> {
+        let kvp =
+            KeyValuePair::try_from(("secrets.stackable.tech/provision-parts", provision_parts))?;
+        Ok(Self(kvp))
+    }
+
     /// Constructs a `secrets.stackable.tech/class` annotation.
     pub fn secret_class(secret_class: &str) -> Result<Self, AnnotationError> {
         let kvp = KeyValuePair::try_from(("secrets.stackable.tech/class", secret_class))?;