chore: Rename annotation

Author: Techassi

rust/operator-binary/src/backend/auto_tls/mod.rs

@@ -27,7 +27,7 @@ use time::OffsetDateTime;
 
 use crate::{
     backend::{
-        ScopeAddressesError, SecretBackend, SecretBackendError, SecretContents,
+        ProvisionParts, ScopeAddressesError, SecretBackend, SecretBackendError, SecretContents,
         SecretVolumeSelector,
         pod_info::{Address, PodInfo},
         scope::SecretScope,
@@ -267,7 +267,6 @@ impl SecretBackend for TlsGenerate {
         // Extract and convert consumer input from the Volume annotations.
         let cert_lifetime = selector.autotls_cert_lifetime;
         let cert_restart_buffer = selector.autotls_cert_restart_buffer;
-        let provision_cert = !selector.only_provision_identity;
 
         // We need to check that the cert lifetime it is not longer than allowed,
         // by capping it to the maximum configured at the SecretClass.
@@ -325,7 +324,7 @@ impl SecretBackend for TlsGenerate {
         // Only run leaf certificate generation if it was requested based on the
         // secret volume selector. Otherwise only a ca.crt file as a PEM envelope
         // will be available (to be mounted).
-        let tls_secret_data = if provision_cert {
+        let tls_secret_data = if selector.provision_parts == ProvisionParts::PublicPrivate {
             let conf = Conf::new(ConfMethod::default())
                 .expect("failed to initialize OpenSSL configuration");
 

rust/operator-binary/src/backend/kerberos_keytab.rs

@@ -22,6 +22,7 @@ use super::{
     scope::SecretScope,
 };
 use crate::{
+    backend::ProvisionParts,
     crd::{self, KerberosPrincipal, v1alpha2},
     format::{SecretData, WellKnownSecretData, well_known},
     utils::Unloggable,
@@ -167,8 +168,6 @@ impl SecretBackend for KerberosKeytab {
             admin_principal,
         } = self;
 
-        let provision_keytab = !selector.only_provision_identity;
-
         let admin_server_clause = match admin {
             v1alpha2::KerberosKeytabBackendAdmin::Mit(v1alpha2::KerberosKeytabBackendMit {
                 kadmin_server,
@@ -211,7 +210,7 @@ cluster.local = {realm_name}
         }
 
         let keytab_data =
-            if provision_keytab {
+            if selector.provision_parts == ProvisionParts::PublicPrivate {
                 let admin_keytab_file_path = tmp.path().join("admin-keytab");
                 {
                     let mut admin_keytab_file = File::create(&admin_keytab_file_path)

rust/operator-binary/src/backend/mod.rs

@@ -140,19 +140,18 @@ pub struct SecretVolumeSelector {
     pub cert_manager_cert_lifetime: Option<Duration>,
 
     // TODO (@Techassi): Name to be decided. Will potentially be renamed.
-    /// Only provision non-sensitive secret data.
+    /// Configure to either only provision public data or public + private data.
+    ///
+    /// The following pieces of data are considered public/non-senstive:
     ///
     /// - TLS (PEM): Only provision the `ca.crt` file
     /// - TLS (PKCS#12): Only provision the `truststore.p12` file
     /// - Kerberos: Only provision the `krb5.conf` file
     ///
-    /// This defaults to `false` to be backwords compatible with behaviour before SDP 26.3.0.
-    #[serde(
-        rename = "secrets.stackable.tech/only-provision-identity",
-        deserialize_with = "SecretVolumeSelector::deserialize_str_as_bool",
-        default
-    )]
-    pub only_provision_identity: bool,
+    /// This defaults to [`ProvisionParts::PublicPrivate`] to be backwords compatible with behaviour
+    /// before SDP 26.3.0.
+    #[serde(rename = "secrets.stackable.tech/provision-parts", default)]
+    pub provision_parts: ProvisionParts,
 }
 
 /// Configuration provided by the [`TrustStore`] selecting what trust data should be provided.
@@ -161,6 +160,19 @@ pub struct TrustSelector {
     pub namespace: String,
 }
 
+/// Contains options available for the `secrets.stackable.tech/provision-parts` annotation.
+#[derive(Debug, Default, PartialEq, Eq, Deserialize, strum::Display)]
+#[strum(serialize_all = "kebab-case")]
+#[serde(rename_all = "kebab-case")]
+pub enum ProvisionParts {
+    /// Provision only public (non-senstive) data.
+    Public,
+
+    /// Provision both public and private data.
+    #[default]
+    PublicPrivate,
+}
+
 /// Internal parameters of [`SecretVolumeSelector`] managed by secret-operator itself.
 // These are optional even if they are set unconditionally, because otherwise we will
 // fail to restore volumes (after Node reboots etc) from before they were added during upgrades.
@@ -285,16 +297,6 @@ impl SecretVolumeSelector {
             )
         })
     }
-
-    fn deserialize_str_as_bool<'de, D: Deserializer<'de>>(de: D) -> Result<bool, D::Error> {
-        let str = String::deserialize(de)?;
-        str.parse().map_err(|_| {
-            <D::Error as serde::de::Error>::invalid_value(
-                Unexpected::Str(&str),
-                &"a string containing a boolean",
-            )
-        })
-    }
 }
 
 #[derive(Debug)]

rust/operator-binary/src/csi_server/node.rs

@@ -220,7 +220,7 @@ impl SecretProvisionerNode {
         selector: SecretVolumeSelector,
     ) -> Result<(), PublishError> {
         let SecretVolumeSelector {
-            only_provision_identity: relaxed,
+            provision_parts,
             format,
             compat,
             names,
@@ -240,7 +240,7 @@ impl SecretProvisionerNode {
 
         for (k, v) in data
             .data
-            .into_files(format, names, compat, relaxed)
+            .into_files(format, names, compat, provision_parts)
             .context(publish_error::FormatDataSnafu)?
         {
             // The following few lines of code do some basic checks against

rust/operator-binary/src/format/mod.rs

@@ -7,7 +7,7 @@ pub use self::{
     convert::ConvertError,
     well_known::{FromFilesError as ParseError, SecretFormat, WellKnownSecretData},
 };
-use crate::format::well_known::NamingOptions;
+use crate::{backend::ProvisionParts, format::well_known::NamingOptions};
 
 mod convert;
 pub mod well_known;
@@ -20,10 +20,10 @@ pub enum SecretData {
     Unknown(SecretFiles),
 }
 impl SecretData {
-    pub fn parse(self, relaxed: bool) -> Result<WellKnownSecretData, ParseError> {
+    pub fn parse(self, provision_parts: ProvisionParts) -> Result<WellKnownSecretData, ParseError> {
         match self {
             Self::WellKnown(data) => Ok(data),
-            Self::Unknown(files) => WellKnownSecretData::from_files(files, relaxed),
+            Self::Unknown(files) => WellKnownSecretData::from_files(files, provision_parts),
         }
     }
 
@@ -32,17 +32,17 @@ impl SecretData {
         format: Option<SecretFormat>,
         names: NamingOptions,
         compat: CompatibilityOptions,
-        relaxed: bool,
+        provision_parts: ProvisionParts,
     ) -> Result<SecretFiles, IntoFilesError> {
         let files = if let Some(format) = format {
             tracing::debug!(
                 ?format,
                 ?names,
-                relaxed,
+                %provision_parts,
                 "Explicit format requested: parsing and converting to transform into files"
             );
 
-            self.parse(relaxed)?
+            self.parse(provision_parts)?
                 .convert_to(format, compat)?
                 .into_files(names)
         } else {

rust/operator-binary/src/format/well_known.rs

@@ -4,7 +4,7 @@ use stackable_operator::schemars::{self, JsonSchema};
 use strum::EnumDiscriminants;
 
 use super::{ConvertError, SecretFiles, convert};
-use crate::utils::ResultExt;
+use crate::{backend::ProvisionParts, utils::ResultExt};
 
 const FILE_PEM_CERT_CERT: &str = "tls.crt";
 const FILE_PEM_CERT_KEY: &str = "tls.key";
@@ -84,9 +84,16 @@ impl WellKnownSecretData {
 
     pub fn from_files(
         mut files: SecretFiles,
-        relaxed: bool,
+        provision_parts: ProvisionParts,
     ) -> Result<WellKnownSecretData, FromFilesError> {
-        tracing::debug!(relaxed, "Constructing well-known secret data from files");
+        tracing::debug!(
+            %provision_parts,
+            "Constructing well-known secret data from files"
+        );
+
+        // Apply the relaxed file loading/parsing if the user only requested to provision the public
+        // parts.
+        let relaxed = provision_parts == ProvisionParts::Public;
 
         let mut take_file = |format, file| {
             files

rust/operator-binary/src/truststore_controller.rs

@@ -27,7 +27,7 @@ use strum::{EnumDiscriminants, IntoStaticStr};
 
 use crate::{
     OPERATOR_NAME,
-    backend::{self, SecretBackendError, TrustSelector},
+    backend::{self, ProvisionParts, SecretBackendError, TrustSelector},
     crd::{v1alpha1, v1alpha2},
     format::{
         self,
@@ -287,7 +287,7 @@ async fn reconcile(
             truststore.spec.format,
             NamingOptions::default(),
             CompatibilityOptions::default(),
-            false,
+            ProvisionParts::PublicPrivate,
         )
         .context(FormatDataSnafu {
             secret_class: secret_class_ref,