Support specifying Service type (#350)

# Description

For stackabletech/issues#360

Author: sbernauer

CHANGELOG.md

@@ -10,6 +10,11 @@
 
 ### Changed
 
+- [BREAKING]: Support specifying Service type by moving `serviceType` (which was an experimental feature) to `clusterConfig.listenerClass`.
+  This enables us to later switch non-breaking to using `ListenerClasses` for the exposure of Services.
+  This change is breaking, because - for security reasons - we default to the `cluster-internal` `ListenerClass`.
+  If you need your cluster to be accessible from outside of Kubernetes you need to set `clusterConfig.listenerClass`
+  to `external-unstable` or `external-stable` ([#350]).
 - `operator-rs` `0.31.0` -> `0.35.0` ([#322], [#326]).
 - Bumped stackable image versions to "23.4.0-rc2" ([#322], [#326]).
 - Fragmented `SupersetConfig` ([#323]).
@@ -21,6 +26,7 @@
 [#337]: https://github.com/stackabletech/superset-operator/pull/337
 [#344]: https://github.com/stackabletech/superset-operator/pull/344
 [#348]: https://github.com/stackabletech/superset-operator/pull/348
+[#350]: https://github.com/stackabletech/superset-operator/pull/350
 
 ## [23.1.0] - 2023-01-23
 

deploy/helm/superset-operator/crds/crds.yaml

@@ -47,6 +47,27 @@ spec:
                       description: This role will be given in addition to any AUTH_ROLES_MAPPING. Gets mapped to `AUTH_USER_REGISTRATION_ROLE`
                       type: string
                   type: object
+                clusterConfig:
+                  default:
+                    listenerClass: cluster-internal
+                  description: Superset cluster configuration options.
+                  properties:
+                    listenerClass:
+                      default: cluster-internal
+                      description: |-
+                        In the future this setting will control, which ListenerClass <https://docs.stackable.tech/home/stable/listener-operator/listenerclass.html> will be used to expose the service. Currently only a subset of the ListenerClasses are supported by choosing the type of the created Services by looking at the ListenerClass name specified, In a future release support for custom ListenerClasses will be introduced without a breaking change:
+
+                        * cluster-internal: Use a ClusterIP service
+
+                        * external-unstable: Use a NodePort service
+
+                        * external-stable: Use a LoadBalancer service
+                      enum:
+                        - cluster-internal
+                        - external-unstable
+                        - external-stable
+                      type: string
+                  type: object
                 clusterOperation:
                   default:
                     stopped: false
@@ -1482,13 +1503,6 @@ spec:
                   required:
                     - roleGroups
                   type: object
-                serviceType:
-                  description: Specify the type of the created kubernetes service. This attribute will be removed in a future release when listener-operator is finished. Use with caution.
-                  enum:
-                    - NodePort
-                    - ClusterIP
-                  nullable: true
-                  type: string
                 stopped:
                   description: Emergency stop button, if `true` then all pods are stopped without affecting configuration (as setting `replicas` to `0` would)
                   nullable: true

rust/crd/src/lib.rs

@@ -146,6 +146,9 @@ pub struct SupersetClusterSpec {
     pub stopped: Option<bool>,
     /// The Superset image to use
     pub image: ProductImage,
+    /// Superset cluster configuration options.
+    #[serde(default)]
+    pub cluster_config: SupersetClusterConfig,
     /// Name of the Vector aggregator discovery ConfigMap.
     /// It must contain the key `ADDRESS` with the address of the Vector aggregator.
     #[serde(skip_serializing_if = "Option::is_none")]
@@ -160,27 +163,49 @@ pub struct SupersetClusterSpec {
     pub nodes: Option<Role<SupersetConfigFragment>>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub database_initialization: Option<supersetdb::SupersetDbConfigFragment>,
-    /// Specify the type of the created kubernetes service.
-    /// This attribute will be removed in a future release when listener-operator is finished.
-    /// Use with caution.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub service_type: Option<ServiceType>,
     /// Cluster operations like pause reconciliation or cluster stop.
     #[serde(default)]
     pub cluster_operation: ClusterOperation,
 }
 
+#[derive(Clone, Debug, Default, Eq, Deserialize, JsonSchema, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SupersetClusterConfig {
+    /// In the future this setting will control, which ListenerClass <https://docs.stackable.tech/home/stable/listener-operator/listenerclass.html>
+    /// will be used to expose the service.
+    /// Currently only a subset of the ListenerClasses are supported by choosing the type of the created Services
+    /// by looking at the ListenerClass name specified,
+    /// In a future release support for custom ListenerClasses will be introduced without a breaking change:
+    ///
+    /// * cluster-internal: Use a ClusterIP service
+    ///
+    /// * external-unstable: Use a NodePort service
+    ///
+    /// * external-stable: Use a LoadBalancer service
+    #[serde(default)]
+    pub listener_class: CurrentlySupportedListenerClasses,
+}
+
 // TODO: Temporary solution until listener-operator is finished
-#[derive(Clone, Debug, Display, Deserialize, Eq, JsonSchema, PartialEq, Serialize)]
+#[derive(Clone, Debug, Default, Display, Deserialize, Eq, JsonSchema, PartialEq, Serialize)]
 #[serde(rename_all = "PascalCase")]
-pub enum ServiceType {
-    NodePort,
-    ClusterIP,
+pub enum CurrentlySupportedListenerClasses {
+    #[default]
+    #[serde(rename = "cluster-internal")]
+    ClusterInternal,
+    #[serde(rename = "external-unstable")]
+    ExternalUnstable,
+    #[serde(rename = "external-stable")]
+    ExternalStable,
 }
 
-impl Default for ServiceType {
-    fn default() -> Self {
-        Self::NodePort
+impl CurrentlySupportedListenerClasses {
+    pub fn k8s_service_type(&self) -> String {
+        match self {
+            CurrentlySupportedListenerClasses::ClusterInternal => "ClusterIP".to_string(),
+            CurrentlySupportedListenerClasses::ExternalUnstable => "NodePort".to_string(),
+            CurrentlySupportedListenerClasses::ExternalStable => "LoadBalancer".to_string(),
+        }
     }
 }
 

rust/operator-binary/src/superset_controller.rs

@@ -379,21 +379,20 @@ fn build_node_role_service(
             ))
             .build(),
         spec: Some(ServiceSpec {
+            type_: Some(
+                superset
+                    .spec
+                    .cluster_config
+                    .listener_class
+                    .k8s_service_type(),
+            ),
             ports: Some(vec![ServicePort {
                 name: Some("superset".to_string()),
                 port: APP_PORT.into(),
                 protocol: Some("TCP".to_string()),
                 ..ServicePort::default()
             }]),
             selector: Some(role_selector_labels(superset, APP_NAME, &role_name)),
-            type_: Some(
-                superset
-                    .spec
-                    .service_type
-                    .clone()
-                    .unwrap_or_default()
-                    .to_string(),
-            ),
             ..ServiceSpec::default()
         }),
         status: None,
@@ -499,6 +498,8 @@ fn build_node_rolegroup_service(
             .with_label("prometheus.io/scrape", "true")
             .build(),
         spec: Some(ServiceSpec {
+            // Internal communication does not need to be exposed
+            type_: Some("ClusterIP".to_string()),
             cluster_ip: Some("None".to_string()),
             ports: Some(vec![
                 ServicePort {