fix spool secret length

Author: razvan

rust/operator-binary/src/controller.rs

@@ -527,14 +527,18 @@ pub async fn reconcile_trino(
     create_random_secret(
         &shared_internal_secret_name(trino),
         ENV_INTERNAL_SECRET,
+        512,
         trino,
         client,
     )
     .await?;
 
+    // This secret is created even if spooling is not configured.
+    // Trino currently requires the secret to be exactly 256 bits long.
     create_random_secret(
         &shared_spooling_secret_name(trino),
         ENV_SPOOLING_SECRET,
+        32,
         trino,
         client,
     )
@@ -796,6 +800,16 @@ fn build_rolegroup_config_map(
                     );
                 }
 
+                // Add spooling properties from resolved configuration
+                if let Some(resolved_spooling) = resolved_spooling_config {
+                    dynamic_resolved_config.extend(
+                        resolved_spooling
+                            .config_properties
+                            .iter()
+                            .map(|(k, v)| (k.clone(), Some(v.clone()))),
+                    );
+                }
+
                 // Add static properties and overrides
                 dynamic_resolved_config.extend(transformed_config);
 
@@ -1027,8 +1041,19 @@ fn build_rolegroup_statefulset(
     // additional authentication env vars
     let mut env = trino_authentication_config.env_vars(trino_role, &Container::Trino);
 
-    let secret_name = shared_internal_secret_name(trino);
-    env.push(env_var_from_secret(&secret_name, None, ENV_INTERNAL_SECRET));
+    let internal_secret_name = shared_internal_secret_name(trino);
+    env.push(env_var_from_secret(
+        &internal_secret_name,
+        None,
+        ENV_INTERNAL_SECRET,
+    ));
+
+    let spooling_secret_name = shared_spooling_secret_name(trino);
+    env.push(env_var_from_secret(
+        &spooling_secret_name,
+        None,
+        ENV_SPOOLING_SECRET,
+    ));
 
     trino_authentication_config
         .add_authentication_pod_and_volume_config(
@@ -1466,11 +1491,12 @@ fn build_recommended_labels<'a>(
 async fn create_random_secret(
     secret_name: &str,
     secret_key: &str,
+    secret_byte_size: usize,
     trino: &v1alpha1::TrinoCluster,
     client: &Client,
 ) -> Result<()> {
     let mut internal_secret = BTreeMap::new();
-    internal_secret.insert(secret_key.to_string(), get_random_base64());
+    internal_secret.insert(secret_key.to_string(), get_random_base64(secret_byte_size));
 
     let secret = Secret {
         immutable: Some(true),
@@ -1513,8 +1539,8 @@ fn shared_spooling_secret_name(trino: &v1alpha1::TrinoCluster) -> String {
     format!("{}-spooling-secret", trino.name_any())
 }
 
-fn get_random_base64() -> String {
-    let mut buf = [0; 512];
+fn get_random_base64(byte_size: usize) -> String {
+    let mut buf: Vec<u8> = vec![0; byte_size];
     openssl::rand::rand_bytes(&mut buf).unwrap();
     openssl::base64::encode_block(&buf)
 }

rust/operator-binary/src/crd/client_protocol.rs

@@ -84,6 +84,9 @@ pub struct S3SpoolingConfig {
 }
 
 pub struct ResolvedSpoolingProtocolConfig {
+    /// Properties to add to config.properties
+    pub config_properties: BTreeMap<String, String>,
+
     // Properties for spooling-manager.properties
     pub spooling_manager_properties: BTreeMap<String, String>,
 
@@ -110,22 +113,9 @@ impl ResolvedSpoolingProtocolConfig {
         client: Option<&Client>,
         namespace: &str,
     ) -> Result<Self, Error> {
-        let mut spooling_manager_properties = BTreeMap::new();
-
-        spooling_manager_properties.insert(
-            "protocol.spooling.enabled".to_string(),
-            config.enabled.to_string(),
-        );
-
-        spooling_manager_properties.insert(
-            "protocol.spooling.shared-secret-key".to_string(),
-            format!("${{ENV:{secret}}}", secret = ENV_SPOOLING_SECRET),
-        );
-
-        spooling_manager_properties.insert("fs.location".to_string(), config.location.clone());
-
         let mut resolved_config = Self {
-            spooling_manager_properties,
+            config_properties: BTreeMap::new(),
+            spooling_manager_properties: BTreeMap::new(),
             volumes: Vec::new(),
             volume_mounts: Vec::new(),
             load_env_from_files: BTreeMap::new(),
@@ -144,6 +134,26 @@ impl ResolvedSpoolingProtocolConfig {
             }
         }
 
+        resolved_config.spooling_manager_properties.extend([
+            ("fs.location".to_string(), config.location.clone()),
+            (
+                "spooling-manager.name".to_string(),
+                "filesystem".to_string(),
+            ),
+        ]);
+
+        // Enable spooling protocol
+        resolved_config.config_properties.extend([
+            (
+                "protocol.spooling.enabled".to_string(),
+                config.enabled.to_string(),
+            ),
+            (
+                "protocol.spooling.shared-secret-key".to_string(),
+                format!("${{ENV:{secret}}}", secret = ENV_SPOOLING_SECRET),
+            ),
+        ]);
+
         // Finally, extend the spooling manager properties with any user configuration
         if let Some(user_config) = config.config_overrides.as_ref() {
             resolved_config
@@ -284,17 +294,15 @@ mod tests {
         .unwrap();
 
         let expected_props = BTreeMap::from([
-            ("protocol.spooling.enabled".to_string(), "true".to_string()),
-            (
-                "protocol.spooling.shared-secret-key".to_string(),
-                format!("${{ENV:{}}}", ENV_SPOOLING_SECRET),
-            ),
             (
                 "fs.location".to_string(),
                 "s3://my-bucket/spooling".to_string(),
             ),
+            (
+                "spooling-manager.name".to_string(),
+                "filesystem".to_string(),
+            ),
         ]);
-
         assert_eq!(
             expected_props,
             resolved_spooling_config.spooling_manager_properties
@@ -330,11 +338,6 @@ mod tests {
         .unwrap();
 
         let expected_props = BTreeMap::from([
-            ("protocol.spooling.enabled".to_string(), "true".to_string()),
-            (
-                "protocol.spooling.shared-secret-key".to_string(),
-                format!("${{ENV:{}}}", ENV_SPOOLING_SECRET),
-            ),
             (
                 "fs.location".to_string(),
                 "s3://my-bucket/spooling".to_string(),
@@ -343,6 +346,10 @@ mod tests {
                 "protocol.spooling.retrieval-mode".to_string(),
                 "STORAGE".to_string(),
             ),
+            (
+                "spooling-manager.name".to_string(),
+                "filesystem".to_string(),
+            ),
         ]);
 
         assert_eq!(