test: improve test helper & add auth tests

Author: maltesander

rust/operator-binary/src/controller/build/properties/config_properties.rs

@@ -250,9 +250,75 @@ pub fn build(
 mod tests {
     use super::*;
     use crate::controller::build::properties::test_support::{
-        MINIMAL_TRINO_YAML, validated_cluster_from_yaml,
+        MINIMAL_TRINO_YAML, file_auth_class, validated_cluster_from_yaml,
+        validated_cluster_from_yaml_with_auth,
     };
 
+    const SERVER_TLS_ONLY_YAML: &str = r#"
+        apiVersion: trino.stackable.tech/v1alpha1
+        kind: TrinoCluster
+        metadata:
+          name: simple-trino
+          namespace: default
+          uid: "e6ac237d-a6d4-43a1-8135-f36506110912"
+        spec:
+          image:
+            productVersion: "479"
+          clusterConfig:
+            catalogLabelSelector: {}
+            tls:
+              internalSecretClass: null
+          coordinators:
+            roleGroups:
+              default:
+                replicas: 1
+          workers:
+            roleGroups:
+              default:
+                replicas: 1
+        "#;
+
+    const INTERNAL_TLS_ONLY_YAML: &str = r#"
+        apiVersion: trino.stackable.tech/v1alpha1
+        kind: TrinoCluster
+        metadata:
+          name: simple-trino
+          namespace: default
+          uid: "e6ac237d-a6d4-43a1-8135-f36506110912"
+        spec:
+          image:
+            productVersion: "479"
+          clusterConfig:
+            catalogLabelSelector: {}
+            tls:
+              serverSecretClass: null
+          coordinators:
+            roleGroups:
+              default:
+                replicas: 1
+          workers:
+            roleGroups:
+              default:
+                replicas: 1
+        "#;
+
+    fn cluster_info() -> stackable_operator::utils::cluster_info::KubernetesClusterInfo {
+        stackable_operator::utils::cluster_info::KubernetesClusterInfo {
+            cluster_domain: stackable_operator::commons::networking::DomainName::try_from(
+                "cluster.local",
+            )
+            .unwrap(),
+        }
+    }
+
+    fn rg(cluster: &ValidatedCluster, role: &TrinoRole) -> TrinoRoleGroupConfig {
+        cluster.role_group_configs[role]
+            .values()
+            .next()
+            .expect("the fixture defines a role group")
+            .clone()
+    }
+
     #[test]
     fn default_renders_includes_coordinator_default_and_query_max_memory_default() {
         let cluster = validated_cluster_from_yaml(MINIMAL_TRINO_YAML);
@@ -280,4 +346,125 @@ mod tests {
             Some("50GB")
         );
     }
+
+    #[test]
+    fn server_tls_only_uses_server_keystore_dir_and_http_discovery() {
+        let cluster = validated_cluster_from_yaml(SERVER_TLS_ONLY_YAML);
+        let props = build(
+            &cluster,
+            TrinoRole::Coordinator,
+            &rg(&cluster, &TrinoRole::Coordinator),
+            &cluster_info(),
+        )
+        .unwrap();
+
+        assert_eq!(
+            props.get("http-server.https.enabled").map(String::as_str),
+            Some("true")
+        );
+        assert_eq!(
+            props.get("http-server.https.port").map(String::as_str),
+            Some("8443")
+        );
+        assert_eq!(
+            props
+                .get("http-server.https.keystore.path")
+                .map(String::as_str),
+            Some("/stackable/server_tls/keystore.p12"),
+        );
+        // Server TLS is on, so insecure HTTP access must not be allowed.
+        assert_eq!(
+            props.get("http-server.authentication.allow-insecure-over-http"),
+            None
+        );
+        // Internal TLS is off: no internal-communication keystore or FQDN address source.
+        assert_eq!(
+            props.get("internal-communication.https.keystore.path"),
+            None
+        );
+        assert_eq!(props.get("node.internal-address-source"), None);
+        // Discovery uses http when internal TLS is disabled.
+        assert!(props.get("discovery.uri").unwrap().starts_with("http://"));
+    }
+
+    #[test]
+    fn internal_tls_only_allows_insecure_http_and_uses_internal_keystore_dir() {
+        let cluster = validated_cluster_from_yaml(INTERNAL_TLS_ONLY_YAML);
+        let props = build(
+            &cluster,
+            TrinoRole::Coordinator,
+            &rg(&cluster, &TrinoRole::Coordinator),
+            &cluster_info(),
+        )
+        .unwrap();
+
+        assert_eq!(
+            props.get("http-server.https.enabled").map(String::as_str),
+            Some("true")
+        );
+        assert_eq!(
+            props
+                .get("http-server.authentication.allow-insecure-over-http")
+                .map(String::as_str),
+            Some("true"),
+        );
+        assert_eq!(
+            props.get("http-server.http.port").map(String::as_str),
+            Some("8080")
+        );
+        assert_eq!(
+            props
+                .get("http-server.https.keystore.path")
+                .map(String::as_str),
+            Some("/stackable/internal_tls/keystore.p12"),
+        );
+        // Internal TLS block is present.
+        assert_eq!(
+            props
+                .get("internal-communication.https.keystore.path")
+                .map(String::as_str),
+            Some("/stackable/internal_tls/keystore.p12"),
+        );
+        assert_eq!(
+            props
+                .get("node.internal-address-source")
+                .map(String::as_str),
+            Some("FQDN")
+        );
+        // Discovery uses https when internal TLS is enabled.
+        assert!(props.get("discovery.uri").unwrap().starts_with("https://"));
+    }
+
+    #[test]
+    fn worker_omits_include_coordinator() {
+        let cluster = validated_cluster_from_yaml(MINIMAL_TRINO_YAML);
+        let props = build(
+            &cluster,
+            TrinoRole::Worker,
+            &rg(&cluster, &TrinoRole::Worker),
+            &cluster_info(),
+        )
+        .unwrap();
+
+        assert_eq!(props.get("coordinator").map(String::as_str), Some("false"));
+        assert_eq!(props.get("node-scheduler.include-coordinator"), None);
+    }
+
+    #[test]
+    fn authentication_without_server_tls_errors() {
+        // Server TLS off (only internal) plus an enabled authenticator must be rejected.
+        let cluster = validated_cluster_from_yaml_with_auth(
+            INTERNAL_TLS_ONLY_YAML,
+            vec![file_auth_class("file-auth")],
+        );
+        let err = build(
+            &cluster,
+            TrinoRole::Coordinator,
+            &rg(&cluster, &TrinoRole::Coordinator),
+            &cluster_info(),
+        )
+        .unwrap_err();
+
+        assert!(matches!(err, Error::AuthenticationRequiresTls));
+    }
 }

rust/operator-binary/src/controller/build/properties/mod.rs

@@ -39,13 +39,22 @@ pub(crate) mod test_support {
 
     use crate::{
         controller::{ValidatedCluster, dereference::DereferencedObjects},
-        crd::v1alpha1,
+        crd::{authentication::ResolvedAuthenticationClassRef, v1alpha1},
     };
 
     pub fn validated_cluster_from_yaml(yaml: &str) -> ValidatedCluster {
+        validated_cluster_from_yaml_with_auth(yaml, Vec::new())
+    }
+
+    /// Like [`validated_cluster_from_yaml`], but injects already-resolved AuthenticationClasses so
+    /// tests can exercise authentication-dependent branches.
+    pub fn validated_cluster_from_yaml_with_auth(
+        yaml: &str,
+        resolved_authentication_classes: Vec<ResolvedAuthenticationClassRef>,
+    ) -> ValidatedCluster {
         let trino: v1alpha1::TrinoCluster = serde_yaml::from_str(yaml).expect("invalid test YAML");
         let derefs = DereferencedObjects {
-            resolved_authentication_classes: Vec::new(),
+            resolved_authentication_classes,
             catalog_definitions: Vec::new(),
             catalogs: Vec::new(),
             trino_opa_config: None,
@@ -58,7 +67,32 @@ pub(crate) mod test_support {
             image_repository: "oci.example.org".to_string(),
         };
         crate::controller::validate::validate(&trino, &derefs, &operator_env)
-            .expect("validate should succeed for the minimal fixture")
+            .expect("validate should succeed for the test fixture")
+    }
+
+    /// A resolved `static` (file) AuthenticationClass, enough to make
+    /// [`ValidatedClusterConfig::authentication_enabled`](crate::controller::ValidatedClusterConfig)
+    /// return `true`.
+    pub fn file_auth_class(name: &str) -> ResolvedAuthenticationClassRef {
+        let yaml = format!(
+            r#"
+            metadata:
+              name: {name}
+            spec:
+              provider:
+                static:
+                  userCredentialsSecret:
+                    name: {name}
+            "#
+        );
+        let deserializer = serde_yaml::Deserializer::from_str(&yaml);
+        let authentication_class =
+            serde_yaml::with::singleton_map_recursive::deserialize(deserializer)
+                .expect("invalid test AuthenticationClass");
+        ResolvedAuthenticationClassRef {
+            authentication_class,
+            client_auth_options: None,
+        }
     }
 
     pub const MINIMAL_TRINO_YAML: &str = r#"