refactor(openlineage): use credentialsSecretName instead of AuthenticationClass

Follows the operator-rs change: read the OpenLineage backend bearer token from
the connection's `credentialsSecretName` Secret (key `apiKey`) instead of
resolving a Static AuthenticationClass.

See stackabletech/decisions#90

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: razvan

CHANGELOG.md

@@ -16,8 +16,8 @@ All notable changes to this project will be documented in this file.
   `event-listener.properties` pointing at the backend `host`/`port`, with the cluster's `trino.uri`
   and namespace). The backend connection is inlined or references an `OpenLineageConnection`
   resource. TLS server verification against a `secretClass` CA is imported into the coordinator
-  truststore, and a bearer token from a Static `AuthenticationClass` is injected at startup without
-  landing in the ConfigMap ([#914]).
+  truststore, and a bearer token from the connection's `credentialsSecretName` Secret is injected at
+  startup without landing in the ConfigMap ([#914]).
 
 ### Changed
 

Cargo.lock

@@ -71,7 +71,7 @@ IMPORTANT: With TLS server verification, the `host` must match a Subject Alterna
 == Authentication
 
 Backends that require authentication (for example DataHub, or a Marquez instance behind a gateway) expect a bearer token on each request.
-Configure this by referencing an xref:concepts:authentication.adoc[`AuthenticationClass`] from the connection via `authenticationClassRef`:
+Configure this by setting `credentialsSecretName` on the connection to the name of a Secret holding the token:
 
 [source,yaml]
 ----
@@ -86,32 +86,20 @@ spec:
         inline:
           host: marquez
           port: 5000
-          authenticationClassRef: openlineage-auth # <1>
+          credentialsSecretName: openlineage-token # <1>
   ...
 ---
-apiVersion: authentication.stackable.tech/v1alpha1
-kind: AuthenticationClass
-metadata:
-  name: openlineage-auth
-spec:
-  provider:
-    static: # <2>
-      userCredentialsSecret:
-        name: openlineage-token # <3>
----
 apiVersion: v1
 kind: Secret
 metadata:
   name: openlineage-token
-  namespace: default # <4>
+  namespace: default # <2>
 stringData:
-  apiKey: "s3cr3t-bearer-token" # <5>
+  apiKey: "s3cr3t-bearer-token" # <3>
 ----
-<1> References an `AuthenticationClass` by name (cluster-scoped). If omitted, no authentication is used.
-<2> Only the `static` provider is supported for OpenLineage. Other providers (LDAP, OIDC, TLS) are rejected with an error.
-<3> Name of the Secret holding the token. Must exist in the same namespace as the `TrinoCluster`.
-<4> The Secret must be in the cluster's namespace so it can be projected into the coordinator.
-<5> The token must be stored under the fixed key `apiKey`. The token is mounted as a file into the coordinator and resolved into the event listener configuration at startup, so it never appears in the ConfigMap or the pod's environment.
+<1> Name of the Secret holding the token. If omitted, no authentication is used. The Secret must exist in the same namespace as the `TrinoCluster`.
+<2> The Secret must be in the cluster's namespace so it can be projected into the coordinator.
+<3> The token must be stored under the fixed key `apiKey`. The token is mounted as a file into the coordinator and resolved into the event listener configuration at startup, so it never appears in the ConfigMap or the pod's environment.
 
 The operator translates this into the OpenLineage HTTP transport's `api-key` (bearer) authentication.
 Combine it with the `tls` block above when the backend also needs TLS server verification.

Cargo.nix

@@ -922,12 +922,11 @@ spec:
                               OpenLineage connection definition as a resource.
                               Learn more about [OpenLineage](https://openlineage.io/).
                             properties:
-                              authenticationClassRef:
+                              credentialsSecretName:
                                 description: |-
-                                  Name of an [`AuthenticationClass`](https://docs.stackable.tech/home/nightly/concepts/authentication) used
-                                  to authenticate against the OpenLineage backend. The `AuthenticationClass` is cluster-scoped
-                                  and referenced by name; it is resolved at runtime via
-                                  [`OpenLineageConnectionSpec::resolve_authentication_class`]. If not specified, no
+                                  Name of a Secret containing the API key used to authenticate against the OpenLineage
+                                  backend. The API key must be stored under the key `apiKey`. The Secret must be located in
+                                  the same namespace as the workload using this connection. If not specified, no
                                   authentication is used.
                                 nullable: true
                                 type: string
@@ -4455,12 +4454,11 @@ spec:
               OpenLineage connection definition as a resource.
               Learn more about [OpenLineage](https://openlineage.io/).
             properties:
-              authenticationClassRef:
+              credentialsSecretName:
                 description: |-
-                  Name of an [`AuthenticationClass`](https://docs.stackable.tech/home/nightly/concepts/authentication) used
-                  to authenticate against the OpenLineage backend. The `AuthenticationClass` is cluster-scoped
-                  and referenced by name; it is resolved at runtime via
-                  [`OpenLineageConnectionSpec::resolve_authentication_class`]. If not specified, no
+                  Name of a Secret containing the API key used to authenticate against the OpenLineage
+                  backend. The API key must be stored under the key `apiKey`. The Secret must be located in
+                  the same namespace as the workload using this connection. If not specified, no
                   authentication is used.
                 nullable: true
                 type: string

docs/modules/trino/pages/usage-guide/openlineage.adoc

@@ -22,10 +22,7 @@ use stackable_operator::{
     commons::tls_verification::{
         CaCert, TlsClientDetails, TlsClientDetailsError, TlsServerVerification, TlsVerification,
     },
-    crd::{
-        authentication::core::v1alpha1::{AuthenticationClass, AuthenticationClassProvider},
-        openlineage::{self, v1alpha1::OpenLineageJob},
-    },
+    crd::openlineage::{self, v1alpha1::OpenLineageJob},
     k8s_openapi::api::core::v1::{SecretVolumeSource, Volume, VolumeMount},
 };
 
@@ -76,16 +73,6 @@ pub enum Error {
         source: openlineage::v1alpha1::OpenLineageError,
     },
 
-    #[snafu(display("failed to resolve the OpenLineage AuthenticationClass"))]
-    ResolveAuthenticationClass {
-        source: openlineage::v1alpha1::OpenLineageError,
-    },
-
-    #[snafu(display(
-        "unsupported AuthenticationClass provider {provider:?} for OpenLineage; only the Static provider is supported"
-    ))]
-    UnsupportedAuthenticationProvider { provider: String },
-
     #[snafu(display(
         "failed to build volumes and mounts for the OpenLineage backend TLS CA certificate"
     ))]
@@ -172,21 +159,14 @@ impl ResolvedOpenLineageConfig {
         init_container_extra_start_commands
             .extend(openlineage_tls_truststore_commands(&connection.tls));
 
-        // Authentication: resolve the connection's `authenticationClassRef` (Static provider only)
-        // into its credentials Secret, mount it and reference the token via a `${file:...}`
-        // placeholder so it is resolved at startup and never lands in the ConfigMap.
-        if let Some(auth_class) = connection
-            .resolve_authentication_class(client)
-            .await
-            .context(ResolveAuthenticationClassSnafu)?
-        {
-            let secret_name = openlineage_auth_secret_name(&auth_class)
-                .map_err(|provider| UnsupportedAuthenticationProviderSnafu { provider }.build())?;
-
+        // Authentication: when the connection sets `credentialsSecretName`, mount that Secret and
+        // reference the token via a `${file:...}` placeholder so it is resolved at startup and never
+        // lands in the ConfigMap. The token must be stored under the `apiKey` Secret key.
+        if let Some(secret_name) = &connection.credentials_secret_name {
             volumes.push(Volume {
                 name: OPENLINEAGE_AUTH_VOLUME_NAME.to_string(),
                 secret: Some(SecretVolumeSource {
-                    secret_name: Some(secret_name),
+                    secret_name: Some(secret_name.clone()),
                     ..SecretVolumeSource::default()
                 }),
                 ..Volume::default()
@@ -214,22 +194,6 @@ impl ResolvedOpenLineageConfig {
     }
 }
 
-/// Extracts the credentials Secret name from a resolved OpenLineage [`AuthenticationClass`].
-///
-/// Only the `Static` provider is supported (its Secret holds the bearer token under
-/// [`OPENLINEAGE_AUTH_SECRET_KEY`]). Any other provider returns `Err(provider_name)` so the caller
-/// can surface a clear error naming the offending provider.
-pub(crate) fn openlineage_auth_secret_name(
-    auth_class: &AuthenticationClass,
-) -> Result<String, String> {
-    match &auth_class.spec.provider {
-        AuthenticationClassProvider::Static(provider) => {
-            Ok(provider.user_credentials_secret.name.clone())
-        }
-        other => Err(other.to_string()),
-    }
-}
-
 /// Init-container commands that add the backend's `SecretClass` CA certificate to the client
 /// truststore (which is the JVM default truststore, see `config::jvm`). Returns an empty list when
 /// no import is needed: no TLS, `verification.none` (plain `http`), or WebPKI verification (trusted
@@ -248,54 +212,10 @@ fn openlineage_tls_truststore_commands(tls: &TlsClientDetails) -> Vec<String> {
 
 #[cfg(test)]
 mod tests {
-    use stackable_operator::{
-        commons::tls_verification::Tls,
-        crd::authentication::{
-            core::v1alpha1::{
-                AuthenticationClass, AuthenticationClassProvider, AuthenticationClassSpec,
-            },
-            r#static, tls,
-        },
-        k8s_openapi::apimachinery::pkg::apis::meta::v1::ObjectMeta,
-    };
+    use stackable_operator::commons::tls_verification::Tls;
 
     use super::*;
 
-    fn auth_class(provider: AuthenticationClassProvider) -> AuthenticationClass {
-        AuthenticationClass {
-            metadata: ObjectMeta::default(),
-            spec: AuthenticationClassSpec { provider },
-        }
-    }
-
-    #[test]
-    fn secret_name_extracted_from_static_provider() {
-        let ac = auth_class(AuthenticationClassProvider::Static(
-            r#static::v1alpha1::AuthenticationProvider {
-                user_credentials_secret: r#static::v1alpha1::UserCredentialsSecretRef {
-                    name: "ol-token".to_string(),
-                },
-            },
-        ));
-
-        assert_eq!(openlineage_auth_secret_name(&ac).unwrap(), "ol-token");
-    }
-
-    #[test]
-    fn non_static_provider_is_rejected_naming_the_provider() {
-        let ac = auth_class(AuthenticationClassProvider::Tls(
-            tls::v1alpha1::AuthenticationProvider {
-                client_cert_secret_class: None,
-            },
-        ));
-
-        let err = openlineage_auth_secret_name(&ac).unwrap_err();
-        assert!(
-            err.to_lowercase().contains("tls"),
-            "error should name the offending provider, got: {err}"
-        );
-    }
-
     fn tls_details(verification: Option<TlsVerification>) -> TlsClientDetails {
         TlsClientDetails {
             tls: verification.map(|verification| Tls { verification }),