changelog, rename resource name functions, role parsing test

Author: adwk67

CHANGELOG.md

@@ -9,8 +9,11 @@ All notable changes to this project will be documented in this file.
 - Internal operator refactoring: introduce a build() step in the reconciler that
   assembles all relevant Kubernetes resources before anything is applied ([#909]).
 - Bump `stackable-operator` to 0.114.0 ([#918]).
+- The RBAC ServiceAccount and RoleBinding are now built with the operator-rs `v2::rbac`
+  functions and carry the full set of recommended labels ([#913]).
 
 [#909]: https://github.com/stackabletech/trino-operator/pull/909
+[#913]: https://github.com/stackabletech/trino-operator/pull/913
 [#918]: https://github.com/stackabletech/trino-operator/pull/918
 
 ## [26.7.0] - 2026-07-21

rust/operator-binary/src/controller/build/resource/config_map.rs

@@ -74,7 +74,7 @@ pub fn build_rolegroup_config_map(
         })?;
 
     let config_map_name = cluster
-        .resource_names(role, role_group_name)
+        .role_group_resource_names(role, role_group_name)
         .role_group_config_map()
         .to_string();
 

rust/operator-binary/src/controller/build/resource/rbac.rs

@@ -20,7 +20,7 @@ stackable_operator::constant!(NONE_ROLE_GROUP_NAME: RoleGroupName = "none");
 pub fn build_service_account(cluster: &ValidatedCluster) -> ServiceAccount {
     rbac::build_service_account(
         cluster,
-        &cluster.rbac_resource_names(),
+        &cluster.cluster_resource_names(),
         rbac_labels(cluster),
     )
 }
@@ -30,7 +30,7 @@ pub fn build_service_account(cluster: &ValidatedCluster) -> ServiceAccount {
 pub fn build_role_binding(cluster: &ValidatedCluster) -> RoleBinding {
     rbac::build_role_binding(
         cluster,
-        &cluster.rbac_resource_names(),
+        &cluster.cluster_resource_names(),
         rbac_labels(cluster),
     )
 }

rust/operator-binary/src/controller/build/resource/service.rs

@@ -25,7 +25,7 @@ pub fn build_rolegroup_headless_service(
         metadata: cluster
             .object_meta(
                 cluster
-                    .resource_names(role, role_group_name)
+                    .role_group_resource_names(role, role_group_name)
                     .headless_service_name()
                     .to_string(),
                 recommended_labels.clone(),
@@ -56,7 +56,7 @@ pub fn build_rolegroup_metrics_service(
         metadata: cluster
             .object_meta(
                 cluster
-                    .resource_names(role, role_group_name)
+                    .role_group_resource_names(role, role_group_name)
                     .metrics_service_name()
                     .to_string(),
                 recommended_labels.clone(),

rust/operator-binary/src/controller/build/resource/statefulset.rs

@@ -149,7 +149,7 @@ pub fn build_rolegroup_statefulset(
     let env_overrides = &role_group_config.env_overrides;
     let merged_config = &role_group_config.config;
 
-    let resource_names = cluster.resource_names(trino_role, role_group_name);
+    let resource_names = cluster.role_group_resource_names(trino_role, role_group_name);
     let config_map_name = resource_names.role_group_config_map().to_string();
 
     let mut pod_builder = PodBuilder::new();
@@ -423,7 +423,7 @@ pub fn build_rolegroup_statefulset(
         .context(AddVolumeSnafu)?
         .service_account_name(
             cluster
-                .rbac_resource_names()
+                .cluster_resource_names()
                 .service_account_name()
                 .to_string(),
         )

rust/operator-binary/src/controller/mod.rs

@@ -234,15 +234,15 @@ impl ValidatedCluster {
 
     /// Type-safe names for the per-cluster RBAC resources: the ServiceAccount shared by all
     /// Pods, its (namespaced) RoleBinding, and the operator-deployed ClusterRole it binds.
-    pub fn rbac_resource_names(&self) -> role_utils::ResourceNames {
+    pub fn cluster_resource_names(&self) -> role_utils::ResourceNames {
         role_utils::ResourceNames {
             cluster_name: self.name.clone(),
             product_name: product_name(),
         }
     }
 
     /// Type-safe names for the resources of a given role group.
-    pub(crate) fn resource_names(
+    pub(crate) fn role_group_resource_names(
         &self,
         role: &TrinoRole,
         role_group_name: &RoleGroupName,
@@ -263,7 +263,7 @@ impl ValidatedCluster {
     ) -> String {
         format!(
             "{}-catalog",
-            self.resource_names(role, role_group_name)
+            self.role_group_resource_names(role, role_group_name)
                 .role_group_config_map()
         )
     }
@@ -465,3 +465,20 @@ pub(crate) fn validated_cluster() -> ValidatedCluster {
 
     validate::validate(&minimal_trino(), &derefs, &operator_env).expect("validate should succeed")
 }
+
+#[cfg(test)]
+mod tests {
+    use strum::IntoEnumIterator;
+
+    use super::ValidatedCluster;
+    use crate::crd::TrinoRole;
+
+    /// Locks the invariant behind the `expect` in [`ValidatedCluster::role_name`]: every
+    /// `TrinoRole` variant (present and future) must serialise to a valid `RoleName`.
+    #[test]
+    fn every_trino_role_serialises_to_a_valid_role_name() {
+        for role in TrinoRole::iter() {
+            ValidatedCluster::role_name(&role);
+        }
+    }
+}