fix: add internal tls helper

Author: maltesander

rust/operator-binary/src/controller/build/properties/config_properties.rs

@@ -132,8 +132,8 @@ pub fn build(
 
     // TLS gating — mirrors the existing compute_files logic, including the
     // authentication-requires-TLS check.
-    let server_tls_enabled = cluster.cluster_config.tls.server.is_some();
-    let internal_tls_enabled = cluster.cluster_config.tls.internal.is_some();
+    let server_tls_enabled = cluster.server_tls_enabled();
+    let internal_tls_enabled = cluster.internal_tls_enabled();
     if cluster.cluster_config.authentication_enabled() && !server_tls_enabled {
         return Err(Error::AuthenticationRequiresTls);
     }

rust/operator-binary/src/controller/mod.rs

@@ -172,6 +172,11 @@ impl ValidatedCluster {
         self.cluster_config.tls.server.is_some()
     }
 
+    /// Whether internal (inter-node) TLS is enabled.
+    pub fn internal_tls_enabled(&self) -> bool {
+        self.cluster_config.tls.internal.is_some()
+    }
+
     /// The user-provided server TLS SecretClass, if any.
     ///
     /// Mirrors [`v1alpha1::TrinoCluster::get_server_tls`] but reads from the validated config so