Cleanups.

Author: razvan

CHANGELOG.md

@@ -4,12 +4,17 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+### Added
+
+- Add `spec.clusterConfig.openLineage` to emit [OpenLineage](https://openlineage.io/) lineage events ([#914]).
+
 ### Changed
 
 - Internal operator refactoring: introduce a build() step in the reconciler that
   assembles all relevant Kubernetes resources before anything is applied ([#909]).
 
 [#909]: https://github.com/stackabletech/trino-operator/pull/909
+[#914]: https://github.com/stackabletech/trino-operator/pull/914
 
 ## [26.7.0] - 2026-07-21
 
@@ -22,13 +27,6 @@ All notable changes to this project will be documented in this file.
   Previously, users had to use the `generic` connector ([#883]).
 - Added support for Trino 481 ([#900]).
 - Add a new `.spec.name.inferred.replaceHyphensWithUnderscores` field on TrinoCatalog, which allows tweaking the catalog name in Trino ([#903]).
-- Add `spec.clusterConfig.openLineage` to emit [OpenLineage](https://openlineage.io/) lineage events:
-  the operator configures the Trino OpenLineage event listener on the coordinator (an
-  `event-listener.properties` pointing at the backend `host`/`port`, with the cluster's `trino.uri`
-  and namespace). The backend connection is inlined or references an `OpenLineageConnection`
-  resource. TLS server verification against a `secretClass` CA is imported into the coordinator
-  truststore, and a bearer token from the connection's `credentialsSecretName` Secret is injected at
-  startup without landing in the ConfigMap ([#914]).
 
 ### Changed
 
@@ -64,7 +62,6 @@ All notable changes to this project will be documented in this file.
 [#900]: https://github.com/stackabletech/trino-operator/pull/900
 [#903]: https://github.com/stackabletech/trino-operator/pull/903
 [#908]: https://github.com/stackabletech/trino-operator/pull/908
-[#914]: https://github.com/stackabletech/trino-operator/pull/914
 
 ## [26.3.0] - 2026-03-16
 

Cargo.nix

@@ -894,11 +894,7 @@ spec:
                   openLineage:
                     description: |-
                       Emit [OpenLineage](https://openlineage.io/) lineage events for the queries run on this
-                      Trino cluster. The OpenLineage event listener runs on the coordinator only.
-                      The backend connection is either inlined or references an `OpenLineageConnection` resource.
-                      The shared `appName` field sets the OpenLineage job name format
-                      (`openlineage-event-listener.job.name-format`); when unset Trino defaults to `$QUERY_ID`.
-                      See the [OpenLineage usage guide](https://docs.stackable.tech/home/nightly/trino/usage-guide/openlineage).
+                      Trino cluster.
                     nullable: true
                     properties:
                       appName:
@@ -4428,102 +4424,3 @@ spec:
     served: true
     storage: true
     subresources: {}
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: openlineageconnections.openlineage.stackable.tech
-spec:
-  group: openlineage.stackable.tech
-  names:
-    categories: []
-    kind: OpenLineageConnection
-    plural: openlineageconnections
-    shortNames: []
-    singular: openlineageconnection
-  scope: Namespaced
-  versions:
-  - additionalPrinterColumns: []
-    name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        description: A reusable definition of a connection to an OpenLineage backend.
-        properties:
-          spec:
-            description: |-
-              OpenLineage connection definition as a resource.
-              Learn more about [OpenLineage](https://openlineage.io/).
-            properties:
-              credentialsSecretName:
-                description: |-
-                  Name of a Secret containing the API key used to authenticate against the OpenLineage
-                  backend. The API key must be stored under the key `apiKey`. The Secret must be located in
-                  the same namespace as the workload using this connection. If not specified, no
-                  authentication is used.
-                nullable: true
-                type: string
-              host:
-                description: 'Host of the OpenLineage backend without any protocol or port. For example: `marquez`.'
-                type: string
-              port:
-                description: 'Port the OpenLineage backend listens on. For example: `5000`.'
-                format: uint16
-                maximum: 65535.0
-                minimum: 0.0
-                type: integer
-              tls:
-                description: Use a TLS connection. If not specified no TLS will be used.
-                nullable: true
-                properties:
-                  verification:
-                    description: The verification method used to verify the certificates of the server and/or the client.
-                    oneOf:
-                    - required:
-                      - none
-                    - required:
-                      - server
-                    properties:
-                      none:
-                        description: Use TLS but don't verify certificates.
-                        type: object
-                      server:
-                        description: Use TLS and a CA certificate to verify the server.
-                        properties:
-                          caCert:
-                            description: CA cert to verify the server.
-                            oneOf:
-                            - required:
-                              - webPki
-                            - required:
-                              - secretClass
-                            properties:
-                              secretClass:
-                                description: |-
-                                  Name of the [SecretClass](https://docs.stackable.tech/home/nightly/secret-operator/secretclass) which will provide the CA certificate.
-                                  Note that a SecretClass does not need to have a key but can also work with just a CA certificate,
-                                  so if you got provided with a CA cert but don't have access to the key you can still use this method.
-                                type: string
-                              webPki:
-                                description: |-
-                                  Use TLS and the CA certificates trusted by the common web browsers to verify the server.
-                                  This can be useful when you e.g. use public AWS S3 or other public available services.
-                                type: object
-                            type: object
-                        required:
-                        - caCert
-                        type: object
-                    type: object
-                required:
-                - verification
-                type: object
-            required:
-            - host
-            - port
-            type: object
-        required:
-        - spec
-        title: OpenLineageConnection
-        type: object
-    served: true
-    storage: true
-    subresources: {}

crate-hashes.json

@@ -1,5 +1,5 @@
 pub mod client_protocol;
 pub mod fault_tolerant_execution;
 pub mod jvm;
-pub mod open_lineage;
+pub mod openlineage;
 pub mod s3;

extra/crds.yaml

@@ -266,7 +266,7 @@ pub fn build(
 mod tests {
     use super::*;
     use crate::{
-        config::open_lineage::ResolvedOpenLineageConfig,
+        config::openlineage::ResolvedOpenLineageConfig,
         controller::build::properties::test_support::{
             MINIMAL_TRINO_YAML, empty_derefs, file_auth_class, validated_cluster_from_yaml,
             validated_cluster_from_yaml_with_auth, validated_cluster_from_yaml_with_derefs,

rust/operator-binary/src/config/mod.rs

@@ -2,7 +2,7 @@
 //!
 //! The OpenLineage event listener runs on the **coordinator only**, so this builder returns an
 //! empty map for every other role and the caller omits the file from those ConfigMaps. For the
-//! coordinator it emits the connection-derived settings resolved in [`crate::config::open_lineage`],
+//! coordinator it emits the connection-derived settings resolved in [`crate::config::openlineage`],
 //! adds the cluster-facing `trino.uri`, and finally merges any user `event-listener.properties`
 //! overrides (highest precedence).
 
@@ -11,7 +11,7 @@ use std::collections::BTreeMap;
 use stackable_operator::utils::cluster_info::KubernetesClusterInfo;
 
 use crate::{
-    config::open_lineage::OPENLINEAGE_TRINO_URI_KEY,
+    config::openlineage::OPENLINEAGE_TRINO_URI_KEY,
     controller::{TrinoRoleGroupConfig, ValidatedCluster},
     crd::{
         TrinoRole,
@@ -70,7 +70,7 @@ mod tests {
 
     use super::*;
     use crate::{
-        config::open_lineage::{
+        config::openlineage::{
             EVENT_LISTENER_NAME_KEY, OPENLINEAGE_NAMESPACE_KEY, OPENLINEAGE_TRANSPORT_API_KEY_KEY,
             OPENLINEAGE_TRANSPORT_TYPE_KEY, OPENLINEAGE_TRANSPORT_URL_KEY,
             ResolvedOpenLineageConfig,
@@ -88,7 +88,7 @@ mod tests {
         }
     }
 
-    /// A resolved OpenLineage config as `config::open_lineage` would produce it for an inline
+    /// A resolved OpenLineage config as `config::openlineage` would produce it for an inline
     /// `http://marquez:5000` connection, optionally with a bearer-token api-key reference.
     fn resolved_open_lineage(with_auth: bool) -> ResolvedOpenLineageConfig {
         let mut properties = BTreeMap::from([

…erator-binary/src/config/open_lineage.rs …perator-binary/src/config/openlineage.rsrust/operator-binary/src/config/open_lineage.rs renamed to rust/operator-binary/src/config/openlineage.rs rust/operator-binary/src/config/open_lineage.rs renamed to rust/operator-binary/src/config/openlineage.rs

@@ -172,7 +172,7 @@ pub fn build_rolegroup_config_map(
         );
     }
 
-    // 8. jvm.config. The role + role-group `jvmArgumentOverrides` were already merged in the
+    // 9. jvm.config. The role + role-group `jvmArgumentOverrides` were already merged in the
     // validate step and are carried by `product_specific_common_config`.
     let jvm_config = jvm::jvm_config(
         cluster.product_version,
@@ -182,7 +182,7 @@ pub fn build_rolegroup_config_map(
     .context(BuildJvmConfigSnafu)?;
     data.insert(JVM_CONFIG.to_string(), jvm_config);
 
-    // 9. Vector agent config (`vector.yaml`) if the Vector agent is enabled. The file is templated
+    // 10. Vector agent config (`vector.yaml`) if the Vector agent is enabled. The file is templated
     // with environment variables injected by the Vector container at runtime.
     if rg.config.logging.enable_vector_agent {
         data.insert(

rust/operator-binary/src/controller/build/properties/config_properties.rs

@@ -18,7 +18,7 @@ use crate::{
     config::{
         client_protocol::{self, ResolvedClientProtocolConfig},
         fault_tolerant_execution::{self, ResolvedFaultTolerantExecutionConfig},
-        open_lineage::{self, ResolvedOpenLineageConfig},
+        openlineage::{self, ResolvedOpenLineageConfig},
     },
     crd::{
         authentication::{ResolvedAuthenticationClassRef, resolve_authentication_classes},
@@ -68,7 +68,7 @@ pub enum Error {
     ClientProtocolConfiguration { source: client_protocol::Error },
 
     #[snafu(display("failed to resolve OpenLineage configuration"))]
-    OpenLineageConfiguration { source: open_lineage::Error },
+    OpenLineageConfiguration { source: openlineage::Error },
 
     #[snafu(display("invalid OpaConfig"))]
     InvalidOpaConfig {