refactor: consolidate authentication build

Author: maltesander

rust/operator-binary/src/authentication/mod.rs

@@ -80,6 +80,9 @@ type Result<T, E = Error> = std::result::Result<T, E>;
 /// may be in parts reused in other operators.
 #[derive(Clone, Debug, Default)]
 pub struct TrinoAuthenticationConfig {
+    /// The enabled `http-server.authentication.type` values, in evaluation order. Empty when no
+    /// authentication is configured.
+    authentication_types: Vec<String>,
     /// All config properties that have to be added to the `config.properties` of the given role
     config_properties: HashMap<TrinoRole, BTreeMap<String, String>>,
     /// All extra config files required for authentication for each role.
@@ -136,6 +139,7 @@ impl TrinoAuthenticationConfig {
                 http_server_authentication_types.join(","),
             );
         }
+        authentication_config.authentication_types = http_server_authentication_types;
 
         trace!(
             "Final Trino authentication config: {:?}",
@@ -145,6 +149,11 @@ impl TrinoAuthenticationConfig {
         Ok(authentication_config)
     }
 
+    /// Whether no authentication is configured.
+    pub fn is_empty(&self) -> bool {
+        self.authentication_types.is_empty()
+    }
+
     /// Automatically add volumes, volume mounts, commands and containers to
     /// the respective pod / container builders.
     pub fn add_authentication_pod_and_volume_config(

rust/operator-binary/src/controller/build/properties/config_properties.rs

@@ -134,7 +134,7 @@ pub fn build(
     // authentication-requires-TLS check.
     let server_tls_enabled = cluster.cluster_config.tls.server.is_some();
     let internal_tls_enabled = cluster.cluster_config.tls.internal.is_some();
-    if cluster.cluster_config.authentication_enabled && !server_tls_enabled {
+    if cluster.cluster_config.authentication_enabled() && !server_tls_enabled {
         return Err(Error::AuthenticationRequiresTls);
     }
     if server_tls_enabled || internal_tls_enabled {

rust/operator-binary/src/controller/mod.rs

@@ -60,14 +60,20 @@ pub struct ValidatedTls {
 pub struct ValidatedClusterConfig {
     pub tls: ValidatedTls,
     pub authentication: TrinoAuthenticationConfig,
-    pub authentication_enabled: bool,
     pub authorization: Option<TrinoOpaConfig>,
     pub fault_tolerant_execution: Option<ResolvedFaultTolerantExecutionConfig>,
     pub client_protocol: Option<ResolvedClientProtocolConfig>,
     pub coordinator_pod_refs: Vec<TrinoPodRef>,
     pub catalogs: Vec<CatalogConfig>,
 }
 
+impl ValidatedClusterConfig {
+    /// Whether any authentication is configured.
+    pub fn authentication_enabled(&self) -> bool {
+        !self.authentication.is_empty()
+    }
+}
+
 /// A validated, merged Trino role-group config.
 ///
 /// Holds the merged [`v1alpha1::TrinoConfig`] fields so the build steps consume this
@@ -184,7 +190,7 @@ impl ValidatedCluster {
 
     /// Whether client TLS should be set, depending on authentication and server TLS settings.
     pub fn tls_enabled(&self) -> bool {
-        self.cluster_config.authentication_enabled || self.server_tls_enabled()
+        self.cluster_config.authentication_enabled() || self.server_tls_enabled()
     }
 
     /// The client-facing port Trino exposes: HTTPS when server TLS is enabled, otherwise HTTP.

rust/operator-binary/src/controller/validate.rs

@@ -266,7 +266,6 @@ pub fn validate(
             internal: tls.internal_secret_class.as_ref().map(ToString::to_string),
         },
         authentication,
-        authentication_enabled: trino.authentication_enabled(),
         authorization: dereferenced_objects.trino_opa_config.clone(),
         fault_tolerant_execution: dereferenced_objects.resolved_fte_config.clone(),
         client_protocol: dereferenced_objects.resolved_client_protocol_config.clone(),
@@ -366,7 +365,7 @@ mod tests {
             "e6ac237d-a6d4-43a1-8135-f36506110912"
         );
         assert_eq!(validated.product_version, 479);
-        assert!(!validated.cluster_config.authentication_enabled);
+        assert!(!validated.cluster_config.authentication_enabled());
         assert!(
             validated
                 .role_group_configs

rust/operator-binary/src/crd/mod.rs

@@ -568,12 +568,6 @@ impl v1alpha1::TrinoCluster {
         &self.spec.cluster_config.authentication
     }
 
-    /// Check if any authentication settings are provided
-    pub fn authentication_enabled(&self) -> bool {
-        let spec: &v1alpha1::TrinoClusterSpec = &self.spec;
-        !spec.cluster_config.authentication.is_empty()
-    }
-
     pub fn get_opa_config(&self) -> Option<&v1alpha1::TrinoAuthorizationOpaConfig> {
         self.spec
             .cluster_config