fix: split fetch and validate auth class steps

Author: maltesander

rust/operator-binary/src/crd/authentication.rs

@@ -57,6 +57,35 @@ pub struct ResolvedAuthenticationClasses {
 }
 
 impl ResolvedAuthenticationClasses {
+    /// Fetch the referenced AuthenticationClasses from the Kubernetes API without validating them.
+    ///
+    /// Call [`Self::validate`] on the result to enforce the constraints documented there.
+    pub async fn fetch_references(
+        client: &Client,
+        auth_classes: &Vec<v1alpha1::ZookeeperAuthentication>,
+    ) -> Result<ResolvedAuthenticationClasses, Error> {
+        let mut resolved_authentication_classes: Vec<core::v1alpha1::AuthenticationClass> = vec![];
+
+        for auth_class in auth_classes {
+            resolved_authentication_classes.push(
+                core::v1alpha1::AuthenticationClass::resolve(
+                    client,
+                    &auth_class.authentication_class,
+                )
+                .await
+                .context(AuthenticationClassRetrievalSnafu {
+                    authentication_class: ObjectRef::<core::v1alpha1::AuthenticationClass>::new(
+                        &auth_class.authentication_class,
+                    ),
+                })?,
+            );
+        }
+
+        Ok(ResolvedAuthenticationClasses {
+            resolved_authentication_classes,
+        })
+    }
+
     /// Return the (first) TLS `AuthenticationClass` if available
     pub fn get_tls_authentication_class(&self) -> Option<&core::v1alpha1::AuthenticationClass> {
         self.resolved_authentication_classes.iter().find(|auth| {
@@ -101,31 +130,3 @@ impl ResolvedAuthenticationClasses {
         }
     }
 }
-
-/// Resolve provided AuthenticationClasses via API calls and validate the contents.
-/// Currently errors out if:
-/// - AuthenticationClass could not be resolved
-/// - Validation failed
-pub async fn resolve_authentication_classes(
-    client: &Client,
-    auth_classes: &Vec<v1alpha1::ZookeeperAuthentication>,
-) -> Result<ResolvedAuthenticationClasses, Error> {
-    let mut resolved_authentication_classes: Vec<core::v1alpha1::AuthenticationClass> = vec![];
-
-    for auth_class in auth_classes {
-        resolved_authentication_classes.push(
-            core::v1alpha1::AuthenticationClass::resolve(client, &auth_class.authentication_class)
-                .await
-                .context(AuthenticationClassRetrievalSnafu {
-                    authentication_class: ObjectRef::<core::v1alpha1::AuthenticationClass>::new(
-                        &auth_class.authentication_class,
-                    ),
-                })?,
-        );
-    }
-
-    ResolvedAuthenticationClasses {
-        resolved_authentication_classes,
-    }
-    .validate()
-}

rust/operator-binary/src/zk_controller/dereference.rs

@@ -15,13 +15,14 @@ use crate::crd::{
 
 #[derive(Snafu, Debug)]
 pub enum Error {
-    #[snafu(display("failed to resolve authentication classes"))]
-    ResolveAuthenticationClasses { source: authentication::Error },
+    #[snafu(display("failed to fetch authentication classes"))]
+    FetchAuthenticationClasses { source: authentication::Error },
 }
 
 type Result<T, E = Error> = std::result::Result<T, E>;
 
-/// Kubernetes objects referenced from the [`v1alpha1::ZookeeperCluster`] spec, already fetched.
+/// Kubernetes objects referenced from the [`v1alpha1::ZookeeperCluster`] spec, already fetched but
+/// not yet validated.
 pub struct DereferencedObjects {
     pub resolved_authentication_classes: ResolvedAuthenticationClasses,
 }
@@ -31,12 +32,12 @@ pub async fn dereference(
     client: &Client,
     zk: &v1alpha1::ZookeeperCluster,
 ) -> Result<DereferencedObjects> {
-    let resolved_authentication_classes = authentication::resolve_authentication_classes(
+    let resolved_authentication_classes = ResolvedAuthenticationClasses::fetch_references(
         client,
         &zk.spec.cluster_config.authentication,
     )
     .await
-    .context(ResolveAuthenticationClassesSnafu)?;
+    .context(FetchAuthenticationClassesSnafu)?;
 
     Ok(DereferencedObjects {
         resolved_authentication_classes,

rust/operator-binary/src/zk_controller/validate.rs

@@ -17,7 +17,7 @@ use stackable_operator::{
 use crate::{
     crd::{
         CONTAINER_IMAGE_BASE_NAME, JVM_SECURITY_PROPERTIES_FILE, ZOOKEEPER_PROPERTIES_FILE,
-        ZookeeperRole, security::ZookeeperSecurity, v1alpha1,
+        ZookeeperRole, authentication, security::ZookeeperSecurity, v1alpha1,
     },
     zk_controller::dereference::DereferencedObjects,
 };
@@ -29,6 +29,9 @@ pub enum Error {
         source: product_image_selection::Error,
     },
 
+    #[snafu(display("failed to validate authentication classes"))]
+    InvalidAuthenticationClassConfiguration { source: authentication::Error },
+
     #[snafu(display("object defines no server role"))]
     NoServerRole,
 
@@ -69,10 +72,12 @@ pub fn validate(
         )
         .context(ResolveProductImageSnafu)?;
 
-    let zookeeper_security = ZookeeperSecurity::new(
-        zk,
-        dereferenced_objects.resolved_authentication_classes.clone(),
-    );
+    let resolved_authentication_classes = dereferenced_objects
+        .resolved_authentication_classes
+        .validate()
+        .context(InvalidAuthenticationClassConfigurationSnafu)?;
+
+    let zookeeper_security = ZookeeperSecurity::new(zk, resolved_authentication_classes);
 
     let validated_role_config =
         validated_product_config(zk, &resolved_product_image.product_version, product_config)?;

rust/operator-binary/src/znode_controller/dereference.rs

@@ -2,7 +2,8 @@
 //!
 //! Fetches the parent [`v1alpha1::ZookeeperCluster`] referenced by the znode's
 //! `spec.clusterRef`, plus the [`ResolvedAuthenticationClasses`] of that cluster. Both Apply
-//! and Cleanup paths in `reconcile_znode` share this output.
+//! and Cleanup paths in `reconcile_znode` share this output. Synchronous validation of the
+//! fetched objects happens in the validate step.
 
 use snafu::{ResultExt, Snafu};
 use stackable_operator::{
@@ -32,8 +33,8 @@ pub enum Error {
         zk: ObjectRef<v1alpha1::ZookeeperCluster>,
     },
 
-    #[snafu(display("failed to resolve authentication classes"))]
-    ResolveAuthenticationClasses { source: authentication::Error },
+    #[snafu(display("failed to fetch authentication classes"))]
+    FetchAuthenticationClasses { source: authentication::Error },
 }
 
 type Result<T, E = Error> = std::result::Result<T, E>;
@@ -51,12 +52,12 @@ pub async fn dereference(
 ) -> Result<DereferencedObjects> {
     let zk = find_zk_of_znode(client, znode).await?;
 
-    let resolved_authentication_classes = authentication::resolve_authentication_classes(
+    let resolved_authentication_classes = ResolvedAuthenticationClasses::fetch_references(
         client,
         &zk.spec.cluster_config.authentication,
     )
     .await
-    .context(ResolveAuthenticationClassesSnafu)?;
+    .context(FetchAuthenticationClassesSnafu)?;
 
     Ok(DereferencedObjects {
         zk,

rust/operator-binary/src/znode_controller/validate.rs

@@ -10,7 +10,7 @@ use stackable_operator::{
 };
 
 use crate::{
-    crd::{CONTAINER_IMAGE_BASE_NAME, security::ZookeeperSecurity, v1alpha1},
+    crd::{CONTAINER_IMAGE_BASE_NAME, authentication, security::ZookeeperSecurity, v1alpha1},
     znode_controller::dereference::DereferencedObjects,
 };
 
@@ -20,6 +20,9 @@ pub enum Error {
     ResolveProductImage {
         source: product_image_selection::Error,
     },
+
+    #[snafu(display("failed to validate authentication classes"))]
+    InvalidAuthenticationClassConfiguration { source: authentication::Error },
 }
 
 type Result<T, E = Error> = std::result::Result<T, E>;
@@ -47,10 +50,13 @@ pub fn validate(
         )
         .context(ResolveProductImageSnafu)?;
 
-    let zookeeper_security = ZookeeperSecurity::new(
-        &dereferenced_objects.zk,
-        dereferenced_objects.resolved_authentication_classes.clone(),
-    );
+    let resolved_authentication_classes = dereferenced_objects
+        .resolved_authentication_classes
+        .validate()
+        .context(InvalidAuthenticationClassConfigurationSnafu)?;
+
+    let zookeeper_security =
+        ZookeeperSecurity::new(&dereferenced_objects.zk, resolved_authentication_classes);
 
     Ok(ValidatedInputs {
         resolved_product_image,