refactor: use v2 Port, sa name helper

Author: maltesander

rust/operator-binary/src/crd/mod.rs

@@ -26,8 +26,11 @@ use stackable_operator::{
     v2::{
         config_overrides::KeyValueConfigOverrides,
         role_utils::JavaCommonConfig,
-        types::kubernetes::{
-            ConfigMapName, ListenerClassName, ListenerName, NamespaceName, ServiceName,
+        types::{
+            common::Port,
+            kubernetes::{
+                ConfigMapName, ListenerClassName, ListenerName, NamespaceName, ServiceName,
+            },
         },
     },
     versioned::versioned,
@@ -57,15 +60,15 @@ pub const FIELD_MANAGER: &str = "zookeeper-operator";
 
 pub const ZOOKEEPER_SERVER_PORT_NAME: &str = "zk";
 pub const ZOOKEEPER_LEADER_PORT_NAME: &str = "zk-leader";
-pub const ZOOKEEPER_LEADER_PORT: u16 = 2888;
+pub const ZOOKEEPER_LEADER_PORT: Port = Port(2888);
 pub const ZOOKEEPER_ELECTION_PORT_NAME: &str = "zk-election";
-pub const ZOOKEEPER_ELECTION_PORT: u16 = 3888;
+pub const ZOOKEEPER_ELECTION_PORT: Port = Port(3888);
 
 pub const JMX_METRICS_PORT_NAME: &str = "jmx-metrics";
-pub const JMX_METRICS_PORT: u16 = 9505;
+pub const JMX_METRICS_PORT: Port = Port(9505);
 pub const METRICS_PROVIDER_HTTP_PORT_KEY: &str = "metricsProvider.httpPort";
 pub const METRICS_PROVIDER_HTTP_PORT_NAME: &str = "metrics";
-pub const METRICS_PROVIDER_HTTP_PORT: u16 = 7000;
+pub const METRICS_PROVIDER_HTTP_PORT: Port = Port(7000);
 
 pub const STACKABLE_DATA_DIR: &str = "/stackable/data";
 pub const STACKABLE_CONFIG_DIR: &str = "/stackable/config";

rust/operator-binary/src/crd/security.rs

@@ -59,12 +59,12 @@ pub struct ZookeeperSecurity {
 
 impl ZookeeperSecurity {
     // ports
-    pub const CLIENT_PORT: u16 = 2181;
+    pub const CLIENT_PORT: Port = Port(2181);
     pub const CLIENT_PORT_NAME: &'static str = "clientPort";
     // directories
     pub const QUORUM_TLS_DIR: &'static str = "/stackable/quorum_tls";
     pub const QUORUM_TLS_MOUNT_DIR: &'static str = "/stackable/quorum_tls_mount";
-    pub const SECURE_CLIENT_PORT: u16 = 2282;
+    pub const SECURE_CLIENT_PORT: Port = Port(2282);
     pub const SECURE_CLIENT_PORT_NAME: &'static str = "secureClientPort";
     pub const SERVER_CNXN_FACTORY: &'static str = "serverCnxnFactory";
     pub const SERVER_TLS_DIR: &'static str = "/stackable/server_tls";
@@ -133,9 +133,9 @@ impl ZookeeperSecurity {
     /// Return the ZooKeeper (secure) client port depending on tls or authentication settings.
     pub fn client_port(&self) -> Port {
         if self.tls_enabled() {
-            Port::from(Self::SECURE_CLIENT_PORT)
+            Self::SECURE_CLIENT_PORT
         } else {
-            Port::from(Self::CLIENT_PORT)
+            Self::CLIENT_PORT
         }
     }
 

rust/operator-binary/src/zk_controller.rs

@@ -291,7 +291,6 @@ pub async fn reconcile_zk(
             &validated_cluster,
             rolegroup_name,
             rolegroup_config,
-            &rbac_sa,
         )
         .with_context(|_| BuildRoleGroupStatefulSetSnafu {
             rolegroup: rolegroup_name.clone(),

rust/operator-binary/src/zk_controller/build/properties/zoo_cfg.rs

@@ -7,6 +7,8 @@
 
 use std::collections::BTreeMap;
 
+use stackable_operator::v2::types::common::Port;
+
 use crate::{
     crd::{
         METRICS_PROVIDER_HTTP_PORT, METRICS_PROVIDER_HTTP_PORT_KEY, STACKABLE_DATA_DIR,
@@ -113,10 +115,11 @@ impl ValidatedCluster {
     /// Defined here (in the build layer) rather than in `validate` so that resolving the port —
     /// which renders the full `zoo.cfg` via [`build`] — does not invert the validate → build
     /// dependency direction.
-    pub fn metrics_http_port(&self, rolegroup_config: &ValidatedRoleGroupConfig) -> u16 {
+    pub fn metrics_http_port(&self, rolegroup_config: &ValidatedRoleGroupConfig) -> Port {
         build(self, rolegroup_config)
             .get(METRICS_PROVIDER_HTTP_PORT_KEY)
-            .and_then(|port| port.parse().ok())
+            .and_then(|port| port.parse::<u16>().ok())
+            .map(Port::from)
             .unwrap_or(METRICS_PROVIDER_HTTP_PORT)
     }
 }

rust/operator-binary/src/zk_controller/build/resource/service.rs

@@ -2,7 +2,10 @@ use stackable_operator::{
     builder::meta::ObjectMetaBuilder,
     k8s_openapi::api::core::v1::{Service, ServicePort, ServiceSpec},
     kvp::{Annotations, Labels},
-    v2::{builder::meta::ownerreference_from_resource, types::operator::RoleGroupName},
+    v2::{
+        builder::meta::ownerreference_from_resource,
+        types::{common::Port, operator::RoleGroupName},
+    },
 };
 
 use crate::{
@@ -80,7 +83,7 @@ pub(crate) fn build_server_rolegroup_metrics_service(
         .ownerreference(ownerreference_from_resource(cluster, None, Some(true)))
         .with_labels(cluster.recommended_labels(role_group_name))
         .with_labels(prometheus_labels())
-        .with_annotations(prometheus_annotations(metrics_port))
+        .with_annotations(prometheus_annotations(metrics_port.clone()))
         .build();
 
     let service_spec = ServiceSpec {
@@ -124,7 +127,7 @@ fn prometheus_labels() -> Labels {
 /// These annotations can be used in a ServiceMonitor.
 ///
 /// see also <https://github.com/prometheus-community/helm-charts/blob/prometheus-27.32.0/charts/prometheus/values.yaml#L983-L1036>
-fn prometheus_annotations(metrics_port: u16) -> Annotations {
+fn prometheus_annotations(metrics_port: Port) -> Annotations {
     Annotations::try_from([
         ("prometheus.io/path".to_owned(), "/metrics".to_owned()),
         ("prometheus.io/port".to_owned(), metrics_port.to_string()),

rust/operator-binary/src/zk_controller/build/resource/statefulset.rs

@@ -23,12 +23,11 @@ use stackable_operator::{
             core::v1::{
                 ConfigMapVolumeSource, EmptyDirVolumeSource, EnvVar, EnvVarSource, ExecAction,
                 ObjectFieldSelector, PersistentVolumeClaim, PodSecurityContext, Probe,
-                ResourceRequirements, ServiceAccount, Volume,
+                ResourceRequirements, Volume,
             },
         },
         apimachinery::pkg::apis::meta::v1::LabelSelector,
     },
-    kube::ResourceExt,
     kvp::Labels,
     memory::{BinaryMultiple, MemoryQuantity},
     product_logging::{
@@ -158,7 +157,6 @@ pub fn build_server_rolegroup_statefulset(
     cluster: &ValidatedCluster,
     role_group_name: &RoleGroupName,
     rolegroup_config: &ValidatedRoleGroupConfig,
-    service_account: &ServiceAccount,
 ) -> Result<StatefulSet> {
     let merged_config = &rolegroup_config.config;
     let logging = &merged_config.logging;
@@ -331,9 +329,12 @@ pub fn build_server_rolegroup_statefulset(
             ZOOKEEPER_SERVER_PORT_NAME,
             i32::from(zookeeper_security.client_port()),
         )
-        .add_container_port(ZOOKEEPER_LEADER_PORT_NAME, ZOOKEEPER_LEADER_PORT as i32)
-        .add_container_port(ZOOKEEPER_ELECTION_PORT_NAME, ZOOKEEPER_ELECTION_PORT as i32)
-        .add_container_port(JMX_METRICS_PORT_NAME, JMX_METRICS_PORT as i32)
+        .add_container_port(ZOOKEEPER_LEADER_PORT_NAME, i32::from(ZOOKEEPER_LEADER_PORT))
+        .add_container_port(
+            ZOOKEEPER_ELECTION_PORT_NAME,
+            i32::from(ZOOKEEPER_ELECTION_PORT),
+        )
+        .add_container_port(JMX_METRICS_PORT_NAME, i32::from(JMX_METRICS_PORT))
         .add_container_port(METRICS_PROVIDER_HTTP_PORT_NAME, metrics_port.into())
         .add_volume_mount(DATA_VOLUME_NAME, STACKABLE_DATA_DIR)
         .context(AddVolumeMountSnafu)?
@@ -390,7 +391,7 @@ pub fn build_server_rolegroup_statefulset(
             fs_group: Some(1000),
             ..PodSecurityContext::default()
         })
-        .service_account_name(service_account.name_any());
+        .service_account_name(cluster.rbac_service_account_name());
 
     // Use the user-provided custom log ConfigMap if one is configured, otherwise fall back to the
     // rolegroup's own ConfigMap. This branches on the *validated* logging choice.

rust/operator-binary/src/zk_controller/validate.rs

@@ -35,9 +35,11 @@ use stackable_operator::{
             validate_logging_configuration_for_container,
         },
         role_group_utils::ResourceNames,
-        role_utils::{JavaCommonConfig, with_validated_config},
+        role_utils::{JavaCommonConfig, ResourceNames as RbacResourceNames, with_validated_config},
         types::{
-            kubernetes::{ConfigMapName, ListenerClassName, NamespaceName, Uid},
+            kubernetes::{
+                ConfigMapName, ListenerClassName, NamespaceName, ServiceAccountName, Uid,
+            },
             operator::{
                 ClusterName, ControllerName, OperatorName, ProductName, ProductVersion,
                 RoleGroupName, RoleName,
@@ -270,6 +272,19 @@ impl ValidatedCluster {
         }
     }
 
+    /// The RBAC ServiceAccount name for this cluster, `<cluster>-serviceaccount`.
+    ///
+    /// Matches the name produced by
+    /// [`build_rbac_resources`](stackable_operator::commons::rbac::build_rbac_resources) so the
+    /// StatefulSet can reference the ServiceAccount without depending on the built object.
+    pub(crate) fn rbac_service_account_name(&self) -> ServiceAccountName {
+        RbacResourceNames {
+            cluster_name: self.name.clone(),
+            product_name: product_name(),
+        }
+        .service_account_name()
+    }
+
     /// Recommended labels for a role-group resource, using the given product version.
     ///
     /// Used for PVC templates that cannot be modified once deployed: passing a constant version