From 06da6e1cfb9c96a3686d5298bab73b525a9db3e3 Mon Sep 17 00:00:00 2001 From: Andrew Kenworthy Date: Fri, 28 Aug 2026 17:29:49 +0200 Subject: [PATCH 1/3] use expect where possible and remove unecessary enums/Results --- .../src/controller/build/kerberos.rs | 42 ++--------- .../src/controller/build/opa.rs | 11 +++ .../controller/build/resource/config_map.rs | 12 +-- .../controller/build/resource/discovery.rs | 28 +++---- .../src/controller/build/resource/listener.rs | 18 +++-- .../controller/build/resource/statefulset.rs | 74 ++++++++----------- rust/operator-binary/src/crd/mod.rs | 16 ++-- 7 files changed, 78 insertions(+), 123 deletions(-) diff --git a/rust/operator-binary/src/controller/build/kerberos.rs b/rust/operator-binary/src/controller/build/kerberos.rs index d3bbe23b..507575a5 100644 --- a/rust/operator-binary/src/controller/build/kerberos.rs +++ b/rust/operator-binary/src/controller/build/kerberos.rs @@ -1,18 +1,11 @@ use std::{collections::BTreeMap, str::FromStr}; use indoc::formatdoc; -use snafu::{ResultExt, Snafu}; use stackable_operator::{ - builder::{ - self, - pod::{ - PodBuilder, - container::ContainerBuilder, - volume::{ - SecretOperatorVolumeSourceBuilder, SecretOperatorVolumeSourceBuilderError, - VolumeBuilder, - }, - }, + builder::pod::{ + PodBuilder, + container::ContainerBuilder, + volume::{SecretOperatorVolumeSourceBuilder, VolumeBuilder}, }, commons::secret_class::SecretClassVolumeProvisionParts, constant, @@ -40,29 +33,12 @@ constant!(KRB5_CONFIG: EnvVarName = "KRB5_CONFIG"); /// sub-paths are derived from this. pub(crate) const STACKABLE_KERBEROS_DIR: &str = "/stackable/kerberos"; -#[derive(Snafu, Debug)] -#[allow(clippy::enum_variant_names)] // all variants have the same prefix: `Add` -pub enum Error { - #[snafu(display("failed to add Kerberos secret volume"))] - AddKerberosSecretVolume { - source: SecretOperatorVolumeSourceBuilderError, - }, - - #[snafu(display("failed to add needed volume"))] - AddVolume { source: builder::pod::Error }, - - #[snafu(display("failed to add needed volumeMount"))] - AddVolumeMount { - source: builder::pod::container::Error, - }, -} - pub fn add_kerberos_pod_config( cluster: &ValidatedCluster, role: &HiveRole, cb: &mut ContainerBuilder, pb: &mut PodBuilder, -) -> Result<(), Error> { +) { if let Some(kerberos_secret_class) = &cluster.cluster_config.kerberos_secret_class { // Mount keytab let kerberos_secret_operator_volume = SecretOperatorVolumeSourceBuilder::new( @@ -73,18 +49,16 @@ pub fn add_kerberos_pod_config( .with_service_scope(cluster.name.to_string()) .with_kerberos_service_name(role.kerberos_service_name()) .build() - .context(AddKerberosSecretVolumeSnafu)?; + .expect("The annotation keys are static and annotation values cannot be invalid."); pb.add_volume( VolumeBuilder::new(&*KERBEROS_VOLUME_NAME) .ephemeral(kerberos_secret_operator_volume) .build(), ) - .context(AddVolumeSnafu)?; + .expect("The volume names are statically defined and there should be no duplicates."); cb.add_volume_mount(&*KERBEROS_VOLUME_NAME, STACKABLE_KERBEROS_DIR) - .context(AddVolumeMountSnafu)?; + .expect("The mount paths are statically defined and there should be no duplicates."); } - - Ok(()) } /// The environment variables the Kerberos configuration requires on the Hive container, or an diff --git a/rust/operator-binary/src/controller/build/opa.rs b/rust/operator-binary/src/controller/build/opa.rs index c09599f2..383cea84 100644 --- a/rust/operator-binary/src/controller/build/opa.rs +++ b/rust/operator-binary/src/controller/build/opa.rs @@ -91,3 +91,14 @@ pub fn build_opa_tls_ca_cert_mount_path(opa: &ResolvedOpaConfig) -> Option = std::result::Result; @@ -120,7 +114,7 @@ pub fn build_metastore_rolegroup_config_map( ); } - cm_builder.build().with_context(|_| AssembleSnafu { - role_group: role_group_name.clone(), - }) + Ok(cm_builder + .build() + .expect("The ConfigMap metadata is set in this function.")) } diff --git a/rust/operator-binary/src/controller/build/resource/discovery.rs b/rust/operator-binary/src/controller/build/resource/discovery.rs index 1e8b66fa..0ee03906 100644 --- a/rust/operator-binary/src/controller/build/resource/discovery.rs +++ b/rust/operator-binary/src/controller/build/resource/discovery.rs @@ -4,7 +4,7 @@ use snafu::{ResultExt, Snafu}; use stackable_operator::{ builder::configmap::ConfigMapBuilder, k8s_openapi::api::core::v1::ConfigMap, - kube::{api::ObjectMeta, runtime::reflector::ObjectRef}, + kube::api::ObjectMeta, v2::types::{kubernetes::ConfigMapName, operator::ClusterName}, }; @@ -16,40 +16,34 @@ use crate::{ resource::listener::build_listener_connection_string, }, }, - crd::{HiveRole, v1alpha1}, + crd::HiveRole, }; #[derive(Snafu, Debug)] pub enum Error { - #[snafu(display("could not build discovery config map for {obj_ref}"))] - DiscoveryConfigMap { - source: stackable_operator::builder::configmap::Error, - obj_ref: ObjectRef, - }, - #[snafu(display("failed to configure listener discovery configmap"))] ListenerConfiguration { source: crate::controller::build::resource::listener::Error, }, } -/// An [`ObjectRef`] back to the owning [`v1alpha1::HiveCluster`], reconstructed from the validated -/// cluster identity for use in error messages. -fn cluster_object_ref(cluster: &ValidatedCluster) -> ObjectRef { - ObjectRef::new(cluster.name.as_ref()).within(cluster.namespace.as_ref()) -} - /// The name of the discovery [`ConfigMap`] -- the cluster name itself. /// /// Takes the bare cluster name (not [`ValidatedCluster`]) so the dereference step, which runs /// before validation, can derive the same name. pub fn discovery_config_map_name(cluster_name: &ClusterName) -> ConfigMapName { + const _: () = assert!( + ClusterName::MAX_LENGTH <= ConfigMapName::MAX_LENGTH, + "The string `` must not exceed the limit of ConfigMap names." + ); + let _ = ClusterName::IS_RFC_1123_SUBDOMAIN_NAME; + ConfigMapName::from_str(cluster_name.as_ref()) .expect("a valid cluster name is a valid ConfigMap name") } /// Builds the discovery [`ConfigMap`] containing information about how to connect to a certain -/// [`v1alpha1::HiveCluster`]. +/// [`crate::crd::v1alpha1::HiveCluster`]. /// /// The ConfigMap needs the role Listener's ingress address, which only the listener-operator /// writes. While the dereferenced Listener is absent or still address-less (around the first @@ -98,9 +92,7 @@ pub fn build_discovery_configmap( let config_map = discovery_configmap .build() - .with_context(|_| DiscoveryConfigMapSnafu { - obj_ref: cluster_object_ref(cluster), - })?; + .expect("The ConfigMap metadata is set in this function."); Ok(Some(config_map)) } diff --git a/rust/operator-binary/src/controller/build/resource/listener.rs b/rust/operator-binary/src/controller/build/resource/listener.rs index ca9dacf2..c20a0548 100644 --- a/rust/operator-binary/src/controller/build/resource/listener.rs +++ b/rust/operator-binary/src/controller/build/resource/listener.rs @@ -5,7 +5,7 @@ use stackable_operator::{ crd::listener::v1alpha1::{Listener, ListenerIngress, ListenerPort, ListenerSpec}, v2::types::{ kubernetes::{ListenerClassName, ListenerName}, - operator::ClusterName, + operator::{ClusterName, RoleName}, }, }; @@ -48,11 +48,17 @@ pub fn build_listener_connection_string( /// Takes the bare cluster name (not [`ValidatedCluster`]) so the dereference step, which runs /// before validation, can derive the same name. pub fn role_listener_name(cluster_name: &ClusterName, hive_role: &HiveRole) -> ListenerName { - ListenerName::from_str(&format!( - "{cluster_name}-{hive_role}", - hive_role = **hive_role - )) - .expect("the role listener name is a valid Listener name") + const _: () = assert!( + ClusterName::MAX_LENGTH + 1 /* dash */ + RoleName::MAX_LENGTH <= ListenerName::MAX_LENGTH, + "The string `-` must not exceed the limit of Listener names." + ); + // Both halves are RFC 1123 labels joined by a dash, which is a valid RFC 1123 subdomain. + let _ = ClusterName::IS_RFC_1123_SUBDOMAIN_NAME; + let _ = RoleName::IS_RFC_1123_LABEL_NAME; + + let role_name: &RoleName = hive_role; + ListenerName::from_str(&format!("{cluster_name}-{role_name}")) + .expect("The role listener name is a valid Listener name.") } // Designed to build a listener per role diff --git a/rust/operator-binary/src/controller/build/resource/statefulset.rs b/rust/operator-binary/src/controller/build/resource/statefulset.rs index 7fa0d152..3c3c34b5 100644 --- a/rust/operator-binary/src/controller/build/resource/statefulset.rs +++ b/rust/operator-binary/src/controller/build/resource/statefulset.rs @@ -89,35 +89,15 @@ pub enum Error { source: crate::controller::build::graceful_shutdown::Error, }, - #[snafu(display("failed to add kerberos config"))] - AddKerberosConfig { - source: crate::controller::build::kerberos::Error, - }, - #[snafu(display("failed to add the database credential environment variables"))] AddDatabaseCredentialEnvVar { source: stackable_operator::v2::builder::pod::container::Error, }, - #[snafu(display("failed to add needed volume"))] - AddVolume { - source: stackable_operator::builder::pod::Error, - }, - - #[snafu(display("failed to add needed volumeMount"))] - AddVolumeMount { - source: stackable_operator::builder::pod::container::Error, - }, - #[snafu(display("failed to construct JVM arguments"))] ConstructJvmArguments { source: crate::controller::build::jvm::Error, }, - - #[snafu(display("failed to build TLS certificate SecretClass Volume"))] - TlsCertSecretClassVolumeBuild { - source: stackable_operator::builder::pod::volume::SecretOperatorVolumeSourceBuilderError, - }, } type Result = std::result::Result; @@ -197,6 +177,9 @@ pub(crate) fn build_metastore_rolegroup_statefulset( let mut pod_builder = PodBuilder::new(); + // Operator-managed volumes and volume mounts have constant names and paths, so they cannot + // collide with each other and the adds are infallible. The S3 volumes (named after the user's + // SecretClasses) are added last, after every operator-managed one, and stay fallible. if let Some(hdfs) = &cluster.cluster_config.hdfs { pod_builder .add_volume( @@ -204,19 +187,10 @@ pub(crate) fn build_metastore_rolegroup_statefulset( .with_config_map(&hdfs.config_map) .build(), ) - .context(AddVolumeSnafu)?; + .expect("The volume names are statically defined and there should be no duplicates."); container_builder .add_volume_mount(&*HDFS_DISCOVERY_VOLUME_NAME, HDFS_CONFIG_MOUNT_DIR) - .context(AddVolumeMountSnafu)?; - } - - if let Some(s3) = s3_connection { - s3.add_volumes_and_mounts(&mut pod_builder, vec![&mut container_builder]) - .context(ConfigureS3ConnectionSnafu)?; - - if s3.tls.uses_tls() && !s3.tls.uses_tls_verification() { - S3TlsNoVerificationNotSupportedSnafu.fail()?; - } + .expect("The mount paths are statically defined and there should be no duplicates."); } // Add OPA TLS certs if configured @@ -230,7 +204,7 @@ pub(crate) fn build_metastore_rolegroup_statefulset( { container_builder .add_volume_mount(&*OPA_TLS_VOLUME_NAME, &tls_mount_path) - .context(AddVolumeMountSnafu)?; + .expect("The mount paths are statically defined and there should be no duplicates."); let opa_tls_volume = VolumeBuilder::new(&*OPA_TLS_VOLUME_NAME) .ephemeral( @@ -240,13 +214,13 @@ pub(crate) fn build_metastore_rolegroup_statefulset( SecretClassVolumeProvisionParts::Public, ) .build() - .context(TlsCertSecretClassVolumeBuildSnafu)?, + .expect("The annotation keys are static and annotation values cannot be invalid."), ) .build(); pod_builder .add_volume(opa_tls_volume) - .context(AddVolumeSnafu)?; + .expect("The volume names are statically defined and there should be no duplicates."); } let db_type = &cluster.cluster_config.db_type; @@ -303,19 +277,19 @@ pub(crate) fn build_metastore_rolegroup_statefulset( hive_opa_config, )) .add_volume_mount(&*STACKABLE_CONFIG_DIR_NAME, STACKABLE_CONFIG_DIR) - .context(AddVolumeMountSnafu)? + .expect("The mount paths are statically defined and there should be no duplicates.") .add_volume_mount( &*STACKABLE_CONFIG_MOUNT_DIR_NAME, STACKABLE_CONFIG_MOUNT_DIR, ) - .context(AddVolumeMountSnafu)? + .expect("The mount paths are statically defined and there should be no duplicates.") .add_volume_mount(&*STACKABLE_LOG_DIR_NAME, STACKABLE_LOG_DIR) - .context(AddVolumeMountSnafu)? + .expect("The mount paths are statically defined and there should be no duplicates.") .add_volume_mount( &*STACKABLE_LOG_CONFIG_MOUNT_DIR_NAME, STACKABLE_LOG_CONFIG_MOUNT_DIR, ) - .context(AddVolumeMountSnafu)? + .expect("The mount paths are statically defined and there should be no duplicates.") .add_container_port(HIVE_PORT_NAME, HIVE_PORT.into()) .add_container_port(METRICS_PORT_NAME, METRICS_PORT.into()) .resources(merged_config.resources.clone().into()) @@ -372,7 +346,7 @@ pub(crate) fn build_metastore_rolegroup_statefulset( container_builder .add_volume_mount(&*LISTENER_PVC_NAME, LISTENER_VOLUME_DIR) - .context(AddVolumeMountSnafu)?; + .expect("The mount paths are statically defined and there should be no duplicates."); pod_builder .metadata(metadata) @@ -385,7 +359,7 @@ pub(crate) fn build_metastore_rolegroup_statefulset( }), ..Volume::default() }) - .context(AddVolumeSnafu)? + .expect("The volume names are statically defined and there should be no duplicates.") .add_volume(stackable_operator::k8s_openapi::api::core::v1::Volume { name: STACKABLE_CONFIG_MOUNT_DIR_NAME.to_string(), config_map: Some(ConfigMapVolumeSource { @@ -394,14 +368,14 @@ pub(crate) fn build_metastore_rolegroup_statefulset( }), ..Default::default() }) - .context(AddVolumeSnafu)? + .expect("The volume names are statically defined and there should be no duplicates.") .add_empty_dir_volume( &*STACKABLE_LOG_DIR_NAME, Some(product_logging::framework::calculate_log_volume_size_limit( &[MAX_HIVE_LOG_FILES_SIZE], )), ) - .context(AddVolumeSnafu)? + .expect("The volume names are statically defined and there should be no duplicates.") .affinity(&merged_config.affinity) .service_account_name( cluster @@ -433,13 +407,23 @@ pub(crate) fn build_metastore_rolegroup_statefulset( }), ..Volume::default() }) - .context(AddVolumeSnafu)?; + .expect("The volume names are statically defined and there should be no duplicates."); add_graceful_shutdown_config(merged_config, &mut pod_builder).context(GracefulShutdownSnafu)?; if cluster.has_kerberos_enabled() { - add_kerberos_pod_config(cluster, hive_role, container_builder, &mut pod_builder) - .context(AddKerberosConfigSnafu)?; + add_kerberos_pod_config(cluster, hive_role, container_builder, &mut pod_builder); + } + + // S3 volumes and mounts last: their names come from the user's SecretClasses, so they can + // collide with the operator-managed ones above and the adds stay fallible. + if let Some(s3) = s3_connection { + s3.add_volumes_and_mounts(&mut pod_builder, vec![&mut *container_builder]) + .context(ConfigureS3ConnectionSnafu)?; + + if s3.tls.uses_tls() && !s3.tls.uses_tls_verification() { + S3TlsNoVerificationNotSupportedSnafu.fail()?; + } } // this is the main container diff --git a/rust/operator-binary/src/crd/mod.rs b/rust/operator-binary/src/crd/mod.rs index 19b58942..9e3a5203 100644 --- a/rust/operator-binary/src/crd/mod.rs +++ b/rust/operator-binary/src/crd/mod.rs @@ -8,7 +8,6 @@ pub use product_logging::spec::{ }; use security::AuthenticationConfig; use serde::{Deserialize, Serialize}; -use snafu::Snafu; use stackable_operator::{ commons::{ affinity::StackableAffinity, @@ -78,12 +77,12 @@ pub const STACKABLE_TRUST_STORE: &str = "/stackable/truststore.p12"; pub const STACKABLE_TRUST_STORE_PASSWORD: &str = "changeit"; // Listener defaults -pub const DEFAULT_LISTENER_CLASS: &str = "cluster-internal"; +constant!(pub DEFAULT_LISTENER_CLASS: ListenerClassName = "cluster-internal"); -// used by crds to define a default listener_class name +/// Serde default for `listenerClass`. Kept as a function because `#[serde(default = "...")]` +/// requires a function path. pub fn metastore_default_listener_class() -> ListenerClassName { - ListenerClassName::from_str(DEFAULT_LISTENER_CLASS) - .expect("the default listener class is a valid listener class name") + DEFAULT_LISTENER_CLASS.clone() } const DEFAULT_METASTORE_GRACEFUL_SHUTDOWN_TIMEOUT: Duration = Duration::from_minutes_unchecked(5); @@ -100,12 +99,6 @@ pub type HiveRoleType = Role< pub type HiveRoleGroupType = RoleGroup; -#[derive(Snafu, Debug)] -pub enum Error { - #[snafu(display("the role {role} is not defined"))] - CannotRetrieveHiveRole { role: String }, -} - #[versioned( version(name = "v1alpha1"), crates( @@ -410,6 +403,7 @@ mod tests { fn test_constants() { // Test that dereferencing the constants does not panic. let _ = *METASTORE_ROLE_NAME; + let _ = *DEFAULT_LISTENER_CLASS; } impl RoundtripTestData for v1alpha1::HiveClusterSpec { From aaee6f4c09e787321e0a71377cb379d66fd298c7 Mon Sep 17 00:00:00 2001 From: Andrew Kenworthy Date: Fri, 28 Aug 2026 17:33:03 +0200 Subject: [PATCH 2/3] changelog --- CHANGELOG.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index cb39df8e..8c180605 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -23,6 +23,7 @@ All notable changes to this project will be documented in this file. StatefulSets created by older operator versions cannot be updated in place: after the operator upgrade, delete each metastore StatefulSet so that the operator immediately recreates it with the new labels ([#748]). +- Make operations infallible where appropriate ([#759]). ### Fixed @@ -42,6 +43,7 @@ All notable changes to this project will be documented in this file. [#741]: https://github.com/stackabletech/hive-operator/pull/741 [#748]: https://github.com/stackabletech/hive-operator/pull/748 [#754]: https://github.com/stackabletech/hive-operator/pull/754 +[#759]: https://github.com/stackabletech/hive-operator/pull/759 ## [26.7.0] - 2026-07-21 From 9f57f9309112d847e2fb3b4efc448d1cbbfed4d9 Mon Sep 17 00:00:00 2001 From: Andrew Kenworthy Date: Fri, 28 Aug 2026 21:23:09 +0200 Subject: [PATCH 3/3] align StatefulSet assert with rendered volume and env order --- tests/templates/kuttl/smoke/60-assert.yaml.j2 | 81 ++++++++++--------- 1 file changed, 41 insertions(+), 40 deletions(-) diff --git a/tests/templates/kuttl/smoke/60-assert.yaml.j2 b/tests/templates/kuttl/smoke/60-assert.yaml.j2 index d98d3af5..1b938437 100644 --- a/tests/templates/kuttl/smoke/60-assert.yaml.j2 +++ b/tests/templates/kuttl/smoke/60-assert.yaml.j2 @@ -207,7 +207,14 @@ spec: - -euo - pipefail - -c + # Env vars are emitted in alphabetical order (operator-rs `EnvVarSet` is a BTreeMap). env: + - name: COMMON_VAR + value: group-value + - name: CONTAINERDEBUG_LOG_DIRECTORY + value: /stackable/log/containerdebug + - name: GROUP_VAR + value: group-value - name: HADOOP_HEAPSIZE value: "614" - name: HADOOP_OPTS @@ -215,22 +222,16 @@ spec: -javaagent:/stackable/jmx/jmx_prometheus_javaagent.jar=9084:/stackable/jmx/jmx_hive_config.yaml -Djavax.net.ssl.trustStore=/stackable/truststore.p12 -Djavax.net.ssl.trustStorePassword=changeit -Djavax.net.ssl.trustStoreType=pkcs12 - - name: CONTAINERDEBUG_LOG_DIRECTORY - value: /stackable/log/containerdebug - - name: METADATA_DATABASE_USERNAME + - name: METADATA_DATABASE_PASSWORD valueFrom: secretKeyRef: - key: username + key: password name: hive-credentials - - name: METADATA_DATABASE_PASSWORD + - name: METADATA_DATABASE_USERNAME valueFrom: secretKeyRef: - key: password + key: username name: hive-credentials - - name: COMMON_VAR - value: group-value - - name: GROUP_VAR - value: group-value - name: ROLE_VAR value: role-value imagePullPolicy: IfNotPresent @@ -266,12 +267,6 @@ spec: cpu: 250m memory: 768Mi volumeMounts: - - mountPath: /stackable/secrets/test-hive-s3-secret-class - name: test-hive-s3-secret-class-s3-credentials -{% if test_scenario['values']['s3-use-tls'] == 'true' %} - - mountPath: /stackable/secrets/minio-tls-certificates - name: minio-tls-certificates-ca-cert -{% endif %} {% if test_scenario['values']['opa-use-tls'] == 'true' %} - mountPath: /stackable/secrets/opa-tls name: opa-tls @@ -286,6 +281,12 @@ spec: name: log-config-mount - mountPath: /stackable/listener name: listener + - mountPath: /stackable/secrets/test-hive-s3-secret-class + name: test-hive-s3-secret-class-s3-credentials +{% if test_scenario['values']['s3-use-tls'] == 'true' %} + - mountPath: /stackable/secrets/minio-tls-certificates + name: minio-tls-certificates-ca-cert +{% endif %} {% if lookup('env', 'VECTOR_AGGREGATOR') %} - args: - |- @@ -357,12 +358,12 @@ spec: serviceAccountName: hive-serviceaccount terminationGracePeriodSeconds: 300 volumes: +{% if test_scenario['values']['opa-use-tls'] == 'true' %} - ephemeral: volumeClaimTemplate: metadata: annotations: - secrets.stackable.tech/class: test-hive-s3-secret-class - secrets.stackable.tech/provision-parts: public-private + secrets.stackable.tech/provision-parts: public spec: accessModes: - ReadWriteOnce @@ -371,14 +372,28 @@ spec: storage: "1" storageClassName: secrets.stackable.tech volumeMode: Filesystem - name: test-hive-s3-secret-class-s3-credentials -{% if test_scenario['values']['s3-use-tls'] == 'true' %} + name: opa-tls +{% endif %} + - emptyDir: + sizeLimit: 10Mi + name: config + - configMap: + defaultMode: 420 + name: hive-metastore-default + name: config-mount + - emptyDir: + sizeLimit: 30Mi + name: log + - configMap: + defaultMode: 420 + name: hive-metastore-default + name: log-config-mount - ephemeral: volumeClaimTemplate: metadata: annotations: - secrets.stackable.tech/class: minio-tls-certificates - secrets.stackable.tech/provision-parts: public + secrets.stackable.tech/class: test-hive-s3-secret-class + secrets.stackable.tech/provision-parts: public-private spec: accessModes: - ReadWriteOnce @@ -387,13 +402,13 @@ spec: storage: "1" storageClassName: secrets.stackable.tech volumeMode: Filesystem - name: minio-tls-certificates-ca-cert -{% endif %} -{% if test_scenario['values']['opa-use-tls'] == 'true' %} + name: test-hive-s3-secret-class-s3-credentials +{% if test_scenario['values']['s3-use-tls'] == 'true' %} - ephemeral: volumeClaimTemplate: metadata: annotations: + secrets.stackable.tech/class: minio-tls-certificates secrets.stackable.tech/provision-parts: public spec: accessModes: @@ -403,22 +418,8 @@ spec: storage: "1" storageClassName: secrets.stackable.tech volumeMode: Filesystem - name: opa-tls + name: minio-tls-certificates-ca-cert {% endif %} - - emptyDir: - sizeLimit: 10Mi - name: config - - configMap: - defaultMode: 420 - name: hive-metastore-default - name: config-mount - - emptyDir: - sizeLimit: 30Mi - name: log - - configMap: - defaultMode: 420 - name: hive-metastore-default - name: log-config-mount volumeClaimTemplates: - apiVersion: v1 kind: PersistentVolumeClaim