Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ All notable changes to this project will be documented in this file.
Broker StatefulSets created by older operator versions cannot be updated in place: after the
operator upgrade, delete each broker StatefulSet so that the operator immediately recreates it
with the new labels ([#1011]).
- Make operations infallible where appropriate ([#1017]).

### Fixed

Expand All @@ -41,6 +42,7 @@ All notable changes to this project will be documented in this file.
[#1000]: https://github.com/stackabletech/kafka-operator/pull/1000
[#1011]: https://github.com/stackabletech/kafka-operator/pull/1011
[#1014]: https://github.com/stackabletech/kafka-operator/pull/1014
[#1017]: https://github.com/stackabletech/kafka-operator/pull/1017

## [26.7.0] - 2026-07-21

Expand Down
57 changes: 20 additions & 37 deletions rust/operator-binary/src/controller/build/kerberos.rs
Original file line number Diff line number Diff line change
@@ -1,21 +1,17 @@
use std::str::FromStr;

use snafu::{ResultExt, Snafu};
use stackable_operator::{
builder::{
self,
pod::{
PodBuilder,
container::ContainerBuilder,
volume::{
SecretOperatorVolumeSourceBuilder, SecretOperatorVolumeSourceBuilderError,
VolumeBuilder,
},
},
builder::pod::{
PodBuilder,
container::ContainerBuilder,
volume::{SecretOperatorVolumeSourceBuilder, VolumeBuilder},
},
commons::secret_class::SecretClassVolumeProvisionParts,
constant,
v2::builder::pod::container::{EnvVarName, EnvVarSet},
v2::{
builder::pod::container::{EnvVarName, EnvVarSet},
types::kubernetes::VolumeName,
},
};

use crate::{
Expand All @@ -26,55 +22,41 @@ use crate::{
},
};

#[derive(Snafu, Debug)]
pub enum Error {
#[snafu(display("failed to add Kerberos secret volume"))]
KerberosSecretVolume {
source: SecretOperatorVolumeSourceBuilderError,
},

#[snafu(display("failed to add needed volume"))]
AddVolume { source: builder::pod::Error },

#[snafu(display("failed to add needed volumeMount"))]
AddVolumeMount {
source: builder::pod::container::Error,
},
}
constant!(KERBEROS_VOLUME_NAME: VolumeName = "kerberos");

pub fn add_kerberos_pod_config(
kafka_security: &ValidatedKafkaSecurity,
role: &KafkaRole,
cb_kcat_prober: &mut ContainerBuilder,
cb_kafka: &mut ContainerBuilder,
pb: &mut PodBuilder,
) -> Result<(), Error> {
) {
if let Some(kerberos_secret_class) = kafka_security.kerberos_secret_class() {
// Mount keytab
let kerberos_secret_operator_volume = SecretOperatorVolumeSourceBuilder::new(
kerberos_secret_class,
// We need both public (krb5.conf) and private (keytab) parts.
SecretClassVolumeProvisionParts::PublicPrivate,
)
.with_listener_volume_scope(LISTENER_BROKER_VOLUME_NAME)
.with_listener_volume_scope(LISTENER_BOOTSTRAP_VOLUME_NAME)
.with_listener_volume_scope(&*LISTENER_BROKER_VOLUME_NAME)
.with_listener_volume_scope(&*LISTENER_BOOTSTRAP_VOLUME_NAME)
.with_kerberos_service_name(role.kerberos_service_name())
.build()
.context(KerberosSecretVolumeSnafu)?;
.expect("The annotation keys are static and annotation values cannot be invalid.");
pb.add_volume(
VolumeBuilder::new("kerberos")
VolumeBuilder::new(&*KERBEROS_VOLUME_NAME)
.ephemeral(kerberos_secret_operator_volume)
.build(),
)
.context(AddVolumeSnafu)?;
.expect("The volume names are statically defined and there should be no duplicates.");

for cb in [cb_kafka, cb_kcat_prober] {
cb.add_volume_mount("kerberos", STACKABLE_KERBEROS_DIR)
.context(AddVolumeMountSnafu)?;
cb.add_volume_mount(&*KERBEROS_VOLUME_NAME, STACKABLE_KERBEROS_DIR)
.expect(
"The mount paths are statically defined and there should be no duplicates.",
);
}
}

Ok(())
}

constant!(KRB5_CONFIG: EnvVarName = "KRB5_CONFIG");
Expand Down Expand Up @@ -108,5 +90,6 @@ mod tests {
// Test that dereferencing the constants does not panic.
let _ = *KRB5_CONFIG;
let _ = *KAFKA_OPTS;
let _ = *KERBEROS_VOLUME_NAME;
}
}
12 changes: 2 additions & 10 deletions rust/operator-binary/src/controller/build/resource/config_map.rs
Original file line number Diff line number Diff line change
Expand Up @@ -30,12 +30,6 @@ use crate::{

#[derive(Snafu, Debug)]
pub enum Error {
#[snafu(display("failed to build ConfigMap for role group {role_group}"))]
BuildRoleGroupConfig {
source: stackable_operator::builder::configmap::Error,
role_group: RoleGroupName,
},

#[snafu(display(
"failed to serialize [{}] for role group {role_group}",
ConfigFileName::Security
Expand Down Expand Up @@ -194,11 +188,9 @@ pub fn build_rolegroup_config_map(
cm_builder.add_data(VECTOR_CONFIG_FILE, vector_config);
}

cm_builder
Ok(cm_builder
.build()
.with_context(|_| BuildRoleGroupConfigSnafu {
role_group: role_group_name.clone(),
})
.expect("The ConfigMap metadata is set in this function."))
}

// Generate JAAS configuration file for Kerberos authentication
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -17,11 +17,6 @@ use crate::{
pub enum Error {
#[snafu(display("nodePort was out of range"))]
InvalidNodePort { source: TryFromIntError },

#[snafu(display("failed to build ConfigMap"))]
BuildConfigMap {
source: stackable_operator::builder::configmap::Error,
},
}

/// Build a discovery [`ConfigMap`] containing information about how to connect to a certain
Expand Down Expand Up @@ -76,7 +71,7 @@ pub fn build_discovery_configmap(validated_cluster: &ValidatedCluster) -> Result
)
.add_data("KAFKA", bootstrap_servers)
.build()
.context(BuildConfigMapSnafu)?;
.expect("The ConfigMap metadata is set in this function.");

Ok(discovery_cm)
}
Expand Down
Loading
Loading