refactor: extract dereference/validate pipeline from reconcile_airflow#795
Merged
Conversation
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Move external resource resolution (product image, auth, authz, internal secrets) into controller::dereference module with its own error enum. Extract config validation and merging into validate_cluster(), which produces a ValidatedAirflowCluster proving all product-config validation succeeded before any Kubernetes resources are created. The validated struct owns the resolved product image and per-role/ per-rolegroup merged configs. Existing build functions are unchanged and receive their parameters from the validated structs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This was referenced May 12, 2026
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Open
3 tasks
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Member
Author
Rename ProductConfigTransform to GenerateProductConfig and fix the display string casing to match the convention used across all three dereference/validate extraction PRs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
siegfriedweber
requested changes
May 13, 2026
Image resolution is a pure computation, not an I/O dereference, so it belongs in validate_cluster alongside the other config validation. This also aligns with the pattern used by the trino operator. The dereference error variants were renamed to drop the `Invalid` prefix (e.g. InvalidAuthenticationConfig → AuthenticationConfig) because removing ResolveProductImage left all remaining variants sharing the same prefix, triggering clippy::enum_variant_names. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Secret creation is a side effect that should not happen before the cluster spec has been validated. Moved it to the reconciler, after validate_cluster succeeds. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
adwk67
moved this from Development: In Review
to Development: Done
in Stackable Engineering
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Ord/PartialOrdonAirflowRoleso it can be used as aBTreeMapkeycontroller::dereferencemodule with its own Snafu error enumvalidate_cluster(), producing aValidatedAirflowClusterstruct that proves all validation succeeded before any Kubernetes resources are createdValidatedAirflowClusterowns the resolved product image and per-role/per-rolegroup merged configs; existing build functions are unchanged and receive parameters from the validated structsReviewer notes
dereference()andvalidate_cluster()contain no new logic — they are pure extractions of code that was previously inline inreconcile_airflow()ValidatedAirflowClusterstruct intentionally has fewer fields than a full ownership model would (noname/namespace/uid/metadatavalidated types, noprecomputed_pod_data). This is a "construct but decompose" fail-fast gate: built early in reconcile to prove validation passes, then its fields feed the existing unchanged build functionscontroller/directory is introduced as a home for pipeline stages — currently justdereference, withvalidateand further stages to follow in later PRsDereferencewrapper variant in the controller'sErrorenum replaces 4 individual error variants (ResolveProductImage,InvalidAuthenticationConfig,InvalidAuthorizationConfig,InvalidInternalSecret) that moved into the new module's own error enumTest plan
🤖 Generated with Claude Code