Implement TrinoCatalog according to ADR

CHANGELOG.md

@@ -4,12 +4,23 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+### Added
+
+- Add support for connecting to HDFS ([#209]).
+
 ### Changed
 
+- BREAKING: TrinoCatalogs now have their own CRD object and get referenced by the TrinoCluster. See [ADR19](https://docs.stackable.tech/home/contributor/adr/ADR019-trino_catalog_definitions.html) and [ADR20](https://docs.stackable.tech/home/contributor/adr/ADR020-trino_catalog_usage.html) ([#209]).
 - Include chart name when installing with a custom release name ([#233], [#234]).
 - `operator-rs` `0.21.1` -> `0.22.0` ([#235]).
-- Add support for Hive 3.1.3 ([#243])
+- Add support for Hive 3.1.3 ([#243]).
+
+### Fixed
+
+- Add missing role to read S3Connection objects ([#209]).
+- Disable Hive connector setting that disallow dropping tables. This check is now done by normal Trino authorization (e.g. OPA) ([#209]).
 
+[#209]: https://github.com/stackabletech/trino-operator/pull/209
 [#233]: https://github.com/stackabletech/trino-operator/pull/233
 [#234]: https://github.com/stackabletech/trino-operator/pull/234
 [#235]: https://github.com/stackabletech/trino-operator/pull/235

deploy/crd/trinocatalog.crd.yaml

@@ -0,0 +1,166 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: trinocatalogs.trino.stackable.tech
+spec:
+  group: trino.stackable.tech
+  names:
+    categories: []
+    kind: TrinoCatalog
+    plural: trinocatalogs
+    shortNames: []
+    singular: trinocatalog
+  scope: Namespaced
+  versions:
+    - additionalPrinterColumns: []
+      name: v1alpha1
+      schema:
+        openAPIV3Schema:
+          description: "Auto-generated derived type for TrinoCatalogSpec via `CustomResource`"
+          properties:
+            spec:
+              properties:
+                configOverrides:
+                  additionalProperties:
+                    type: string
+                  default: {}
+                  type: object
+                connector:
+                  oneOf:
+                    - required:
+                        - hive
+                  properties:
+                    hive:
+                      properties:
+                        hdfs:
+                          nullable: true
+                          properties:
+                            configMap:
+                              description: Name of the discovery-configmap providing information about the HDFS
+                              type: string
+                          required:
+                            - configMap
+                          type: object
+                        metastore:
+                          description: "Mandatory connection to a Hive Metastore, which will be used as a storage for metadata"
+                          properties:
+                            configMap:
+                              description: Name of the discovery-configmap providing information about the Hive metastore
+                              type: string
+                          required:
+                            - configMap
+                          type: object
+                        s3:
+                          description: Connection to an S3 store
+                          nullable: true
+                          oneOf:
+                            - required:
+                                - inline
+                            - required:
+                                - reference
+                          properties:
+                            inline:
+                              description: S3 connection definition as CRD.
+                              properties:
+                                accessStyle:
+                                  description: "Which access style to use. Defaults to virtual hosted-style as most of the data products out there. Have a look at the official documentation on <https://docs.aws.amazon.com/AmazonS3/latest/userguide/VirtualHosting.html>"
+                                  enum:
+                                    - Path
+                                    - VirtualHosted
+                                  nullable: true
+                                  type: string
+                                credentials:
+                                  description: "If the S3 uses authentication you have to specify you S3 credentials. In the most cases a SecretClass providing `accessKey` and `secretKey` is sufficient."
+                                  nullable: true
+                                  properties:
+                                    scope:
+                                      description: "[Scope](https://docs.stackable.tech/secret-operator/scope.html) of the [SecretClass](https://docs.stackable.tech/secret-operator/secretclass.html)"
+                                      nullable: true
+                                      properties:
+                                        node:
+                                          default: false
+                                          type: boolean
+                                        pod:
+                                          default: false
+                                          type: boolean
+                                        services:
+                                          default: []
+                                          items:
+                                            type: string
+                                          type: array
+                                      type: object
+                                    secretClass:
+                                      description: "[SecretClass](https://docs.stackable.tech/secret-operator/secretclass.html) containing the LDAP bind credentials"
+                                      type: string
+                                  required:
+                                    - secretClass
+                                  type: object
+                                host:
+                                  description: Hostname of the S3 server without any protocol or port
+                                  nullable: true
+                                  type: string
+                                port:
+                                  description: Port the S3 server listens on. If not specified the products will determine the port to use.
+                                  format: uint16
+                                  minimum: 0.0
+                                  nullable: true
+                                  type: integer
+                                tls:
+                                  description: If you want to use TLS when talking to S3 you can enable TLS encrypted communication with this setting.
+                                  nullable: true
+                                  properties:
+                                    verification:
+                                      description: The verification method used to verify the certificates of the server and/or the client
+                                      oneOf:
+                                        - required:
+                                            - none
+                                        - required:
+                                            - server
+                                      properties:
+                                        none:
+                                          description: "Use TLS but don't verify certificates"
+                                          type: object
+                                        server:
+                                          description: Use TLS and ca certificate to verify the server
+                                          properties:
+                                            caCert:
+                                              description: Ca cert to verify the server
+                                              oneOf:
+                                                - required:
+                                                    - webPki
+                                                - required:
+                                                    - secretClass
+                                              properties:
+                                                secretClass:
+                                                  description: "Name of the SecretClass which will provide the ca cert. Note that a SecretClass does not need to have a key but can also work with just a ca cert. So if you got provided with a ca cert but don't have access to the key you can still use this method."
+                                                  type: string
+                                                webPki:
+                                                  description: Use TLS and the ca certificates trusted by the common web browsers to verify the server. This can be useful when you e.g. use public AWS S3 or other public available services.
+                                                  type: object
+                                              type: object
+                                          required:
+                                            - caCert
+                                          type: object
+                                      type: object
+                                  required:
+                                    - verification
+                                  type: object
+                              type: object
+                            reference:
+                              type: string
+                          type: object
+                      required:
+                        - metastore
+                      type: object
+                  type: object
+              required:
+                - connector
+              type: object
+          required:
+            - spec
+          title: TrinoCatalog
+          type: object
+      served: true
+      storage: true
+      subresources: {}

deploy/crd/trinocluster.crd.yaml

@@ -50,6 +50,37 @@ spec:
                   required:
                     - method
                   type: object
+                catalogLabelSelector:
+                  description: A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.
+                  nullable: true
+                  properties:
+                    matchExpressions:
+                      description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+                      items:
+                        description: "A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values."
+                        properties:
+                          key:
+                            description: key is the label key that the selector applies to.
+                            type: string
+                          operator:
+                            description: "operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist."
+                            type: string
+                          values:
+                            description: "values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch."
+                            items:
+                              type: string
+                            type: array
+                        required:
+                          - key
+                          - operator
+                        type: object
+                      type: array
+                    matchLabels:
+                      additionalProperties:
+                        type: string
+                      description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \"key\", the operator is \"In\", and the values array contains only \"value\". The requirements are ANDed."
+                      type: object
+                  type: object
                 coordinators:
                   nullable: true
                   properties:
@@ -157,9 +188,6 @@ spec:
                   required:
                     - roleGroups
                   type: object
-                hiveConfigMapName:
-                  nullable: true
-                  type: string
                 opa:
                   nullable: true
                   properties: