refactor: Build RBAC with recommended labels

CHANGELOG.md

@@ -9,8 +9,13 @@ All notable changes to this project will be documented in this file.
 - Internal operator refactoring: introduce a build() step in the reconciler that
   assembles all relevant Kubernetes resources before anything is applied ([#909]).
 - Bump `stackable-operator` to 0.114.0 ([#918]).
+- The RBAC ServiceAccount and RoleBinding are now built with the operator-rs `v2::rbac`
+  functions and carry the full set of recommended labels ([#913]).
+- BREAKING: The `coordinators` and `workers` roles are now required by the CRD.
+  Previously a TrinoCluster missing either role was accepted by the API server but failed reconciliation ([#913]).
 
 [#909]: https://github.com/stackabletech/trino-operator/pull/909
+[#913]: https://github.com/stackabletech/trino-operator/pull/913
 [#918]: https://github.com/stackabletech/trino-operator/pull/918
 
 ## [26.7.0] - 2026-07-21

Cargo.toml

@@ -29,5 +29,5 @@ tokio = { version = "1.52", features = ["full"] }
 tracing = "0.1"
 
 [patch."https://github.com/stackabletech/operator-rs.git"]
-# stackable-operator = { git = "https://github.com/stackabletech//operator-rs.git", branch = "smooth-operator"}
+# stackable-operator = { git = "https://github.com/stackabletech//operator-rs.git", branch = "main"}
 # stackable-operator = { path = "../operator-rs/crates/stackable-operator" }

extra/crds.yaml

@@ -973,7 +973,6 @@ spec:
                   at role level, the `roleConfig`.
                   You can learn more about this in the
                   [Roles and role group concept documentation](https://docs.stackable.tech/home/nightly/concepts/roles-and-role-groups).
-                nullable: true
                 properties:
                   cliOverrides:
                     additionalProperties:
@@ -2253,7 +2252,6 @@ spec:
                   at role level, the `roleConfig`.
                   You can learn more about this in the
                   [Roles and role group concept documentation](https://docs.stackable.tech/home/nightly/concepts/roles-and-role-groups).
-                nullable: true
                 properties:
                   cliOverrides:
                     additionalProperties:
@@ -3441,7 +3439,9 @@ spec:
                 type: object
             required:
             - clusterConfig
+            - coordinators
             - image
+            - workers
             type: object
           status:
             nullable: true

rust/operator-binary/src/config/jvm.rs

@@ -200,6 +200,10 @@ mod tests {
             roleGroups:
               default:
                 replicas: 1
+          workers:
+            roleGroups:
+              default:
+                replicas: 1
         "#;
         let jvm_config = construct_jvm_config(input);
 
@@ -259,6 +263,10 @@ mod tests {
                   add:
                     - -Xmx40000m
                     - -Dhttps.proxyPort=1234
+          workers:
+            roleGroups:
+              default:
+                replicas: 1
         "#;
         let jvm_config = construct_jvm_config(input);
 

rust/operator-binary/src/controller/build.rs

@@ -4,7 +4,10 @@ use std::str::FromStr;
 
 use snafu::{ResultExt, Snafu};
 use stackable_operator::{
-    utils::cluster_info::KubernetesClusterInfo, v2::types::operator::RoleGroupName,
+    builder::meta::ObjectMetaBuilder,
+    kvp::Labels,
+    utils::cluster_info::KubernetesClusterInfo,
+    v2::{builder::meta::ownerreference_from_resource, types::operator::RoleGroupName},
 };
 
 use crate::controller::{
@@ -13,6 +16,7 @@ use crate::controller::{
         config_map,
         listener::{build_group_listener, group_listener_name},
         pdb::build_pdb,
+        rbac::{build_role_binding, build_service_account},
         service::{
             build_rolegroup_headless_service, build_rolegroup_metrics_service,
             headless_service_ports,
@@ -52,13 +56,9 @@ pub enum Error {
 /// Does not need a Kubernetes client: every reference to another Kubernetes resource is already
 /// dereferenced and validated by this point, so the errors returned here are resource-assembly
 /// failures only.
-///
-/// `service_account_name` is the name of the RBAC `ServiceAccount` the role-group Pods run under
-/// (RBAC resources are built and applied separately, in the reconcile step).
 pub fn build(
     cluster: &ValidatedCluster,
     cluster_info: &KubernetesClusterInfo,
-    service_account_name: &str,
 ) -> Result<KubernetesResources, Error> {
     let mut stateful_sets = vec![];
     let mut services = vec![];
@@ -115,7 +115,6 @@ pub fn build(
                     role,
                     role_group_name,
                     role_group_config,
-                    service_account_name,
                 )
                 .context(StatefulSetSnafu {
                     role_group: role_group_name.clone(),
@@ -147,9 +146,30 @@ pub fn build(
         listeners,
         config_maps,
         pod_disruption_budgets,
+        service_accounts: vec![build_service_account(cluster)],
+        role_bindings: vec![build_role_binding(cluster)],
     })
 }
 
+/// Returns an [`ObjectMetaBuilder`] pre-filled with the cluster's namespace, an owner
+/// reference back to the cluster, the resource `name` and the given `recommended_labels`.
+///
+/// Consolidates the metadata chain repeated by the child-resource builders. Call sites that
+/// need extra labels/annotations chain them onto the returned builder.
+pub(crate) fn object_meta(
+    cluster: &ValidatedCluster,
+    name: impl Into<String>,
+    recommended_labels: Labels,
+) -> ObjectMetaBuilder {
+    let mut builder = ObjectMetaBuilder::new();
+    builder
+        .name_and_namespace(cluster)
+        .name(name)
+        .ownerreference(ownerreference_from_resource(cluster, None, Some(true)))
+        .with_labels(recommended_labels);
+    builder
+}
+
 #[cfg(test)]
 mod tests {
     use stackable_operator::{
@@ -177,8 +197,7 @@ mod tests {
                 .expect("cluster.local is a valid domain name"),
         };
 
-        let resources =
-            build(&cluster, &cluster_info, "simple-trino-serviceaccount").expect("build succeeds");
+        let resources = build(&cluster, &cluster_info).expect("build succeeds");
 
         // One StatefulSet per role group.
         assert_eq!(
@@ -218,5 +237,14 @@ mod tests {
             sorted_names(&resources.pod_disruption_budgets),
             ["simple-trino-coordinator", "simple-trino-worker"]
         );
+        // The cluster-shared RBAC pair.
+        assert_eq!(
+            sorted_names(&resources.service_accounts),
+            ["simple-trino-serviceaccount"]
+        );
+        assert_eq!(
+            sorted_names(&resources.role_bindings),
+            ["simple-trino-rolebinding"]
+        );
     }
 }

rust/operator-binary/src/controller/build/resource/config_map.rs

@@ -13,10 +13,13 @@ use crate::{
     config::jvm,
     controller::{
         RoleGroupName, ValidatedCluster,
-        build::properties::{
-            ConfigFileName, access_control_properties, config_properties,
-            exchange_manager_properties, log_properties, node_properties, product_logging,
-            security_properties, spooling_manager_properties,
+        build::{
+            object_meta,
+            properties::{
+                ConfigFileName, access_control_properties, config_properties,
+                exchange_manager_properties, log_properties, node_properties, product_logging,
+                security_properties, spooling_manager_properties,
+            },
         },
     },
     crd::TrinoRole,
@@ -74,7 +77,7 @@ pub fn build_rolegroup_config_map(
         })?;
 
     let config_map_name = cluster
-        .resource_names(role, role_group_name)
+        .role_group_resource_names(role, role_group_name)
         .role_group_config_map()
         .to_string();
 
@@ -164,7 +167,7 @@ pub fn build_rolegroup_config_map(
     // 8. jvm.config. The role + role-group `jvmArgumentOverrides` were already merged in the
     // validate step and are carried by `product_specific_common_config`.
     let jvm_config = jvm::jvm_config(
-        cluster.product_version,
+        cluster.numeric_product_version,
         &rg.config,
         &rg.product_specific_common_config.jvm_argument_overrides,
     )
@@ -181,11 +184,7 @@ pub fn build_rolegroup_config_map(
     }
 
     ConfigMapBuilder::new()
-        .metadata(
-            cluster
-                .object_meta(&config_map_name, recommended_labels.clone())
-                .build(),
-        )
+        .metadata(object_meta(cluster, &config_map_name, recommended_labels.clone()).build())
         .data(data)
         .build()
         .with_context(|_| AssembleSnafu {
@@ -204,9 +203,12 @@ pub fn build_rolegroup_catalog_config_map(
     let catalog_config_map_name = cluster.role_group_catalog_config_map_name(role, role_group_name);
     ConfigMapBuilder::new()
         .metadata(
-            cluster
-                .object_meta(&catalog_config_map_name, recommended_labels.clone())
-                .build(),
+            object_meta(
+                cluster,
+                &catalog_config_map_name,
+                recommended_labels.clone(),
+            )
+            .build(),
         )
         .data(
             cluster

rust/operator-binary/src/controller/build/resource/listener.rs

@@ -10,7 +10,10 @@ use stackable_operator::{
 };
 
 use crate::{
-    controller::{ValidatedCluster, build::ports},
+    controller::{
+        ValidatedCluster,
+        build::{object_meta, ports},
+    },
     crd::TrinoRole,
 };
 
@@ -32,9 +35,7 @@ pub fn build_group_listener(
     listener_group_name: String,
 ) -> Listener {
     Listener {
-        metadata: cluster
-            .object_meta(listener_group_name, recommended_labels)
-            .build(),
+        metadata: object_meta(cluster, listener_group_name, recommended_labels).build(),
         spec: ListenerSpec {
             class_name: Some(listener_class.to_string()),
             ports: Some(listener_ports(cluster)),

rust/operator-binary/src/controller/build/resource/mod.rs

@@ -7,5 +7,6 @@
 pub mod config_map;
 pub mod listener;
 pub mod pdb;
+pub mod rbac;
 pub mod service;
 pub mod statefulset;

rust/operator-binary/src/controller/build/resource/pdb.rs

@@ -1,4 +1,4 @@
-use std::{cmp::max, str::FromStr};
+use std::cmp::max;
 
 use stackable_operator::{
     commons::pdb::PdbConfig,
@@ -26,8 +26,7 @@ pub fn build_pdb(
         TrinoRole::Coordinator => max_unavailable_coordinators(),
         TrinoRole::Worker => max_unavailable_workers(worker_count(cluster)),
     });
-    let role_name =
-        RoleName::from_str(&role.to_string()).expect("a TrinoRole is a valid RFC 1123 role name");
+    let role_name: RoleName = role.into();
     let pdb = pod_disruption_budget_builder_with_role(
         cluster,
         &product_name(),