mod.rs

use std::{collections::BTreeSet, ops::Deref, str::FromStr};

use serde::{Deserialize, Serialize};
use snafu::{ResultExt, Snafu};
use stackable_operator::{
    commons::{
        affinity::StackableAffinity,
        cache::UserInformationCache,
        cluster_operation::ClusterOperation,
        opa::OpaConfig,
        product_image_selection::ProductImage,
        resources::{
            CpuLimitsFragment, MemoryLimitsFragment, NoRuntimeLimits, NoRuntimeLimitsFragment,
            Resources, ResourcesFragment,
        },
    },
    config::{
        fragment::{self, Fragment, ValidationError},
        merge::Merge,
    },
    constant,
    crd::git_sync,
    deep_merger::ObjectOverrides,
    k8s_openapi::{
        api::core::v1::{Volume, VolumeMount},
        apimachinery::pkg::api::resource::Quantity,
    },
    kube::{CustomResource, ResourceExt},
    memory::{BinaryMultiple, MemoryQuantity},
    product_logging::{
        self,
        framework::{create_vector_shutdown_file_command, remove_vector_shutdown_file_command},
        spec::Logging,
    },
    role_utils::GenericRoleConfig,
    schemars::{self, JsonSchema},
    shared::time::Duration,
    status::condition::{ClusterCondition, HasStatusCondition},
    utils::{COMMON_BASH_TRAP_FUNCTIONS, crds::raw_object_list_schema},
    v2::{
        config_overrides::KeyValueConfigOverrides,
        flask_config_writer::{FlaskAppConfigOptions, PythonType},
        product_logging::framework::STACKABLE_LOG_DIR,
        role_utils::{CommonConfiguration, GenericCommonConfig, Role, RoleGroup},
        types::{
            common::Port,
            kubernetes::{
                ConfigMapName, ContainerName, ListenerClassName, ListenerName,
                PersistentVolumeClaimName, SecretName, VolumeName,
            },
            operator::RoleName,
        },
    },
    versioned::versioned,
};
use strum::{Display, EnumIter, EnumString};

use crate::{
    controller::{ValidatedCluster, build::properties::ConfigFileName},
    crd::{
        affinity::{get_affinity, get_executor_affinity},
        authentication::{
            AirflowAuthenticationClassResolved, AirflowClientAuthenticationDetails,
            AirflowClientAuthenticationDetailsResolved,
        },
        databases::{
            CeleryBrokerConnection, CeleryResultBackendConnection, MetadataDatabaseConnection,
        },
        trusted_proxies::TrustedProxy,
    },
    util::role_service_name,
};

pub mod affinity;
pub mod authentication;
pub mod authorization;
pub mod databases;
pub mod internal_secret;
pub mod trusted_proxies;

pub const APP_NAME: &str = "airflow";
pub const FIELD_MANAGER: &str = "airflow-operator";
pub const AIRFLOW_OPERATOR_NAME: &str = "airflow.stackable.tech";
pub const CONFIG_PATH: &str = "/stackable/app/config";
pub const LOG_CONFIG_DIR: &str = "/stackable/app/log_config";
pub const AIRFLOW_HOME: &str = "/stackable/airflow";

constant!(pub TEMPLATE_VOLUME_NAME: VolumeName = "airflow-executor-pod-template");
pub const TEMPLATE_LOCATION: &str = "/templates";
pub const TEMPLATE_NAME: &str = "airflow_executor_pod_template.yaml";

constant!(pub LISTENER_PVC_NAME: PersistentVolumeClaimName = "listener");
pub const LISTENER_VOLUME_DIR: &str = "/stackable/listener";

pub const HTTP_PORT_NAME: &str = "http";
pub const HTTP_PORT: Port = Port(8080);
pub const METRICS_PORT_NAME: &str = "metrics";
pub const METRICS_PORT: Port = Port(9102);
// The metrics container has no logging configuration, so it is not a `Container` variant and
// carries its name directly.
constant!(pub METRICS_CONTAINER_NAME: ContainerName = "metrics");

const DEFAULT_AIRFLOW_GRACEFUL_SHUTDOWN_TIMEOUT: Duration = Duration::from_minutes_unchecked(2);
const DEFAULT_WORKER_GRACEFUL_SHUTDOWN_TIMEOUT: Duration = Duration::from_minutes_unchecked(5);

pub const MAX_LOG_FILES_SIZE: MemoryQuantity = MemoryQuantity {
    value: 10.0,
    unit: BinaryMultiple::Mebi,
};

constant!(WEBSERVER_ROLE_NAME: RoleName = "webserver");
constant!(SCHEDULER_ROLE_NAME: RoleName = "scheduler");
constant!(WORKER_ROLE_NAME: RoleName = "worker");
constant!(DAG_PROCESSOR_ROLE_NAME: RoleName = "dagprocessor");
constant!(TRIGGERER_ROLE_NAME: RoleName = "triggerer");

pub type AirflowRoleType =
    Role<AirflowConfigFragment, AirflowConfigOverrides, GenericRoleConfig, GenericCommonConfig>;

pub type AirflowExecutorCommonConfiguration =
    CommonConfiguration<ExecutorConfigFragment, GenericCommonConfig, AirflowConfigOverrides>;

pub type AirflowWebserverRoleType = Role<
    AirflowConfigFragment,
    AirflowConfigOverrides,
    v1alpha2::WebserverRoleConfig,
    GenericCommonConfig,
>;

#[derive(Clone, Debug, Default, Deserialize, Eq, JsonSchema, Merge, PartialEq, Serialize)]
#[serde(rename_all = "camelCase")]
pub struct AirflowConfigOverrides {
    #[serde(default, rename = "webserver_config.py")]
    pub webserver_config_py: KeyValueConfigOverrides,
}

#[derive(Snafu, Debug)]
pub enum Error {
    #[snafu(display("fragment validation failure"))]
    FragmentValidationFailure { source: ValidationError },
}

#[derive(Display, EnumIter, EnumString)]
#[strum(serialize_all = "SCREAMING_SNAKE_CASE")]
pub enum AirflowConfigOptions {
    AuthType,
    OauthProviders,
    AuthLdapSearch,
    AuthLdapSearchFilter,
    AuthLdapServer,
    AuthLdapUidField,
    AuthLdapBindUser,
    AuthLdapBindPassword,
    AuthUserRegistration,
    AuthUserRegistrationRole,
    AuthLdapFirstnameField,
    AuthLdapLastnameField,
    AuthLdapEmailField,
    AuthLdapGroupField,
    AuthRolesSyncAtLogin,
    AuthLdapTlsDemand,
    AuthLdapTlsCertfile,
    AuthLdapTlsKeyfile,
    AuthLdapTlsCacertfile,
    AuthLdapAllowSelfSigned,
    // OPA configs for Airflow 2
    // Airflow 3 configs need to be passed via env variables!
    // See `env_vars::authorization_env_vars` for details
    AuthOpaCacheMaxsize,
    AuthOpaCacheTtlInSec,
    AuthOpaRequestUrl,
    AuthOpaRequestTimeout,
}

impl FlaskAppConfigOptions for AirflowConfigOptions {
    fn python_type(&self) -> PythonType {
        match self {
            AirflowConfigOptions::AuthType => PythonType::Expression,
            AirflowConfigOptions::OauthProviders => PythonType::Expression,
            AirflowConfigOptions::AuthUserRegistration => PythonType::BoolLiteral,
            AirflowConfigOptions::AuthUserRegistrationRole => PythonType::StringLiteral,
            AirflowConfigOptions::AuthRolesSyncAtLogin => PythonType::BoolLiteral,
            AirflowConfigOptions::AuthLdapServer => PythonType::StringLiteral,
            AirflowConfigOptions::AuthLdapBindUser => PythonType::Expression,
            AirflowConfigOptions::AuthLdapBindPassword => PythonType::Expression,
            AirflowConfigOptions::AuthLdapSearch => PythonType::StringLiteral,
            AirflowConfigOptions::AuthLdapSearchFilter => PythonType::StringLiteral,
            AirflowConfigOptions::AuthLdapUidField => PythonType::StringLiteral,
            AirflowConfigOptions::AuthLdapGroupField => PythonType::StringLiteral,
            AirflowConfigOptions::AuthLdapFirstnameField => PythonType::StringLiteral,
            AirflowConfigOptions::AuthLdapLastnameField => PythonType::StringLiteral,
            AirflowConfigOptions::AuthLdapEmailField => PythonType::StringLiteral,
            AirflowConfigOptions::AuthLdapTlsDemand => PythonType::BoolLiteral,
            AirflowConfigOptions::AuthLdapTlsCertfile => PythonType::StringLiteral,
            AirflowConfigOptions::AuthLdapTlsKeyfile => PythonType::StringLiteral,
            AirflowConfigOptions::AuthLdapTlsCacertfile => PythonType::StringLiteral,
            AirflowConfigOptions::AuthLdapAllowSelfSigned => PythonType::BoolLiteral,
            AirflowConfigOptions::AuthOpaCacheMaxsize => PythonType::IntLiteral,
            AirflowConfigOptions::AuthOpaCacheTtlInSec => PythonType::IntLiteral,
            AirflowConfigOptions::AuthOpaRequestUrl => PythonType::StringLiteral,
            AirflowConfigOptions::AuthOpaRequestTimeout => PythonType::IntLiteral,
        }
    }
}

#[versioned(
    version(name = "v1alpha1"),
    version(name = "v1alpha2"),
    crates(
        kube_core = "stackable_operator::kube::core",
        kube_client = "stackable_operator::kube::client",
        k8s_openapi = "stackable_operator::k8s_openapi",
        schemars = "stackable_operator::schemars",
        versioned = "stackable_operator::versioned"
    )
)]
pub mod versioned {
    /// An Airflow cluster stacklet. This resource is managed by the Stackable operator for Apache Airflow.
    /// Find more information on how to use it and the resources that the operator generates in the
    /// [operator documentation](DOCS_BASE_URL_PLACEHOLDER/airflow/).
    ///
    /// The CRD contains three roles: webserver, scheduler and worker/celeryExecutor.
    /// You can use either the celeryExecutor or the kubernetesExecutor.
    #[versioned(crd(
        doc = "An Airflow cluster stacklet. This resource is managed by the Stackable operator for Apache Airflow.",
        group = "airflow.stackable.tech",
        plural = "airflowclusters",
        shortname = "airflow",
        status = "AirflowClusterStatus",
        namespaced,
    ))]
    #[derive(Clone, CustomResource, Debug, Deserialize, JsonSchema, PartialEq, Serialize)]
    #[serde(rename_all = "camelCase")]
    pub struct AirflowClusterSpec {
        // no doc string - See ProductImage struct
        pub image: ProductImage,

        /// Configuration that applies to all roles and role groups.
        /// This includes settings for authentication, git sync, service exposition and volumes, among other things.
        pub cluster_config: AirflowClusterConfig,

        // no doc string - See ClusterOperation struct
        #[serde(default)]
        pub cluster_operation: ClusterOperation,

        #[serde(default)]
        pub object_overrides: ObjectOverrides,

        /// The `webservers` role provides the main UI for user interaction.
        #[serde(default, skip_serializing_if = "Option::is_none")]
        pub webservers: Option<AirflowWebserverRoleType>,

        /// The `schedulers` is responsible for triggering jobs and persisting their metadata to the backend database.
        /// Jobs are scheduled on the workers/executors.
        #[serde(default, skip_serializing_if = "Option::is_none")]
        pub schedulers: Option<AirflowRoleType>,

        #[serde(flatten)]
        pub executor: AirflowExecutor,

        /// The `dagProcessors` role runs the DAG processor routine for DAG preparation.
        #[serde(default, skip_serializing_if = "Option::is_none")]
        pub dag_processors: Option<AirflowRoleType>,

        /// The `triggerers` role runs the triggerer process for use with deferrable DAG operators.
        #[serde(default, skip_serializing_if = "Option::is_none")]
        pub triggerers: Option<AirflowRoleType>,
    }

    #[derive(Clone, Deserialize, Debug, JsonSchema, PartialEq, Serialize)]
    #[serde(rename_all = "camelCase")]
    pub struct AirflowClusterConfig {
        #[serde(default)]
        pub authentication: Vec<AirflowClientAuthenticationDetails>,

        /// Authorization options.
        /// Learn more in the [Airflow authorization usage guide](DOCS_BASE_URL_PLACEHOLDER/airflow/usage-guide/security#_authorization).
        #[serde(skip_serializing_if = "Option::is_none")]
        pub authorization: Option<AirflowAuthorization>,

        /// Configure the database where Airflow stores all it's internal metadata
        pub metadata_database: MetadataDatabaseConnection,

        /// The name of the Secret object containing the admin user credentials. Read the
        /// [getting started guide first steps](DOCS_BASE_URL_PLACEHOLDER/airflow/getting_started/first_steps)
        /// to find out more.
        pub credentials_secret_name: SecretName,

        /// The `gitSync` settings allow configuring DAGs to mount via `git-sync`. Learn more in the
        /// [mounting DAGs documentation](DOCS_BASE_URL_PLACEHOLDER/airflow/usage-guide/mounting-dags#_via_git_sync).
        #[serde(default)]
        #[versioned(
            changed(since = "v1alpha2", from_type = "Vec<git_sync::v1alpha1::GitSync>"),
            hint(vec)
        )]
        pub dags_git_sync: Vec<git_sync::v1alpha2::GitSync>,

        /// For internal use only - not for production use.
        #[serde(default)]
        pub expose_config: bool,

        /// Whether to load example DAGs or not; defaults to false. The examples are used in the
        /// [getting started guide](DOCS_BASE_URL_PLACEHOLDER/airflow/getting_started/).
        #[serde(default)]
        pub load_examples: bool,

        /// Settings related to the database initialization routines (which are always executed by default).
        #[serde(default)]
        pub database_initialization: DatabaseInitializationConfig,

        #[serde(skip_serializing_if = "Option::is_none")]
        /// Connection information for the celery backend database.
        pub celery_results_backend: Option<CeleryResultBackendConnection>,

        #[serde(skip_serializing_if = "Option::is_none")]
        /// Connection information for the celery broker queue.
        pub celery_broker: Option<CeleryBrokerConnection>,

        /// Name of the Vector aggregator [discovery ConfigMap](DOCS_BASE_URL_PLACEHOLDER/concepts/service_discovery).
        /// It must contain the key `ADDRESS` with the address of the Vector aggregator.
        /// Follow the [logging tutorial](DOCS_BASE_URL_PLACEHOLDER/tutorials/logging-vector-aggregator)
        /// to learn how to configure log aggregation with Vector.
        #[serde(skip_serializing_if = "Option::is_none")]
        pub vector_aggregator_config_map_name: Option<ConfigMapName>,

        /// Additional volumes to define. Use together with `volumeMounts` to mount the volumes.
        #[serde(default)]
        #[schemars(schema_with = "raw_object_list_schema")]
        pub volumes: Vec<Volume>,

        /// Additional volumes to mount. Use together with `volumes` to define volumes.
        #[serde(default)]
        #[schemars(schema_with = "raw_object_list_schema")]
        pub volume_mounts: Vec<VolumeMount>,
    }
    // TODO: move generic version to op-rs?
    #[derive(Clone, Debug, Deserialize, JsonSchema, PartialEq, Serialize)]
    #[serde(rename_all = "camelCase")]
    pub struct WebserverRoleConfig {
        #[serde(flatten)]
        pub common: GenericRoleConfig,

        /// This field controls which [ListenerClass](https://docs.stackable.tech/home/nightly/listener-operator/listenerclass.html) is used to expose the webserver.
        #[serde(default = "webserver_default_listener_class")]
        pub listener_class: ListenerClassName,

        /// Enable trusted proxies when Airflow is deployed behind a reverse proxy like Istio or nginx.
        ///
        /// The reverse proxies whose `X-Forwarded-*` headers the webserver trusts, as IP addresses
        /// (`10.0.0.1`), CIDR networks (`10.244.0.0/16`), or `*` for every peer. `*` must be the
        /// only entry in the list if used: combining it with other entries is rejected, since it
        /// would silently degrade to trusting only those other entries.
        ///
        /// On Airflow 3.x this restricts trust to the listed peers. On 2.x it only switches
        /// forwarded-header handling on or off: any non-empty list trusts every peer, the same as
        /// `*`, since Airflow 2.x has no way to restrict it further.
        ///
        /// Leave this empty (the default) and forwarded headers are ignored entirely.
        #[serde(default)]
        pub trusted_proxies: Vec<String>,
    }
}

#[derive(Clone, Debug, Deserialize, JsonSchema, PartialEq, Serialize)]
#[serde(rename_all = "camelCase")]
pub struct DatabaseInitializationConfig {
    /// Whether to execute the database initialization routines (a combination of database initialization, upgrade and migration depending on the Airflow version). Defaults to true to be backwards-compatible.
    /// WARNING: setting this to false is *unsupported* as subsequent updates to the Airflow cluster may result in broken behaviour due to inconsistent metadata!
    /// Do not change the default unless you know what you are doing!
    #[serde(default = "default_db_init")]
    pub enabled: bool,
}

impl Default for DatabaseInitializationConfig {
    fn default() -> Self {
        Self {
            enabled: default_db_init(),
        }
    }
}

pub fn default_db_init() -> bool {
    true
}

impl Default for v1alpha2::WebserverRoleConfig {
    fn default() -> Self {
        v1alpha2::WebserverRoleConfig {
            listener_class: webserver_default_listener_class(),
            trusted_proxies: Vec::new(),
            common: Default::default(),
        }
    }
}

fn webserver_default_listener_class() -> ListenerClassName {
    ListenerClassName::from_str("cluster-internal")
        .expect("the default listener class is a valid listener class name")
}

#[derive(Clone, Debug, Default, Deserialize, JsonSchema, PartialEq, Eq, Serialize)]
#[serde(rename_all = "camelCase")]
pub struct AirflowClusterStatus {
    #[serde(default)]
    pub conditions: Vec<ClusterCondition>,
}

impl HasStatusCondition for v1alpha2::AirflowCluster {
    fn conditions(&self) -> Vec<ClusterCondition> {
        match &self.status {
            Some(status) => status.conditions.clone(),
            None => vec![],
        }
    }
}

impl v1alpha2::AirflowCluster {
    /// The name of the group-listener provided for a specific role.
    /// Webservers will use this group listener so that only one load balancer
    /// is needed for that role.
    pub fn group_listener_name(&self, role: &AirflowRole) -> Option<ListenerName> {
        match role {
            AirflowRole::Webserver => Some(
                ListenerName::from_str(&role_service_name(&self.name_any(), &role.to_string()))
                    .expect("the group listener name is a valid Listener name"),
            ),
            AirflowRole::Scheduler
            | AirflowRole::Worker
            | AirflowRole::DagProcessor
            | AirflowRole::Triggerer => None,
        }
    }

    /// the worker role will not be returned if airflow provisions pods as needed (i.e. when
    /// the kubernetes executor is specified)
    pub fn get_role(&self, role: &AirflowRole) -> Option<AirflowRoleType> {
        match role {
            AirflowRole::Webserver => self
                .spec
                .webservers
                .to_owned()
                .map(extract_role_from_webserver_config),
            AirflowRole::Scheduler => self.spec.schedulers.to_owned(),
            AirflowRole::DagProcessor => self.spec.dag_processors.to_owned(),
            AirflowRole::Triggerer => self.spec.triggerers.to_owned(),
            AirflowRole::Worker => {
                if let AirflowExecutor::CeleryExecutors { config, .. } = &self.spec.executor {
                    Some(*config.clone())
                } else {
                    None
                }
            }
        }
    }

    pub fn role_config(&self, role: &AirflowRole) -> Option<GenericRoleConfig> {
        self.get_role(role).map(|r| r.role_config)
    }

    /// Retrieve and merge resource configs for the executor template
    pub fn merged_executor_config(
        &self,
        config: &ExecutorConfigFragment,
    ) -> Result<ExecutorConfig, Error> {
        // use the worker defaults for executor pods
        let resources = default_resources(&AirflowRole::Worker);
        let logging = product_logging::spec::default_logging();
        let affinity = get_executor_affinity(&self.name_any());
        let graceful_shutdown_timeout = Some(DEFAULT_WORKER_GRACEFUL_SHUTDOWN_TIMEOUT);

        let executor_defaults = ExecutorConfigFragment {
            resources,
            logging,
            affinity,
            graceful_shutdown_timeout,
        };

        let mut conf_executor = config.to_owned();
        conf_executor.merge(&executor_defaults);

        tracing::debug!("Merged executor config: {:?}", conf_executor);
        fragment::validate(conf_executor).context(FragmentValidationFailureSnafu)
    }
}

fn extract_role_from_webserver_config(fragment: AirflowWebserverRoleType) -> AirflowRoleType {
    Role {
        config: CommonConfiguration {
            config: fragment.config.config,
            config_overrides: fragment.config.config_overrides,
            env_overrides: fragment.config.env_overrides,
            cli_overrides: fragment.config.cli_overrides,
            pod_overrides: fragment.config.pod_overrides,
            product_specific_common_config: fragment.config.product_specific_common_config,
        },
        role_config: fragment.role_config.common,
        role_groups: fragment
            .role_groups
            .into_iter()
            .map(|(k, v)| {
                (
                    k,
                    RoleGroup {
                        config: CommonConfiguration {
                            config: v.config.config,
                            config_overrides: v.config.config_overrides,
                            env_overrides: v.config.env_overrides,
                            cli_overrides: v.config.cli_overrides,
                            pod_overrides: v.config.pod_overrides,
                            product_specific_common_config: v.config.product_specific_common_config,
                        },
                        replicas: v.replicas,
                    },
                )
            })
            .collect(),
    }
}

#[derive(Clone, Debug, Deserialize, Eq, JsonSchema, PartialEq, Serialize)]
#[serde(rename_all = "camelCase")]
pub struct AirflowAuthorization {
    #[serde(skip_serializing_if = "Option::is_none")]
    pub opa: Option<AirflowOpaConfig>,
}

#[derive(Clone, Debug, Deserialize, Eq, JsonSchema, PartialEq, Serialize)]
#[serde(rename_all = "camelCase")]
pub struct AirflowOpaConfig {
    #[serde(flatten)]
    pub opa: OpaConfig,

    #[serde(default)]
    pub cache: UserInformationCache,
}

#[derive(Clone, Debug, EnumIter, Eq, Hash, Ord, PartialEq, PartialOrd)]
pub enum AirflowRole {
    Webserver,
    Scheduler,
    Worker,
    DagProcessor,
    Triggerer,
}

impl AirflowRole {
    /// Returns the start commands for the different airflow components. Airflow expects all
    /// components to have the same image/configuration (e.g. DAG folder location), even if not all
    /// configuration settings are used everywhere. For this reason we ensure that the webserver
    /// config file is in the Airflow home directory on all pods.
    /// Only the webserver needs to know about authentication CA's which is added via python's certify
    /// if authentication is enabled.
    pub fn get_commands(&self, cluster: &ValidatedCluster) -> Vec<String> {
        let auth_config = &cluster.cluster_config.authentication_config;
        let resolved_product_image = &cluster.image;
        let database_initialization_enabled =
            cluster.cluster_config.database_initialization_enabled;
        let has_dag_processors = cluster.has_role(&AirflowRole::DagProcessor);
        let webserver_config = ConfigFileName::WebserverConfig;

        let mut command = vec![
            format!("cp -RL {CONFIG_PATH}/{webserver_config} {AIRFLOW_HOME}/{webserver_config}"),
            // graceful shutdown part
            COMMON_BASH_TRAP_FUNCTIONS.to_string(),
            remove_vector_shutdown_file_command(STACKABLE_LOG_DIR),
        ];

        if resolved_product_image.product_version.starts_with("3.") {
            // Start-up commands have changed in 3.x.
            // See https://airflow.apache.org/docs/apache-airflow/3.0.1/installation/upgrading_to_airflow3.html#step-6-changes-to-your-startup-scripts and
            // https://airflow.apache.org/docs/apache-airflow/3.0.1/installation/setting-up-the-database.html#setting-up-the-database.
            // `airflow db migrate` is not run for each role so there may be
            // re-starts of webserver and/or workers (which require the DB).
            // DB-migrations should be eventually be optional:
            // See https://github.com/stackabletech/airflow-operator/issues/589.
            match &self {
                AirflowRole::Webserver => {
                    command.extend(Self::authentication_start_commands(auth_config));
                    command.extend(vec![
                        "prepare_signal_handlers".to_string(),
                        container_debug_command(),
                        format!(
                            "airflow api-server{} &",
                            self.proxy_headers_argument(cluster)
                        ),
                    ]);
                }
                AirflowRole::Scheduler => {
                    if database_initialization_enabled {
                        tracing::info!("Database initialization has been enabled.");
                        command.extend(vec![
                            "airflow db migrate".to_string(),
                            "airflow users create \
                            --username \"$ADMIN_USERNAME\" \
                            --firstname \"$ADMIN_FIRSTNAME\" \
                            --lastname \"$ADMIN_LASTNAME\" \
                            --email \"$ADMIN_EMAIL\" \
                            --password \"$ADMIN_PASSWORD\" \
                            --role \"Admin\""
                                .to_string(),
                        ]);
                    } else {
                        tracing::info!("Database initialization routines have been skipped!")
                    }
                    command.extend(vec![
                        "prepare_signal_handlers".to_string(),
                        container_debug_command(),
                    ]);
                    if !has_dag_processors {
                        // If no dag_processors role has been specified, the
                        // process needs to be included with the scheduler
                        // (with 3.x there is no longer the possibility of
                        // starting it as a subprocess, so it has to be
                        // explicitly started *somewhere*).
                        // It is started before the scheduler because the
                        // trailing `wait_for_termination $!` binds to the
                        // process that was backgrounded last, and that must be
                        // the scheduler.
                        command.extend(vec!["airflow dag-processor &".to_string()]);
                    }
                    command.extend(vec!["airflow scheduler &".to_string()]);
                }
                AirflowRole::DagProcessor => command.extend(vec![
                    "prepare_signal_handlers".to_string(),
                    container_debug_command(),
                    "airflow dag-processor &".to_string(),
                ]),
                AirflowRole::Triggerer => command.extend(vec![
                    "prepare_signal_handlers".to_string(),
                    container_debug_command(),
                    "airflow triggerer &".to_string(),
                ]),
                AirflowRole::Worker => command.extend(vec![
                    "prepare_signal_handlers".to_string(),
                    container_debug_command(),
                    "airflow celery worker &".to_string(),
                ]),
            }
        } else {
            match &self {
                AirflowRole::Webserver => {
                    // Getting auth commands for AuthClass
                    command.extend(Self::authentication_start_commands(auth_config));
                    command.extend(vec![
                        "prepare_signal_handlers".to_string(),
                        container_debug_command(),
                        "airflow webserver &".to_string(),
                    ]);
                }
                AirflowRole::Scheduler => {
                    if database_initialization_enabled {
                        tracing::info!("Database initialization has been enabled.");
                        command.extend(vec![
                            // Database initialization is limited to the scheduler, see https://github.com/stackabletech/airflow-operator/issues/259
                            "airflow db init".to_string(),
                            "airflow db upgrade".to_string(),
                            "airflow users create \
                            --username \"$ADMIN_USERNAME\" \
                            --firstname \"$ADMIN_FIRSTNAME\" \
                            --lastname \"$ADMIN_LASTNAME\" \
                            --email \"$ADMIN_EMAIL\" \
                            --password \"$ADMIN_PASSWORD\" \
                            --role \"Admin\""
                                .to_string(),
                        ]);
                    } else {
                        tracing::info!("Database initialization routines have been skipped!")
                    }
                    command.extend(vec![
                        "prepare_signal_handlers".to_string(),
                        container_debug_command(),
                        "airflow scheduler &".to_string(),
                    ]);
                }
                AirflowRole::DagProcessor => command.extend(vec![
                    "prepare_signal_handlers".to_string(),
                    container_debug_command(),
                    "airflow dag-processor &".to_string(),
                ]),
                AirflowRole::Triggerer => command.extend(vec![
                    "prepare_signal_handlers".to_string(),
                    container_debug_command(),
                    "airflow triggerer &".to_string(),
                ]),
                AirflowRole::Worker => command.extend(vec![
                    "prepare_signal_handlers".to_string(),
                    container_debug_command(),
                    "airflow celery worker &".to_string(),
                ]),
            }
        }

        // graceful shutdown part
        command.extend(vec![
            "wait_for_termination $!".to_string(),
            create_vector_shutdown_file_command(STACKABLE_LOG_DIR),
        ]);

        command
    }

    /// Add this CLI arg to enable proxy header support.
    /// Additional env vars are needed for the full functionality.
    /// See `env_vars::add_version_specific_env_vars` for the counterpart function.
    /// Only the webserver runs the api-server; every other role returns the empty string.
    fn proxy_headers_argument(&self, cluster: &ValidatedCluster) -> &'static str {
        if !matches!(self, AirflowRole::Webserver) {
            return "";
        }

        let has_trusted_proxies = cluster
            .role_configs
            .get(&AirflowRole::Webserver)
            .is_some_and(|role_config| !role_config.trusted_proxies.is_empty());

        if has_trusted_proxies {
            " --proxy-headers"
        } else {
            ""
        }
    }

    fn authentication_start_commands(
        auth_config: &AirflowClientAuthenticationDetailsResolved,
    ) -> Vec<String> {
        let mut commands = Vec::new();

        let mut tls_client_credentials = BTreeSet::new();

        for auth_class_resolved in &auth_config.authentication_classes_resolved {
            match auth_class_resolved {
                AirflowAuthenticationClassResolved::Oidc { provider, .. } => {
                    tls_client_credentials.insert(&provider.tls);

                    // WebPKI will be handled implicitly
                }
                AirflowAuthenticationClassResolved::Ldap { .. } => {}
            }
        }

        for tls in tls_client_credentials {
            commands.push(tls.tls_ca_cert_mount_path().map(|tls_ca_cert_mount_path| {
                Self::add_cert_to_python_certifi_command(&tls_ca_cert_mount_path)
            }));
        }

        commands.iter().flatten().cloned().collect::<Vec<_>>()
    }

    // Adding certificate to the mount path for airflow startup commands
    fn add_cert_to_python_certifi_command(cert_file: &str) -> String {
        format!("cat {cert_file} >> \"$(python -c 'import certifi; print(certifi.where())')\"")
    }

    /// Will be used to expose service ports and - by extension - which roles should be
    /// created as services.
    pub fn get_http_port(&self) -> Option<Port> {
        match &self {
            AirflowRole::Webserver => Some(HTTP_PORT),
            AirflowRole::Scheduler => None,
            AirflowRole::Worker => None,
            AirflowRole::DagProcessor => None,
            AirflowRole::Triggerer => None,
        }
    }

    pub fn listener_class_name(
        &self,
        airflow: &v1alpha2::AirflowCluster,
    ) -> Option<ListenerClassName> {
        match self {
            Self::Webserver => airflow
                .spec
                .webservers
                .to_owned()
                .map(|webserver| webserver.role_config.listener_class),
            Self::Worker | Self::Scheduler | Self::DagProcessor | Self::Triggerer => None,
        }
    }

    /// The reverse proxies this role trusts `X-Forwarded-*` headers from.
    ///
    /// Only the webserver serves HTTP, so every other role returns an empty list regardless of
    /// what the webserver role configured.
    pub fn trusted_proxies(
        &self,
        airflow: &v1alpha2::AirflowCluster,
    ) -> Result<Vec<TrustedProxy>, trusted_proxies::Error> {
        match self {
            Self::Webserver => {
                let entries: Vec<TrustedProxy> = airflow
                    .spec
                    .webservers
                    .iter()
                    .flat_map(|webserver| &webserver.role_config.trusted_proxies)
                    .map(|trusted_proxy| TrustedProxy::from_str(trusted_proxy))
                    .collect::<Result<_, _>>()?;
                trusted_proxies::ensure_wildcard_is_sole_entry(&entries)?;
                Ok(entries)
            }
            Self::Worker | Self::Scheduler | Self::DagProcessor | Self::Triggerer => Ok(Vec::new()),
        }
    }
}

impl Deref for AirflowRole {
    type Target = RoleName;

    fn deref(&self) -> &Self::Target {
        match self {
            AirflowRole::Webserver => &WEBSERVER_ROLE_NAME,
            AirflowRole::Scheduler => &SCHEDULER_ROLE_NAME,
            AirflowRole::Worker => &WORKER_ROLE_NAME,
            AirflowRole::DagProcessor => &DAG_PROCESSOR_ROLE_NAME,
            AirflowRole::Triggerer => &TRIGGERER_ROLE_NAME,
        }
    }
}

fn container_debug_command() -> String {
    format!("containerdebug --output={STACKABLE_LOG_DIR}/containerdebug-state.json --loop &")
}

#[derive(Clone, Debug, Deserialize, JsonSchema, PartialEq, Serialize)]
#[serde(rename_all = "camelCase")]
pub enum AirflowExecutor {
    /// The celery executor.
    /// Deployed with an explicit number of replicas.
    #[serde(rename_all = "camelCase")]
    CeleryExecutors {
        #[serde(flatten)]
        config: Box<AirflowRoleType>,
    },

    /// With the Kubernetes executor, executor Pods are created on demand.
    KubernetesExecutors {
        #[serde(flatten)]
        common_configuration: Box<AirflowExecutorCommonConfiguration>,
    },
}

impl AirflowExecutor {
    /// Name of the executor as expected to be passed via `AIRFLOW__CORE__EXECUTOR`
    pub fn as_airflow_core_executor(&self) -> &'static str {
        match self {
            AirflowExecutor::CeleryExecutors { .. } => "CeleryExecutor",
            AirflowExecutor::KubernetesExecutors { .. } => "KubernetesExecutor",
        }
    }
}

#[allow(clippy::derive_partial_eq_without_eq)]
#[derive(Clone, Debug, Default, JsonSchema, PartialEq, Fragment)]
#[fragment_attrs(
    allow(clippy::derive_partial_eq_without_eq),
    derive(
        Clone,
        Debug,
        Default,
        Deserialize,
        Merge,
        JsonSchema,
        PartialEq,
        Serialize
    ),
    serde(rename_all = "camelCase")
)]
pub struct AirflowStorageConfig {}

#[derive(
    Clone,
    Debug,
    Deserialize,
    Display,
    Eq,
    EnumIter,
    JsonSchema,
    Ord,
    PartialEq,
    PartialOrd,
    Serialize,
)]
#[serde(rename_all = "kebab-case")]
#[strum(serialize_all = "kebab-case")]
pub enum Container {
    Airflow,
    Vector,
    Base,
    GitSync,
}

// Typed container names. They must match the strum `Display` (kebab-case) of the variants above,
// which is pinned by a unit test.
constant!(AIRFLOW_CONTAINER_NAME: ContainerName = "airflow");
constant!(VECTOR_CONTAINER_NAME: ContainerName = "vector");
constant!(BASE_CONTAINER_NAME: ContainerName = "base");
constant!(GIT_SYNC_CONTAINER_NAME: ContainerName = "git-sync");

impl Container {
    /// The typed container name of this variant.
    pub fn name(&self) -> &'static ContainerName {
        match self {
            Container::Airflow => &AIRFLOW_CONTAINER_NAME,
            Container::Vector => &VECTOR_CONTAINER_NAME,
            Container::Base => &BASE_CONTAINER_NAME,
            Container::GitSync => &GIT_SYNC_CONTAINER_NAME,
        }
    }
}

#[derive(Clone, Debug, Default, Fragment, JsonSchema, PartialEq)]
#[fragment_attrs(
    derive(
        Clone,
        Debug,
        Default,
        Deserialize,
        Merge,
        JsonSchema,
        PartialEq,
        Serialize
    ),
    serde(rename_all = "camelCase")
)]
pub struct ExecutorConfig {
    #[fragment_attrs(serde(default))]
    pub resources: Resources<AirflowStorageConfig, NoRuntimeLimits>,

    #[fragment_attrs(serde(default))]
    pub logging: Logging<Container>,

    #[fragment_attrs(serde(default))]
    pub affinity: StackableAffinity,

    /// Time period Pods have to gracefully shut down, e.g. `30m`, `1h` or `2d`. Consult the operator documentation for details.
    #[fragment_attrs(serde(default))]
    pub graceful_shutdown_timeout: Option<Duration>,
}

#[derive(Clone, Debug, Default, Fragment, JsonSchema, PartialEq)]
#[fragment_attrs(
    derive(
        Clone,
        Debug,
        Default,
        Deserialize,
        Merge,
        JsonSchema,
        PartialEq,
        Serialize
    ),
    serde(rename_all = "camelCase")
)]
pub struct AirflowConfig {
    #[fragment_attrs(serde(default))]
    pub resources: Resources<AirflowStorageConfig, NoRuntimeLimits>,

    #[fragment_attrs(serde(default))]
    pub logging: Logging<Container>,

    #[fragment_attrs(serde(default))]
    pub affinity: StackableAffinity,

    /// Time period Pods have to gracefully shut down, e.g. `30m`, `1h` or `2d`. Consult the operator documentation for details.
    #[fragment_attrs(serde(default))]
    pub graceful_shutdown_timeout: Option<Duration>,
}

impl AirflowConfig {
    pub(crate) fn default_config(cluster_name: &str, role: &AirflowRole) -> AirflowConfigFragment {
        AirflowConfigFragment {
            resources: default_resources(role),
            logging: product_logging::spec::default_logging(),
            affinity: get_affinity(cluster_name, role),
            graceful_shutdown_timeout: Some(match role {
                AirflowRole::Webserver
                | AirflowRole::Scheduler
                | AirflowRole::DagProcessor
                | AirflowRole::Triggerer => DEFAULT_AIRFLOW_GRACEFUL_SHUTDOWN_TIMEOUT,
                AirflowRole::Worker => DEFAULT_WORKER_GRACEFUL_SHUTDOWN_TIMEOUT,
            }),
        }
    }
}

fn default_resources(role: &AirflowRole) -> ResourcesFragment<AirflowStorageConfig> {
    let (cpu, memory) = match role {
        AirflowRole::Worker => (
            CpuLimitsFragment {
                min: Some(Quantity("1".into())),
                max: Some(Quantity("2".into())),
            },
            MemoryLimitsFragment {
                limit: Some(Quantity("3Gi".into())),
                runtime_limits: NoRuntimeLimitsFragment {},
            },
        ),
        AirflowRole::Webserver => (
            CpuLimitsFragment {
                min: Some(Quantity("1".into())),
                max: Some(Quantity("2".into())),
            },
            MemoryLimitsFragment {
                limit: Some(Quantity("3Gi".into())),
                runtime_limits: NoRuntimeLimitsFragment {},
            },
        ),
        AirflowRole::Scheduler => (
            CpuLimitsFragment {
                min: Some(Quantity("1".to_owned())),
                max: Some(Quantity("2".to_owned())),
            },
            MemoryLimitsFragment {
                limit: Some(Quantity("1.5Gi".to_owned())),
                runtime_limits: NoRuntimeLimitsFragment {},
            },
        ),
        AirflowRole::DagProcessor => (
            CpuLimitsFragment {
                min: Some(Quantity("1".to_owned())),
                max: Some(Quantity("2".to_owned())),
            },
            MemoryLimitsFragment {
                limit: Some(Quantity("1Gi".to_owned())),
                runtime_limits: NoRuntimeLimitsFragment {},
            },
        ),
        AirflowRole::Triggerer => (
            CpuLimitsFragment {
                min: Some(Quantity("1".to_owned())),
                max: Some(Quantity("2".to_owned())),
            },
            MemoryLimitsFragment {
                limit: Some(Quantity("1Gi".to_owned())),
                runtime_limits: NoRuntimeLimitsFragment {},
            },
        ),
    };

    ResourcesFragment {
        cpu,
        memory,
        storage: AirflowStorageConfigFragment {},
    }
}

#[cfg(test)]
mod tests {
    use indoc::formatdoc;
    use stackable_operator::{
        commons::product_image_selection::ResolvedProductImage,
        versioned::test_utils::RoundtripTestData,
    };
    use strum::IntoEnumIterator;

    use super::*;
    use crate::{
        controller::build::test_support::{validated_cluster, validated_cluster_with},
        v1alpha1, v1alpha2,
    };

    #[test]
    fn test_constants() {
        // Test that dereferencing the constants does not panic.
        let _ = *WEBSERVER_ROLE_NAME;
        let _ = *SCHEDULER_ROLE_NAME;
        let _ = *WORKER_ROLE_NAME;
        let _ = *DAG_PROCESSOR_ROLE_NAME;
        let _ = *TRIGGERER_ROLE_NAME;
        let _ = *TEMPLATE_VOLUME_NAME;
        let _ = *LISTENER_PVC_NAME;
        let _ = *METRICS_CONTAINER_NAME;
        let _ = *AIRFLOW_CONTAINER_NAME;
        let _ = *VECTOR_CONTAINER_NAME;
        let _ = *BASE_CONTAINER_NAME;
        let _ = *GIT_SYNC_CONTAINER_NAME;
    }

    /// The typed container names returned by `name` must agree with the strum `Display`
    /// of `Container`, which the logging configuration still uses as the per-container key.
    #[test]
    fn container_names_match_display() {
        for container in Container::iter() {
            assert_eq!(container.name().to_string(), container.to_string());
        }
    }

    #[test]
    fn test_cluster_config() {
        let cluster = "
        apiVersion: airflow.stackable.tech/v1alpha2
        kind: AirflowCluster
        metadata:
          name: airflow
        spec:
          image:
            productVersion: 3.1.6
          clusterConfig:
            loadExamples: true
            exposeConfig: true
            credentialsSecretName: airflow-admin-credentials
            metadataDatabase:
              postgresql:
                host: airflow-postgresql
                database: airflow
                credentialsSecretName: airflow-postgresql-credentials
          webservers:
            roleGroups:
              default:
                config: {}
          kubernetesExecutors:
            config: {}
          schedulers:
            roleGroups:
              default:
                config: {}
          ";

        let deserializer = serde_yaml::Deserializer::from_str(cluster);
        let cluster: v1alpha2::AirflowCluster =
            serde_yaml::with::singleton_map_recursive::deserialize(deserializer).unwrap();

        let resolved_airflow_image: ResolvedProductImage = cluster
            .spec
            .image
            .resolve("airflow", "oci.example.org", "0.0.0-dev")
            .expect("test: resolved product image is always valid");

        assert_eq!("3.1.6", &resolved_airflow_image.product_version);

        assert_eq!(
            "KubernetesExecutor",
            cluster.spec.executor.as_airflow_core_executor()
        );
        assert!(cluster.spec.cluster_config.load_examples);
        assert!(cluster.spec.cluster_config.expose_config);
        // defaults to true
        assert!(cluster.spec.cluster_config.database_initialization.enabled);
    }

    #[test]
    fn webserver_role_config_defaults_to_no_trusted_proxies() {
        let role_config: v1alpha2::WebserverRoleConfig =
            serde_yaml::from_str("listenerClass: external-stable")
                .expect("the role config deserialises");

        assert!(role_config.trusted_proxies.is_empty());
    }

    #[test]
    fn webserver_role_config_accepts_trusted_proxies() {
        let role_config: v1alpha2::WebserverRoleConfig = serde_yaml::from_str(
            "
            trustedProxies:
              - 10.244.0.0/16
              - 192.168.1.1
            ",
        )
        .expect("the role config deserialises");

        assert_eq!(
            role_config.trusted_proxies,
            ["10.244.0.0/16", "192.168.1.1"]
        );
    }

    /// A cluster CR with the given `webservers.roleConfig` block spliced in.
    fn test_cluster_with_webserver_role_config(role_config: &str) -> v1alpha2::AirflowCluster {
        let cluster = formatdoc! {"
            apiVersion: airflow.stackable.tech/v1alpha2
            kind: AirflowCluster
            metadata:
              name: airflow
            spec:
              image:
                productVersion: 3.2.2
              clusterConfig:
                credentialsSecretName: airflow-admin-credentials
                metadataDatabase:
                  postgresql:
                    host: airflow-postgresql
                    database: airflow
                    credentialsSecretName: airflow-postgresql-credentials
              webservers:
                roleConfig:
            {role_config}
                roleGroups:
                  default:
                    config: {{}}
              kubernetesExecutors:
                config: {{}}
        "};

        let deserializer = serde_yaml::Deserializer::from_str(&cluster);
        serde_yaml::with::singleton_map_recursive::deserialize(deserializer)
            .expect("the test CR deserialises")
    }

    #[test]
    fn webserver_trusted_proxies_are_parsed() {
        let cluster = test_cluster_with_webserver_role_config(
            "      trustedProxies:\n        - 10.244.0.0/16\n        - 192.168.1.1",
        );

        let trusted_proxies = AirflowRole::Webserver
            .trusted_proxies(&cluster)
            .expect("the trusted proxies are valid");

        let rendered: Vec<String> = trusted_proxies
            .iter()
            .map(TrustedProxy::to_string)
            .collect();
        assert_eq!(rendered, ["10.244.0.0/16", "192.168.1.1"]);
    }

    #[test]
    fn wildcard_combined_with_another_entry_is_rejected() {
        let cluster = test_cluster_with_webserver_role_config(
            "      trustedProxies:\n        - \"*\"\n        - 10.0.0.0/8",
        );

        let error = AirflowRole::Webserver
            .trusted_proxies(&cluster)
            .expect_err("* combined with another entry must be rejected");
        assert!(
            matches!(
                error,
                crate::crd::trusted_proxies::Error::WildcardMustBeSoleEntry
            ),
            "error was: {error:?}"
        );
    }

    #[test]
    fn an_invalid_trusted_proxy_is_rejected() {
        let cluster = test_cluster_with_webserver_role_config(
            "      trustedProxies:\n        - airflow.example.com",
        );

        AirflowRole::Webserver
            .trusted_proxies(&cluster)
            .expect_err("a hostname is not a valid trusted proxy");
    }

    /// Only the webserver serves HTTP, so no other role may pick the setting up even if a
    /// webserver configured it.
    #[test]
    fn non_webserver_roles_have_no_trusted_proxies() {
        let cluster = test_cluster_with_webserver_role_config(
            "      trustedProxies:\n        - 10.244.0.0/16",
        );

        for role in [
            AirflowRole::Scheduler,
            AirflowRole::Worker,
            AirflowRole::DagProcessor,
            AirflowRole::Triggerer,
        ] {
            assert!(
                role.trusted_proxies(&cluster)
                    .expect("no proxies to parse")
                    .is_empty(),
                "role {role:?} must not have trusted proxies"
            );
        }
    }

    #[test]
    fn a_webserver_without_trusted_proxies_yields_an_empty_list() {
        let cluster =
            test_cluster_with_webserver_role_config("      listenerClass: external-stable");

        assert!(
            AirflowRole::Webserver
                .trusted_proxies(&cluster)
                .expect("nothing to parse")
                .is_empty()
        );
    }

    /// The commands that background a process, i.e. the candidates for `$!`.
    fn backgrounded_commands(role: &AirflowRole, cluster: &ValidatedCluster) -> Vec<String> {
        role.get_commands(cluster)
            .into_iter()
            .filter(|command| command.ends_with(" &"))
            .collect()
    }

    #[test]
    fn every_role_backgrounds_its_own_process_last() {
        let cluster = validated_cluster("kubernetesExecutors", "{config: {}}");

        assert!(
            cluster.image.product_version.starts_with("3."),
            "the test cluster must run Airflow 3.x for this to test anything"
        );
        assert!(!cluster.has_role(&AirflowRole::DagProcessor));

        for role in AirflowRole::iter() {
            let own_process = match role {
                AirflowRole::Webserver => "airflow api-server &",
                AirflowRole::Scheduler => "airflow scheduler &",
                AirflowRole::Worker => "airflow celery worker &",
                AirflowRole::DagProcessor => "airflow dag-processor &",
                AirflowRole::Triggerer => "airflow triggerer &",
            };

            assert_eq!(
                backgrounded_commands(&role, &cluster).last(),
                Some(&own_process.to_string()),
                "{role:?} must background its own process last"
            );
        }
    }

    #[test]
    fn a_scheduler_without_a_dag_processor_role_starts_the_dag_processor() {
        let cluster = validated_cluster("kubernetesExecutors", "{config: {}}");
        let backgrounded = backgrounded_commands(&AirflowRole::Scheduler, &cluster);

        assert!(
            backgrounded.contains(&"airflow dag-processor &".to_string()),
            "the scheduler must start the dag-processor, but backgrounds only: {backgrounded:?}"
        );
    }

    #[test]
    fn a_scheduler_with_a_dag_processor_role_does_not_start_the_dag_processor() {
        let cluster = validated_cluster_with("kubernetesExecutors", "{config: {}}", |cluster| {
            cluster["spec"]
                .as_mapping_mut()
                .expect("the test CR has a spec mapping")
                .insert(
                    "dagProcessors".into(),
                    serde_yaml::from_str("{config: {}, roleGroups: {default: {config: {}}}}")
                        .expect("the dag-processor role is valid YAML"),
                );
        });

        assert!(
            cluster.has_role(&AirflowRole::DagProcessor),
            "the fixture must declare a dag-processor role for this to test anything"
        );

        let backgrounded = backgrounded_commands(&AirflowRole::Scheduler, &cluster);

        assert!(
            !backgrounded.contains(&"airflow dag-processor &".to_string()),
            "the dedicated dag-processor role runs the process, so the scheduler must not \
             start a second one, but backgrounds: {backgrounded:?}"
        );
    }

    impl RoundtripTestData for v1alpha1::AirflowClusterSpec {
        fn roundtrip_test_data() -> Vec<Self> {
            let git_sync_section = r#"
    dagsGitSync:
      - repo: ssh://git@github.com/stackable-airflow/dags.git
      - repo: https://github.com/stackable-airflow/dags
        branch: main
        credentialsSecret: my-basic-auth
        wait: 5s
        gitSyncConf:
          foo: bar
        gitFolder: "mount-dags-gitsync/dags_airflow3"
        tls:
          verification:
            server:
              caCert:
                secretClass: git-ca-cert
      - repo: ssh://git@github.com/stackable-airflow/dags.git
    "#;
            let yaml = test_airflow_cluster_yaml(git_sync_section);
            stackable_operator::utils::yaml_from_str_singleton_map(&yaml)
                .expect("Failed to parse AirflowClusterSpec YAML")
        }
    }

    // FIXME: The roundtrip looses data when private keys are used.
    // See https://github.com/stackabletech/issues/issues/849 for details.
    impl RoundtripTestData for v1alpha2::AirflowClusterSpec {
        fn roundtrip_test_data() -> Vec<Self> {
            let git_sync_section = r#"
    dagsGitSync:
      - repo: ssh://git@github.com/stackable-airflow/dags.git
      - repo: https://github.com/stackable-airflow/dags
        branch: main
        credentials:
          basicAuthSecretName: my-basic-auth
        wait: 5s
        gitSyncConf:
          foo: bar
        gitFolder: "mount-dags-gitsync/dags_airflow3"
        tls:
          verification:
            server:
              caCert:
                secretClass: git-ca-cert
      - repo: ssh://git@github.com/stackable-airflow/dags.git
        # FIXME: The roundtrip looses data when private keys are used.
        # See https://github.com/stackabletech/issues/issues/849 for details.
        # credentials:
        #   sshPrivateKeySecretName: my-private-key
    "#;
            let yaml = test_airflow_cluster_yaml(git_sync_section);
            stackable_operator::utils::yaml_from_str_singleton_map(&yaml)
                .expect("Failed to parse AirflowClusterSpec YAML")
        }
    }

    fn test_airflow_cluster_yaml(git_sync_section: &str) -> String {
        formatdoc! {
          r#"
            - image:
                productVersion: 1.2.3
                pullPolicy: IfNotPresent
              clusterConfig:
                vectorAggregatorConfigMapName: vector-aggregator-discovery
                loadExamples: true
                credentialsSecretName: airflow-admin-credentials
                metadataDatabase:
                  postgresql:
                    host: airflow-postgresql
                    database: airflow
                    credentialsSecretName: airflow-postgresql-credentials
                celeryResultsBackend:
                  postgresql:
                    host: airflow-postgresql
                    database: airflow
                    credentialsSecretName: airflow-postgresql-credentials
                celeryBroker:
                  redis:
                    host: airflow-redis-master
                    credentialsSecretName: airflow-redis-credentials
                authentication:
                  - authenticationClass: my-ldap
                    userRegistrationRole: Admin
                authorization:
                  opa:
                    configMapName: test-opa
                    package: airflow
                    cache:
                      entryTimeToLive: 5s
                      maxEntries: 10
                volumes:
                  - name: test-cm-dag
                    configMap:
                      name: test-cm-dag
                volumeMounts:
                  - name: test-cm-dag
                    mountPath: /dags/example_trigger_target_dag.py
                    subPath: example_trigger_target_dag.py
                {git_sync_section}
              webservers:
                roleConfig:
                  listenerClass: external-unstable
                config:
                  resources:
                    cpu:
                      min: 100m
                      max: "1"
                    memory:
                      limit: 3001Mi
                  logging:
                    enableVectorAgent: true
                configOverrides:
                  webserver_config.py:
                    FILE_HEADER: |
                      COMMON_HEADER_VAR = "role-value"
                      ROLE_HEADER_VAR = "role-value"
                    FILE_FOOTER: |
                      ROLE_FOOTER_VAR = "role-value"
                podOverrides:
                  spec:
                    containers:
                      - name: airflow
                        resources:
                          requests:
                            cpu: 300m
                          limits:
                            cpu: 900m
                roleGroups:
                  default:
                    replicas: 1
                    configOverrides:
                      webserver_config.py:
                        FILE_HEADER: |
                          COMMON_HEADER_VAR = "group-value"
              celeryExecutors:
                config:
                  logging:
                    enableVectorAgent: true
                roleGroups:
                  default:
                    replicas: 2
              kubernetesExecutors:
                config:
                  logging:
                    enableVectorAgent: true
              schedulers:
                config:
                  logging:
                    enableVectorAgent: true
                roleGroups:
                  default:
                    replicas: 1
              dagProcessors:
                config:
                  logging:
                    enableVectorAgent: true
                roleGroups:
                  default:
                    replicas: 1
              triggerers:
                config:
                  logging:
                    enableVectorAgent: true
                roleGroups:
                  default:
                    replicas: 1
                "#
        }
    }
}