fix: address v0.1.0 release review findings

- fix(client): clone http.DefaultTransport to avoid connection pool leak
  when TLS skip-verify is enabled (closes #112)
- fix(platform): require credentials for external TimeSeries/Search
  instead of silently auto-generating random ones (closes #113)
- fix(platform): tighten nil-server guard to only apply to internal
  components; external components without a Server are valid (closes #114)
- fix(backups): log validation error before early return on mutual
  exclusion of tables/keyspaces (closes #115)
- test: update platform controller tests to assert MissingExternalCredentials
  condition for external components with no auth configured

Author: digiserg

internal/axonops/client.go

@@ -191,10 +191,23 @@ func NewClient(host, protocol, orgID, apiKey, tokenType string, tlsSkipVerify bo
 
 	baseURL := fmt.Sprintf("%s://%s", protocol, host)
 
-	var transport http.RoundTripper = &http.Transport{
-		TLSClientConfig: &tls.Config{
-			InsecureSkipVerify: tlsSkipVerify,
-		},
+	// Clone http.DefaultTransport to inherit connection pool settings (MaxIdleConns,
+	// IdleConnTimeout, TLSHandshakeTimeout, DialContext, etc.) while overriding only
+	// the TLS config. A bare &http.Transport{} has no idle-connection timeout, so
+	// abandoned transports (one is created per reconcile) accumulate open sockets.
+	var transport http.RoundTripper
+	if dt, ok := http.DefaultTransport.(*http.Transport); ok {
+		cloned := dt.Clone()
+		cloned.TLSClientConfig = &tls.Config{
+			InsecureSkipVerify: tlsSkipVerify, //nolint:gosec // controlled by user-facing field TLSSkipVerify
+		}
+		transport = cloned
+	} else {
+		transport = &http.Transport{
+			TLSClientConfig: &tls.Config{
+				InsecureSkipVerify: tlsSkipVerify, //nolint:gosec
+			},
+		}
 	}
 	if o.verbose {
 		transport = &verboseTransport{base: transport}

internal/controller/axonopsplatform_controller.go

@@ -331,6 +331,37 @@ func (r *AxonOpsPlatformReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 		}
 	}
 
+	// Validate that internal database components are not enabled without the server component.
+	// External components (with spec.*.external.hosts) are already-running services; the operator
+	// only writes connection references for them, so they do not require a Server to be present.
+	// Internal (operator-managed) TimeSeries and Search exist solely to be consumed by the Server;
+	// enabling them without a Server produces a confusing partial state.
+	internalTSEnabled := r.isComponentEnabled(server.Spec.TimeSeries) && !isTimeSeriesExternal(server)
+	internalSearchEnabled := r.isComponentEnabled(server.Spec.Search) && !isSearchExternal(server)
+	if !r.isComponentEnabled(server.Spec.Server) && (internalTSEnabled || internalSearchEnabled) {
+		var components []string
+		if internalTSEnabled {
+			components = append(components, "timeSeries")
+		}
+		if internalSearchEnabled {
+			components = append(components, "search")
+		}
+		msg := fmt.Sprintf("spec.server must be configured when %s is enabled", strings.Join(components, " and "))
+		log.Info("Invalid configuration: database components require server", "components", components)
+		meta.SetStatusCondition(&server.Status.Conditions, metav1.Condition{
+			Type:               "Ready",
+			Status:             metav1.ConditionFalse,
+			ObservedGeneration: server.Generation,
+			Reason:             "InvalidConfiguration",
+			Message:            msg,
+		})
+		server.Status.ObservedGeneration = server.Generation
+		if err := r.Status().Update(ctx, server); err != nil {
+			log.Error(err, "Failed to update status for invalid configuration")
+		}
+		return ctrl.Result{}, nil
+	}
+
 	// Verify cert-manager CRDs are available (only needed for internal database/workload resources)
 	if needsInternalResources(server) {
 		if !r.isCertManagerAvailable() {
@@ -397,10 +428,30 @@ func (r *AxonOpsPlatformReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 				return ctrl.Result{}, err
 			}
 
+			// External databases require explicit credentials — auto-generating random
+			// credentials would cause permanent authentication failures since the operator
+			// cannot know what credentials the existing cluster was provisioned with.
+			tsAuth := server.Spec.TimeSeries.Authentication
+			if tsAuth.SecretRef == "" && tsAuth.Username == "" {
+				msg := "external TimeSeries requires credentials: set spec.timeSeries.authentication.secretRef or spec.timeSeries.authentication.username/password"
+				log.Info("Missing external TimeSeries credentials", "message", msg)
+				meta.SetStatusCondition(&server.Status.Conditions, metav1.Condition{
+					Type:               "Ready",
+					Status:             metav1.ConditionFalse,
+					ObservedGeneration: server.Generation,
+					Reason:             "MissingExternalCredentials",
+					Message:            msg,
+				})
+				server.Status.ObservedGeneration = server.Generation
+				if statusErr := r.Status().Update(ctx, server); statusErr != nil {
+					log.Error(statusErr, "Failed to update status")
+				}
+				return ctrl.Result{RequeueAfter: 30 * time.Second}, nil
+			}
+
 			// Ensure authentication secret for external TimeSeries.
 			// ensureAuthenticationSecret handles all cases: SecretRef (validates it),
-			// inline username/password (creates a managed Secret), and no credentials
-			// (auto-generates into a managed Secret).
+			// inline username/password (creates a managed Secret).
 			var err error
 			timeSeriesSecretName, _, err = r.ensureAuthenticationSecret(ctx, server, componentTimeseries, server.Spec.TimeSeries.Authentication, server.Spec.TimeSeries.StorageConfig)
 			if err != nil {
@@ -447,10 +498,30 @@ func (r *AxonOpsPlatformReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 				return ctrl.Result{}, err
 			}
 
+			// External databases require explicit credentials — auto-generating random
+			// credentials would cause permanent authentication failures since the operator
+			// cannot know what credentials the existing cluster was provisioned with.
+			searchAuth := server.Spec.Search.Authentication
+			if searchAuth.SecretRef == "" && searchAuth.Username == "" {
+				msg := "external Search requires credentials: set spec.search.authentication.secretRef or spec.search.authentication.username/password"
+				log.Info("Missing external Search credentials", "message", msg)
+				meta.SetStatusCondition(&server.Status.Conditions, metav1.Condition{
+					Type:               "Ready",
+					Status:             metav1.ConditionFalse,
+					ObservedGeneration: server.Generation,
+					Reason:             "MissingExternalCredentials",
+					Message:            msg,
+				})
+				server.Status.ObservedGeneration = server.Generation
+				if statusErr := r.Status().Update(ctx, server); statusErr != nil {
+					log.Error(statusErr, "Failed to update status")
+				}
+				return ctrl.Result{RequeueAfter: 30 * time.Second}, nil
+			}
+
 			// Ensure authentication secret for external Search.
 			// ensureAuthenticationSecret handles all cases: SecretRef (validates it),
-			// inline username/password (creates a managed Secret), and no credentials
-			// (auto-generates into a managed Secret).
+			// inline username/password (creates a managed Secret).
 			var err error
 			searchSecretName, _, err = r.ensureAuthenticationSecret(ctx, server, componentSearch, server.Spec.Search.Authentication, server.Spec.Search.StorageConfig)
 			if err != nil {

internal/controller/axonopsplatform_controller_test.go

@@ -214,7 +214,7 @@ var _ = Describe("AxonOpsPlatform Controller", func() {
 			Expect(k8sClient.Delete(ctx, searchSecret)).To(Succeed())
 		})
 
-		It("should auto-generate credentials when external Search has no auth configured", func() {
+		It("should set MissingExternalCredentials condition when external Search has no auth configured", func() {
 			const resourceName = "external-search-no-auth"
 			ctx := context.Background()
 			typeNamespacedName := types.NamespacedName{
@@ -236,7 +236,7 @@ var _ = Describe("AxonOpsPlatform Controller", func() {
 								Hosts: []string{"https://opensearch.example.com:9200"},
 							},
 							Authentication: corev1alpha1.AxonAuthentication{
-								// No SecretRef or Username - credentials will be auto-generated
+								// No SecretRef or Username
 							},
 						},
 					},
@@ -257,20 +257,24 @@ var _ = Describe("AxonOpsPlatform Controller", func() {
 			})
 			Expect(err).NotTo(HaveOccurred())
 
-			By("Verifying that a managed auth secret was created with auto-generated credentials")
+			By("Verifying that Ready=False with MissingExternalCredentials is set")
+			updatedResource := &corev1alpha1.AxonOpsPlatform{}
+			Expect(k8sClient.Get(ctx, typeNamespacedName, updatedResource)).To(Succeed())
+			cond := meta.FindStatusCondition(updatedResource.Status.Conditions, "Ready")
+			Expect(cond).NotTo(BeNil())
+			Expect(cond.Status).To(Equal(metav1.ConditionFalse))
+			Expect(cond.Reason).To(Equal("MissingExternalCredentials"))
+
+			By("Verifying that no managed auth secret was created")
 			managedSecret := &corev1.Secret{}
-			Expect(k8sClient.Get(ctx, types.NamespacedName{
+			err = k8sClient.Get(ctx, types.NamespacedName{
 				Name:      resourceName + "-search-auth",
 				Namespace: "default",
-			}, managedSecret)).To(Succeed())
-			Expect(managedSecret.Data).To(HaveKey("AXONOPS_SEARCH_USER"))
-			Expect(managedSecret.Data).To(HaveKey("AXONOPS_SEARCH_PASSWORD"))
-			Expect(string(managedSecret.Data["AXONOPS_SEARCH_USER"])).NotTo(BeEmpty())
-			Expect(string(managedSecret.Data["AXONOPS_SEARCH_PASSWORD"])).NotTo(BeEmpty())
+			}, managedSecret)
+			Expect(errors.IsNotFound(err)).To(BeTrue())
 
 			By("Cleanup")
 			Expect(k8sClient.Delete(ctx, resource)).To(Succeed())
-			Expect(k8sClient.Delete(ctx, managedSecret)).To(Succeed())
 		})
 
 		It("should exclude search-tls volume when Search is external", func() {
@@ -441,7 +445,7 @@ var _ = Describe("AxonOpsPlatform Controller", func() {
 			Expect(k8sClient.Delete(ctx, timeseriesSecret)).To(Succeed())
 		})
 
-		It("should auto-generate credentials when external TimeSeries has no auth configured", func() {
+		It("should set MissingExternalCredentials condition when external TimeSeries has no auth configured", func() {
 			const resourceName = "external-timeseries-no-auth"
 			ctx := context.Background()
 			typeNamespacedName := types.NamespacedName{
@@ -463,7 +467,7 @@ var _ = Describe("AxonOpsPlatform Controller", func() {
 								Hosts: []string{"cassandra-node1.example.com:9042"},
 							},
 							Authentication: corev1alpha1.AxonAuthentication{
-								// No SecretRef or Username - credentials will be auto-generated
+								// No SecretRef or Username
 							},
 						},
 					},
@@ -484,20 +488,24 @@ var _ = Describe("AxonOpsPlatform Controller", func() {
 			})
 			Expect(err).NotTo(HaveOccurred())
 
-			By("Verifying that a managed auth secret was created with auto-generated credentials")
+			By("Verifying that Ready=False with MissingExternalCredentials is set")
+			updatedResource := &corev1alpha1.AxonOpsPlatform{}
+			Expect(k8sClient.Get(ctx, typeNamespacedName, updatedResource)).To(Succeed())
+			cond := meta.FindStatusCondition(updatedResource.Status.Conditions, "Ready")
+			Expect(cond).NotTo(BeNil())
+			Expect(cond.Status).To(Equal(metav1.ConditionFalse))
+			Expect(cond.Reason).To(Equal("MissingExternalCredentials"))
+
+			By("Verifying that no managed auth secret was created")
 			managedSecret := &corev1.Secret{}
-			Expect(k8sClient.Get(ctx, types.NamespacedName{
+			err = k8sClient.Get(ctx, types.NamespacedName{
 				Name:      resourceName + "-timeseries-auth",
 				Namespace: "default",
-			}, managedSecret)).To(Succeed())
-			Expect(managedSecret.Data).To(HaveKey("AXONOPS_DB_USER"))
-			Expect(managedSecret.Data).To(HaveKey("AXONOPS_DB_PASSWORD"))
-			Expect(string(managedSecret.Data["AXONOPS_DB_USER"])).NotTo(BeEmpty())
-			Expect(string(managedSecret.Data["AXONOPS_DB_PASSWORD"])).NotTo(BeEmpty())
+			}, managedSecret)
+			Expect(errors.IsNotFound(err)).To(BeTrue())
 
 			By("Cleanup")
 			Expect(k8sClient.Delete(ctx, resource)).To(Succeed())
-			Expect(k8sClient.Delete(ctx, managedSecret)).To(Succeed())
 		})
 
 		It("should exclude timeseries-tls volume when TimeSeries is external", func() {

internal/controller/backups/axonopsbackup_controller.go

@@ -108,6 +108,8 @@ func (r *AxonOpsBackupReconciler) Reconcile(ctx context.Context, req ctrl.Reques
 
 	// Validate mutual exclusivity of tables and keyspaces
 	if len(backup.Spec.Tables) > 0 && len(backup.Spec.Keyspaces) > 0 {
+		validationErr := fmt.Errorf("spec.tables and spec.keyspaces are mutually exclusive — specify one or neither")
+		log.Error(validationErr, "Validation failed", "backup", req.NamespacedName)
 		meta.SetStatusCondition(&backup.Status.Conditions, metav1.Condition{
 			Type:               "Failed",
 			Status:             metav1.ConditionTrue,
@@ -119,6 +121,9 @@ func (r *AxonOpsBackupReconciler) Reconcile(ctx context.Context, req ctrl.Reques
 		if err := r.Status().Update(ctx, backup); err != nil {
 			log.Error(err, "Failed to update status")
 		}
+		// Return nil (not the error) — this is a terminal user-error; returning an error
+		// would trigger exponential back-off retries that can never self-resolve without
+		// a spec change.
 		return ctrl.Result{}, nil
 	}