refactor: move product image resolution from dereference to validate

Image resolution is a pure computation, not an I/O dereference, so it
belongs in validate_cluster alongside the other config validation. This
aligns with the pattern used by the trino and airflow operators.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: adwk67

rust/operator-binary/src/controller/dereference.rs

@@ -1,17 +1,11 @@
 use snafu::{ResultExt, Snafu};
-use stackable_operator::commons::product_image_selection::{self, ResolvedProductImage};
 
 use crate::{
     crd::v1alpha1, security::opa::HbaseOpaConfig, zookeeper::ZookeeperConnectionInformation,
 };
 
 #[derive(Snafu, Debug)]
 pub enum Error {
-    #[snafu(display("failed to resolve product image"))]
-    ResolveProductImage {
-        source: product_image_selection::Error,
-    },
-
     #[snafu(display("failed to retrieve zookeeper connection information"))]
     RetrieveZookeeperConnectionInformation { source: crate::zookeeper::Error },
 
@@ -21,24 +15,14 @@ pub enum Error {
 
 /// External references resolved during the dereference step.
 pub struct DereferencedObjects {
-    pub resolved_product_image: ResolvedProductImage,
     pub zookeeper_connection_information: ZookeeperConnectionInformation,
     pub hbase_opa_config: Option<HbaseOpaConfig>,
 }
 
 pub async fn dereference(
     client: &stackable_operator::client::Client,
     hbase: &v1alpha1::HbaseCluster,
-    image_base_name: &str,
-    image_repository: &str,
-    pkg_version: &str,
 ) -> Result<DereferencedObjects, Error> {
-    let resolved_product_image = hbase
-        .spec
-        .image
-        .resolve(image_base_name, image_repository, pkg_version)
-        .context(ResolveProductImageSnafu)?;
-
     let zookeeper_connection_information = ZookeeperConnectionInformation::retrieve(hbase, client)
         .await
         .context(RetrieveZookeeperConnectionInformationSnafu)?;
@@ -53,7 +37,6 @@ pub async fn dereference(
     };
 
     Ok(DereferencedObjects {
-        resolved_product_image,
         zookeeper_connection_information,
         hbase_opa_config,
     })

rust/operator-binary/src/controller/validate.rs

@@ -6,16 +6,20 @@ use std::{
 use product_config::{ProductConfigManager, types::PropertyNameKind};
 use snafu::{ResultExt, Snafu};
 use stackable_operator::{
-    commons::product_image_selection::ResolvedProductImage,
+    commons::product_image_selection::{self, ResolvedProductImage},
     product_config_utils::{transform_all_roles_to_config, validate_all_roles_and_groups_config},
     role_utils::GenericRoleConfig,
 };
 
-use super::dereference::DereferencedObjects;
 use crate::crd::{AnyServiceConfig, HbaseRole, v1alpha1};
 
 #[derive(Snafu, Debug)]
 pub enum Error {
+    #[snafu(display("failed to resolve product image"))]
+    ResolveProductImage {
+        source: product_image_selection::Error,
+    },
+
     #[snafu(display("invalid role properties"))]
     RoleProperties { source: crate::crd::Error },
 
@@ -63,13 +67,21 @@ pub struct ValidatedHbaseCluster {
 
 pub fn validate_cluster(
     hbase: &v1alpha1::HbaseCluster,
-    dereferenced: &DereferencedObjects,
+    image_base_name: &str,
+    image_repository: &str,
+    pkg_version: &str,
     product_config_manager: &ProductConfigManager,
 ) -> Result<ValidatedHbaseCluster, Error> {
+    let resolved_product_image = hbase
+        .spec
+        .image
+        .resolve(image_base_name, image_repository, pkg_version)
+        .context(ResolveProductImageSnafu)?;
+
     let roles = hbase.build_role_properties().context(RolePropertiesSnafu)?;
 
     let validated_config = validate_all_roles_and_groups_config(
-        &dereferenced.resolved_product_image.product_version,
+        &resolved_product_image.product_version,
         &transform_all_roles_to_config(hbase, &roles).context(GenerateProductConfigSnafu)?,
         product_config_manager,
         false,
@@ -117,7 +129,7 @@ pub fn validate_cluster(
     }
 
     Ok(ValidatedHbaseCluster {
-        image: dereferenced.resolved_product_image.clone(),
+        image: resolved_product_image,
         role_groups,
         role_configs,
     })

rust/operator-binary/src/hbase_controller.rs

@@ -298,19 +298,18 @@ pub async fn reconcile_hbase(
 
     let client = &ctx.client;
 
-    let dereferenced = crate::controller::dereference::dereference(
-        client,
+    let dereferenced = crate::controller::dereference::dereference(client, hbase)
+        .await
+        .context(DereferenceSnafu)?;
+
+    let validated = crate::controller::validate::validate_cluster(
         hbase,
         CONTAINER_IMAGE_BASE_NAME,
         &ctx.operator_environment.image_repository,
         crate::built_info::PKG_VERSION,
+        &ctx.product_config,
     )
-    .await
-    .context(DereferenceSnafu)?;
-
-    let validated =
-        crate::controller::validate::validate_cluster(hbase, &dereferenced, &ctx.product_config)
-            .context(ValidateSnafu)?;
+    .context(ValidateSnafu)?;
 
     let mut cluster_resources = ClusterResources::new(
         APP_NAME,