feat: allow plain http connections to s3

CHANGELOG.md

@@ -16,18 +16,23 @@ All notable changes to this project will be documented in this file.
 - The reconciler now applies resources and derives the cluster status in discrete
   apply and update_status steps for the `trino_controller` ([#923]).
 - All product containers now run with `securityContext.runAsNonRoot` set to `true` to improve security ([#925]).
+- Internal operator refactoring: the Trino version is no longer passed to the catalog configuration,
+  as no catalog uses it for version-dependent behaviour anymore ([#928]).
 
 ### Fixed
 
 - Fix a longstanding problem of including empty `categories`, `shortNames` and `additionalPrinterColumns` in the CRDs,
   which could cause problems with GitOps tools (e.g. ArgoCD) reporting a diff in the custom resources.
   See [our internal issue](https://github.com/stackabletech/hdfs-operator/issues/626) and [the fix](https://github.com/kube-rs/kube/pull/2042) for details ([#925]).
+- `S3Connection`s without a `tls` section are accepted again and configured as `s3.endpoint=http://...`.
+  Trino's native S3 file system takes the transport from the endpoint scheme, so requiring TLS was never necessary ([#928]).
 
 [#909]: https://github.com/stackabletech/trino-operator/pull/909
 [#913]: https://github.com/stackabletech/trino-operator/pull/913
 [#918]: https://github.com/stackabletech/trino-operator/pull/918
 [#923]: https://github.com/stackabletech/trino-operator/pull/923
 [#925]: https://github.com/stackabletech/trino-operator/pull/925
+[#928]: https://github.com/stackabletech/trino-operator/pull/928
 
 ## [26.7.0] - 2026-07-21
 

docs/modules/trino/pages/usage-guide/catalogs/delta-lake.adoc

@@ -27,15 +27,15 @@ spec:
           accessStyle: Path
           credentials:
             secretClass: minio-credentials
-          # TLS is required for S3 connections, see the note below
+          # TLS is recommended for S3 connections, see the note below
           tls:
             verification:
               server:
                 caCert:
                   secretClass: minio-tls-certificates
 ----
 
-IMPORTANT: The `tls` section is required, see xref:usage-guide/s3.adoc#tls-required[Connecting Trino to S3].
+NOTE: The `tls` section is optional but recommended, see xref:usage-guide/s3.adoc#tls[Connecting Trino to S3].
 
 == Connect to S3 store or HDFS
 

docs/modules/trino/pages/usage-guide/catalogs/hive.adoc

@@ -37,7 +37,7 @@ spec:
 <1> The name of the catalog as it will appear in Trino
 <2> TrinoCluster can use these labels to select which catalogs to include
 <3> The name of your Hive Stacklet
-<4> TLS is required for S3 connections, see xref:usage-guide/s3.adoc#tls-required[Connecting Trino to S3]
+<4> TLS is recommended for S3 connections, see xref:usage-guide/s3.adoc#tls[Connecting Trino to S3]
 <5> Use `configOverrides` to add arbitrary properties to the Trino catalog configuration
 
 == Connect to S3 store
@@ -66,7 +66,7 @@ spec:
         reference: my-minio
 ----
 
-IMPORTANT: The `tls` section is required, see xref:usage-guide/s3.adoc#tls-required[Connecting Trino to S3].
+NOTE: The `tls` section is optional but recommended, see xref:usage-guide/s3.adoc#tls[Connecting Trino to S3].
 
 See xref:concepts:s3.adoc[] for details about S3 connections.
 

docs/modules/trino/pages/usage-guide/catalogs/iceberg.adoc

@@ -36,7 +36,7 @@ spec:
 ----
 <1> The name of the catalog as it will appear in Trino
 <2> This is the name of your Hive Stacklet
-<3> TLS is required for S3 connections, see xref:usage-guide/s3.adoc#tls-required[Connecting Trino to S3]
+<3> TLS is recommended for S3 connections, see xref:usage-guide/s3.adoc#tls[Connecting Trino to S3]
 
 == Connect to S3 store or HDFS
 The Iceberg connector can connect to S3 or HDFS in the same way the xref:usage-guide/catalogs/hive.adoc[] connector does.

docs/modules/trino/pages/usage-guide/s3.adoc

@@ -4,8 +4,9 @@
 You can specify S3 connection details directly inside the TrinoCatalog specification or by referring to an external S3Connection custom resource.
 This mechanism is used across the whole Stackable Data Platform, read the xref:concepts:s3.adoc[S3 concepts page] to learn more.
 
-[#tls-required]
-IMPORTANT: Every S3 connection must contain a `tls` section, because Trino uses the native S3 client, which requires TLS.
+[#tls]
+NOTE: Add a `tls` section to encrypt the traffic to the object store.
+Without it, Trino connects over plaintext HTTP, which should be reserved for object stores that do not support TLS.
 
 == Inline
 
@@ -34,7 +35,7 @@ s3: # <1>
 <5> Name of the SecretClass providing the credentials. The Secret behind it is expected
     to contain the following keys: `accessKey` and `secretKey`
 <6> TLS settings for encrypted traffic. The `secretClass` can be provided by the Secret Operator or yourself.
-    This section is required, see <<tls-required,the note above>>.
+    This section is optional but recommended, see <<tls,the note above>>.
 
 A self provided S3 TLS secret can be specified like this:
 

rust/operator-binary/src/catalog/black_hole.rs

@@ -15,7 +15,6 @@ impl ToCatalogConfig for BlackHoleConnector {
         catalog_name: &TrinoCatalogName,
         _catalog_namespace: &NamespaceName,
         _client: &Client,
-        _trino_version: u16,
     ) -> Result<CatalogConfig, FromTrinoCatalogError> {
         // No additional properties needed
         Ok(CatalogConfig::new(catalog_name, CONNECTOR_NAME))

rust/operator-binary/src/catalog/commons.rs

@@ -1,5 +1,5 @@
 use async_trait::async_trait;
-use snafu::{OptionExt, ResultExt, ensure};
+use snafu::{OptionExt, ResultExt};
 use stackable_operator::{
     builder::pod::volume::{VolumeBuilder, VolumeMountBuilder},
     client::Client,
@@ -15,7 +15,7 @@ use crate::{
         from_trino_catalog_error::{
             ConfigureS3Snafu, FailedToGetDiscoveryConfigMapDataKeySnafu,
             FailedToGetDiscoveryConfigMapDataSnafu, FailedToGetDiscoveryConfigMapSnafu,
-            S3TlsNoVerificationNotSupportedSnafu, S3TlsRequiredSnafu,
+            S3TlsNoVerificationNotSupportedSnafu,
         },
     },
     config,
@@ -36,7 +36,6 @@ impl ExtendCatalogConfig for MetastoreConnection {
         catalog_name: &TrinoCatalogName,
         catalog_namespace: &NamespaceName,
         client: &Client,
-        _trino_version: u16,
     ) -> Result<(), FromTrinoCatalogError> {
         let hive_cm: ConfigMap = client
             .get(self.config_map.as_ref(), catalog_namespace.as_ref())
@@ -78,7 +77,6 @@ impl ExtendCatalogConfig for s3::v1alpha1::InlineConnectionOrReference {
         _catalog_name: &TrinoCatalogName,
         catalog_namespace: &NamespaceName,
         client: &Client,
-        _trino_version: u16,
     ) -> Result<(), FromTrinoCatalogError> {
         let s3 = self
             .clone()
@@ -103,9 +101,6 @@ impl ExtendCatalogConfig for s3::v1alpha1::InlineConnectionOrReference {
             catalog_config.add_env_property_from_file("s3.aws-secret-key", secret_key);
         }
 
-        // TLS is required when using native S3 implementation.
-        ensure!(s3.tls.uses_tls(), S3TlsRequiredSnafu);
-
         catalog_config.init_container_extra_start_commands.extend(
             config::s3::s3_tls_truststore_commands(&s3.tls)
                 .map_err(|_| S3TlsNoVerificationNotSupportedSnafu.build())?,
@@ -123,7 +118,6 @@ impl ExtendCatalogConfig for HdfsConnection {
         catalog_name: &TrinoCatalogName,
         _catalog_namespace: &NamespaceName,
         _client: &Client,
-        _trino_version: u16,
     ) -> Result<(), FromTrinoCatalogError> {
         // Since Trino 458, fs.hadoop.enabled defaults to false.
         catalog_config.add_property("fs.hadoop.enabled", "true");

rust/operator-binary/src/catalog/config.rs

@@ -110,7 +110,6 @@ impl CatalogConfig {
         catalog: &v1alpha1::TrinoCatalog,
         client: &Client,
         catalog_namespace: &NamespaceName,
-        trino_version: u16,
     ) -> Result<CatalogConfig, FromTrinoCatalogError> {
         let to_catalog_config: &dyn ToCatalogConfig = match &catalog.spec.connector {
             TrinoCatalogConnector::BlackHole(black_hole_connector) => black_hole_connector,
@@ -124,7 +123,7 @@ impl CatalogConfig {
             TrinoCatalogConnector::Tpch(tpch_connector) => tpch_connector,
         };
         let mut catalog_config = to_catalog_config
-            .to_catalog_config(catalog_name, catalog_namespace, client, trino_version)
+            .to_catalog_config(catalog_name, catalog_namespace, client)
             .await?;
 
         catalog_config

rust/operator-binary/src/catalog/delta_lake.rs

@@ -15,7 +15,6 @@ impl ToCatalogConfig for DeltaLakeConnector {
         catalog_name: &TrinoCatalogName,
         catalog_namespace: &NamespaceName,
         client: &Client,
-        trino_version: u16,
     ) -> Result<CatalogConfig, FromTrinoCatalogError> {
         let mut config = CatalogConfig::new(catalog_name, CONNECTOR_NAME);
 
@@ -27,35 +26,17 @@ impl ToCatalogConfig for DeltaLakeConnector {
         config.add_property("delta.security", "allow-all");
 
         self.metastore
-            .extend_catalog_config(
-                &mut config,
-                catalog_name,
-                catalog_namespace,
-                client,
-                trino_version,
-            )
+            .extend_catalog_config(&mut config, catalog_name, catalog_namespace, client)
             .await?;
 
         if let Some(ref s3) = self.s3 {
-            s3.extend_catalog_config(
-                &mut config,
-                catalog_name,
-                catalog_namespace,
-                client,
-                trino_version,
-            )
-            .await?;
+            s3.extend_catalog_config(&mut config, catalog_name, catalog_namespace, client)
+                .await?;
         }
 
         if let Some(ref hdfs) = self.hdfs {
-            hdfs.extend_catalog_config(
-                &mut config,
-                catalog_name,
-                catalog_namespace,
-                client,
-                trino_version,
-            )
-            .await?;
+            hdfs.extend_catalog_config(&mut config, catalog_name, catalog_namespace, client)
+                .await?;
         }
 
         Ok(config)

rust/operator-binary/src/catalog/generic.rs

@@ -16,7 +16,6 @@ impl ToCatalogConfig for GenericConnector {
         catalog_name: &TrinoCatalogName,
         _catalog_namespace: &NamespaceName,
         _client: &Client,
-        _trino_version: u16,
     ) -> Result<CatalogConfig, FromTrinoCatalogError> {
         let connector_name = &self.connector_name;
         let mut config = CatalogConfig::new(catalog_name, connector_name);

rust/operator-binary/src/catalog/google_sheet.rs

@@ -22,7 +22,6 @@ impl ToCatalogConfig for GoogleSheetConnector {
         catalog_name: &TrinoCatalogName,
         _catalog_namespace: &NamespaceName,
         _client: &Client,
-        _trino_version: u16,
     ) -> Result<CatalogConfig, FromTrinoCatalogError> {
         let mut config = CatalogConfig::new(catalog_name, CONNECTOR_NAME);
 

rust/operator-binary/src/catalog/hive.rs

@@ -15,7 +15,6 @@ impl ToCatalogConfig for HiveConnector {
         catalog_name: &TrinoCatalogName,
         catalog_namespace: &NamespaceName,
         client: &Client,
-        trino_version: u16,
     ) -> Result<CatalogConfig, FromTrinoCatalogError> {
         let mut config = CatalogConfig::new(catalog_name, CONNECTOR_NAME);
 
@@ -27,35 +26,17 @@ impl ToCatalogConfig for HiveConnector {
         config.add_property("hive.security", "allow-all");
 
         self.metastore
-            .extend_catalog_config(
-                &mut config,
-                catalog_name,
-                catalog_namespace,
-                client,
-                trino_version,
-            )
+            .extend_catalog_config(&mut config, catalog_name, catalog_namespace, client)
             .await?;
 
         if let Some(ref s3) = self.s3 {
-            s3.extend_catalog_config(
-                &mut config,
-                catalog_name,
-                catalog_namespace,
-                client,
-                trino_version,
-            )
-            .await?;
+            s3.extend_catalog_config(&mut config, catalog_name, catalog_namespace, client)
+                .await?;
         }
 
         if let Some(ref hdfs) = self.hdfs {
-            hdfs.extend_catalog_config(
-                &mut config,
-                catalog_name,
-                catalog_namespace,
-                client,
-                trino_version,
-            )
-            .await?;
+            hdfs.extend_catalog_config(&mut config, catalog_name, catalog_namespace, client)
+                .await?;
         }
 
         Ok(config)

rust/operator-binary/src/catalog/iceberg.rs

@@ -15,7 +15,6 @@ impl ToCatalogConfig for IcebergConnector {
         catalog_name: &TrinoCatalogName,
         catalog_namespace: &NamespaceName,
         client: &Client,
-        trino_version: u16,
     ) -> Result<CatalogConfig, FromTrinoCatalogError> {
         let mut config = CatalogConfig::new(catalog_name, CONNECTOR_NAME);
 
@@ -28,36 +27,18 @@ impl ToCatalogConfig for IcebergConnector {
 
         if let Some(metastore) = &self.metastore {
             metastore
-                .extend_catalog_config(
-                    &mut config,
-                    catalog_name,
-                    catalog_namespace,
-                    client,
-                    trino_version,
-                )
+                .extend_catalog_config(&mut config, catalog_name, catalog_namespace, client)
                 .await?;
         }
 
         if let Some(ref s3) = self.s3 {
-            s3.extend_catalog_config(
-                &mut config,
-                catalog_name,
-                catalog_namespace,
-                client,
-                trino_version,
-            )
-            .await?;
+            s3.extend_catalog_config(&mut config, catalog_name, catalog_namespace, client)
+                .await?;
         }
 
         if let Some(ref hdfs) = self.hdfs {
-            hdfs.extend_catalog_config(
-                &mut config,
-                catalog_name,
-                catalog_namespace,
-                client,
-                trino_version,
-            )
-            .await?;
+            hdfs.extend_catalog_config(&mut config, catalog_name, catalog_namespace, client)
+                .await?;
         }
 
         Ok(config)

rust/operator-binary/src/catalog/mod.rs

@@ -28,9 +28,6 @@ pub enum FromTrinoCatalogError {
     #[snafu(display("trino does not support disabling the TLS verification of S3 servers"))]
     S3TlsNoVerificationNotSupported,
 
-    #[snafu(display("trino 469 and greater require TLS for S3"))]
-    S3TlsRequired,
-
     #[snafu(display("trino catalog has no name set"))]
     InvalidCatalogSpec,
 
@@ -66,7 +63,6 @@ pub trait ToCatalogConfig {
         catalog_name: &TrinoCatalogName,
         catalog_namespace: &NamespaceName,
         client: &Client,
-        trino_version: u16,
     ) -> Result<CatalogConfig, FromTrinoCatalogError>;
 }
 
@@ -78,6 +74,5 @@ pub trait ExtendCatalogConfig {
         catalog_name: &TrinoCatalogName,
         catalog_namespace: &NamespaceName,
         client: &Client,
-        trino_version: u16,
     ) -> Result<(), FromTrinoCatalogError>;
 }

rust/operator-binary/src/catalog/postgresql.rs

@@ -22,7 +22,6 @@ impl ToCatalogConfig for PostgresqlConnector {
         catalog_name: &TrinoCatalogName,
         _catalog_namespace: &NamespaceName,
         _client: &Client,
-        _trino_version: u16,
     ) -> Result<CatalogConfig, FromTrinoCatalogError> {
         let mut config = CatalogConfig::new(catalog_name, CONNECTOR_NAME);
         // SAFETY: `unique_database_name` must only contain uppercase ASCII letters and underscores.

rust/operator-binary/src/catalog/tpcds.rs

@@ -15,7 +15,6 @@ impl ToCatalogConfig for TpcdsConnector {
         catalog_name: &TrinoCatalogName,
         _catalog_namespace: &NamespaceName,
         _client: &Client,
-        _trino_version: u16,
     ) -> Result<CatalogConfig, FromTrinoCatalogError> {
         // No additional properties needed
         Ok(CatalogConfig::new(catalog_name, CONNECTOR_NAME))

rust/operator-binary/src/catalog/tpch.rs

@@ -15,7 +15,6 @@ impl ToCatalogConfig for TpchConnector {
         catalog_name: &TrinoCatalogName,
         _catalog_namespace: &NamespaceName,
         _client: &Client,
-        _trino_version: u16,
     ) -> Result<CatalogConfig, FromTrinoCatalogError> {
         // No additional properties needed
         Ok(CatalogConfig::new(catalog_name, CONNECTOR_NAME))