chore: Default REST catalog tls to null

CHANGELOG.md

@@ -13,7 +13,7 @@ All notable changes to this project will be documented in this file.
 - Coordinators now have a default affinity to the OPA Pods when OPA authorization is configured ([#924]).
 - Add support for 483 ([#956]).
 - Support configuring an Iceberg REST catalog in the Iceberg connector, optionally authenticated
-  using OAuth2 client credentials or a bearer token ([#950]).
+  using OAuth2 client credentials or a bearer token ([#950], [#972]).
 
 ### Changed
 
@@ -99,6 +99,7 @@ All notable changes to this project will be documented in this file.
 [#961]: https://github.com/stackabletech/trino-operator/pull/961
 [#963]: https://github.com/stackabletech/trino-operator/pull/963
 [#966]: https://github.com/stackabletech/trino-operator/pull/966
+[#972]: https://github.com/stackabletech/trino-operator/pull/972
 
 ## [26.7.0] - 2026-07-21
 

docs/modules/trino/pages/usage-guide/catalogs/iceberg.adoc

@@ -37,6 +37,11 @@ spec:
               server:  # <7>
                 hostname: idp.example.com
                 path: /oauth2/token
+                tls:
+                  verification:
+                    server:
+                      caCert:
+                        webPki: {}
               clientCredentials:  # <8>
                 secretName: trino-iceberg-client  # <9>
                 scopes:  # <10>
@@ -62,11 +67,12 @@ stringData:
 <3> Optional, defaults to 443 if TLS is used and to 80 otherwise
 <4> Optional, defaults to `/`
 <5> Optional, uses the same TLS configuration as xref:usage-guide/s3.adoc#tls[S3 connections].
-    If not specified, TLS is used and the server certificate is verified against the web PKI (`webPki`).
-    Set `tls: null` to connect without TLS. Disabling the TLS verification (`verification.none`) is not supported.
+    If not specified, Trino connects over plaintext HTTP.
+    Disabling the TLS verification (`verification.none`) is not supported.
 <6> Optional, defaults to no authentication
 <7> The token endpoint of the OAuth2 server, see <<oauth2-server>>.
-    It takes the same `hostname`, `port`, `path` and `tls` fields as the REST catalog, so it uses TLS with `webPki` verification by default.
+    It takes the same `hostname`, `port`, `path` and `tls` fields as the REST catalog, so it connects over plaintext HTTP unless `tls` is set.
+    TLS is strongly recommended here, as client credentials and tokens are sent to this endpoint.
 <8> The client credentials are exchanged for a token using the OAuth2 client credentials flow.
     Alternatively, use `token.secretName` to pass a Secret containing a static bearer token in the `token` key.
 <9> Name of a Secret containing the `clientId` and `clientSecret` keys

extra/crds.yaml

@@ -4315,12 +4315,7 @@ spec:
                                             nullable: true
                                             type: integer
                                           tls:
-                                            default:
-                                              verification:
-                                                server:
-                                                  caCert:
-                                                    webPki: {}
-                                            description: Configure a TLS connection. If not specified it will default to webPki validation.
+                                            description: Use a TLS connection. If not specified no TLS will be used.
                                             nullable: true
                                             properties:
                                               verification:
@@ -4406,12 +4401,7 @@ spec:
                                 nullable: true
                                 type: integer
                               tls:
-                                default:
-                                  verification:
-                                    server:
-                                      caCert:
-                                        webPki: {}
-                                description: Configure a TLS connection. If not specified it will default to webPki validation.
+                                description: Use a TLS connection. If not specified no TLS will be used.
                                 nullable: true
                                 properties:
                                   verification:

rust/operator-binary/src/catalog/iceberg.rs

@@ -304,11 +304,11 @@ mod tests {
         let mut expected_properties = BTreeMap::from([
             ("connector.name", "iceberg"),
             ("iceberg.catalog.type", "rest"),
-            ("iceberg.rest-catalog.uri", "https://rest-catalog/"),
+            ("iceberg.rest-catalog.uri", "http://rest-catalog/"),
             ("iceberg.rest-catalog.security", "OAUTH2"),
             (
                 "iceberg.rest-catalog.oauth2.server-uri",
-                "https://idp.example.com/oauth2/token",
+                "http://idp.example.com/oauth2/token",
             ),
             (
                 "iceberg.rest-catalog.oauth2.credential",
@@ -347,11 +347,11 @@ mod tests {
             BTreeMap::from([
                 ("connector.name", "iceberg"),
                 ("iceberg.catalog.type", "rest"),
-                ("iceberg.rest-catalog.uri", "https://rest-catalog/"),
+                ("iceberg.rest-catalog.uri", "http://rest-catalog/"),
                 ("iceberg.rest-catalog.security", "OAUTH2"),
                 (
                     "iceberg.rest-catalog.oauth2.server-uri",
-                    "https://idp.example.com/oauth2/token",
+                    "http://idp.example.com/oauth2/token",
                 ),
                 (
                     "iceberg.rest-catalog.oauth2.token",

rust/operator-binary/src/crd/catalog/iceberg.rs

@@ -1,7 +1,7 @@
 use serde::{Deserialize, Serialize};
 use snafu::{ResultExt, Snafu};
 use stackable_operator::{
-    commons::{networking::HostName, tls_verification::TlsClientDetailsWithSecureDefaults},
+    commons::{networking::HostName, tls_verification::TlsClientDetails},
     schemars::{self, JsonSchema},
     v2::types::kubernetes::SecretName,
 };
@@ -123,10 +123,9 @@ pub struct HttpEndpoint {
     #[serde(default = "HttpEndpoint::default_path")]
     pub path: String,
 
-    /// Configure a TLS connection. If not specified, it defaults to webPki verification.
-    /// Set it to `null` to not use TLS.
-    #[serde(flatten)]
-    pub tls: TlsClientDetailsWithSecureDefaults,
+    /// Configure a TLS connection. If not specified, no TLS is used.
+    #[serde(flatten, default)]
+    pub tls: TlsClientDetails,
 }
 
 impl HttpEndpoint {
@@ -164,7 +163,7 @@ mod tests {
     use super::*;
 
     #[rstest]
-    #[case::defaults("hostname: rest-catalog", "https://rest-catalog/")]
+    #[case::defaults("hostname: rest-catalog", "http://rest-catalog/")]
     #[case::without_tls("{hostname: rest-catalog, tls: null}", "http://rest-catalog/")]
     #[case::explicit_web_pki(
         "{hostname: rest-catalog, tls: {verification: {server: {caCert: {webPki: {}}}}}}",
@@ -180,9 +179,9 @@ mod tests {
     )]
     #[case::trailing_slashes(
         "{hostname: idp.example.com, path: /realms/test/protocol/openid-connect/token//}",
-        "https://idp.example.com/realms/test/protocol/openid-connect/token"
+        "http://idp.example.com/realms/test/protocol/openid-connect/token"
     )]
-    #[case::ipv6("{hostname: '::1', port: 9001}", "https://[::1]:9001/")]
+    #[case::ipv6("{hostname: '::1', port: 9001}", "http://[::1]:9001/")]
     fn http_endpoint_url(#[case] input: &str, #[case] expected: &str) {
         let endpoint: HttpEndpoint =
             stackable_operator::utils::yaml_from_str_singleton_map(input).unwrap();