Add a credentialsDependency to all controllers

cmd/resource-generator/data/adapter.template

@@ -23,9 +23,10 @@ import (
 
 // Fundamental types
 type (
-	orcObjectT    = orcv1alpha1.{{ .Name }}
-	resourceSpecT = orcv1alpha1.{{ .Name }}ResourceSpec
-	filterT       = orcv1alpha1.{{ .Name }}Filter
+	orcObjectT     = orcv1alpha1.{{ .Name }}
+	orcObjectListT = orcv1alpha1.{{ .Name }}List
+	resourceSpecT  = orcv1alpha1.{{ .Name }}ResourceSpec
+	filterT        = orcv1alpha1.{{ .Name }}Filter
 )
 
 // Derived types

cmd/resource-generator/data/controller.template

@@ -0,0 +1,44 @@
+/*
+Copyright {{ .Year }} The ORC Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package {{ .NameLower }}
+
+import (
+	corev1 "k8s.io/api/core/v1"
+
+	"github.com/k-orc/openstack-resource-controller/internal/controllers/generic"
+	"github.com/k-orc/openstack-resource-controller/internal/util/dependency"
+)
+
+var (
+	// NOTE: controllerName must be defined in any controller using this template
+
+	// finalizer is the string this controller adds to an object's Finalizers
+	finalizer  = generic.GetFinalizerName(controllerName)
+
+	// externalObjectFieldOwner is the field owner we use when using
+	// server-side-apply on objects we don't control
+	externalObjectFieldOwner = generic.GetSSAFieldOwner(controllerName)
+
+	credentialsDependency = dependency.NewDeletionGuardDependency[*orcObjectListT, *corev1.Secret](
+		"spec.cloudCredentialsRef.secretName",
+		func(obj orcObjectPT) []string {
+			return []string{obj.Spec.CloudCredentialsRef.SecretName}
+		},
+		finalizer, externalObjectFieldOwner,
+		dependency.OverrideDependencyName("credentials"),
+	)
+)

cmd/resource-generator/main.go

@@ -20,6 +20,9 @@ var api_template string
 //go:embed data/adapter.template
 var adapter_template string
 
+//go:embed data/controller.template
+var controller_template string
+
 type specExtraValidation struct {
 	Rule    string
 	Message string
@@ -92,6 +95,7 @@ var allResources []templateFields = []templateFields{
 func main() {
 	apiTemplate := template.Must(template.New("api").Parse(api_template))
 	adapterTemplate := template.Must(template.New("adapter").Parse(adapter_template))
+	controllerTemplate := template.Must(template.New("controller").Parse(controller_template))
 
 	for i := range allResources {
 		resource := &allResources[i]
@@ -112,8 +116,13 @@ func main() {
 			panic(err)
 		}
 
-		facadePath := filepath.Join("internal", "controllers", resourceLower, "zz_generated.adapter.go")
-		if err := writeTemplate(facadePath, adapterTemplate, resource); err != nil {
+		adapterPath := filepath.Join("internal", "controllers", resourceLower, "zz_generated.adapter.go")
+		if err := writeTemplate(adapterPath, adapterTemplate, resource); err != nil {
+			panic(err)
+		}
+
+		controllerPath := filepath.Join("internal", "controllers", resourceLower, "zz_generated.controller.go")
+		if err := writeTemplate(controllerPath, controllerTemplate, resource); err != nil {
 			panic(err)
 		}
 	}

config/rbac/role.yaml

@@ -11,6 +11,8 @@ rules:
   verbs:
   - get
   - list
+  - patch
+  - update
   - watch
 - apiGroups:
   - openstack.k-orc.cloud

internal/controllers/flavor/actuator.go

@@ -21,6 +21,7 @@ import (
 	"iter"
 
 	"github.com/gophercloud/gophercloud/v2/openstack/compute/v2/flavors"
+	corev1 "k8s.io/api/core/v1"
 	"k8s.io/utils/ptr"
 	ctrl "sigs.k8s.io/controller-runtime"
 
@@ -167,33 +168,39 @@ type flavorHelperFactory struct{}
 
 var _ helperFactory = flavorHelperFactory{}
 
-func newActuator(ctx context.Context, orcObject *orcv1alpha1.Flavor, controller generic.ResourceController) (flavorActuator, error) {
+func newActuator(ctx context.Context, orcObject *orcv1alpha1.Flavor, controller generic.ResourceController) (flavorActuator, []generic.ProgressStatus, error) {
 	log := ctrl.LoggerFrom(ctx)
 
+	// Ensure credential secrets exist and have our finalizer
+	_, progressStatus, err := credentialsDependency.GetDependencies(ctx, controller.GetK8sClient(), orcObject, func(*corev1.Secret) bool { return true })
+	if len(progressStatus) > 0 || err != nil {
+		return flavorActuator{}, progressStatus, err
+	}
+
 	clientScope, err := controller.GetScopeFactory().NewClientScopeFromObject(ctx, controller.GetK8sClient(), log, orcObject)
 	if err != nil {
-		return flavorActuator{}, err
+		return flavorActuator{}, nil, err
 	}
 	osClient, err := clientScope.NewComputeClient()
 	if err != nil {
-		return flavorActuator{}, err
+		return flavorActuator{}, nil, err
 	}
 
 	return flavorActuator{
 		osClient: osClient,
-	}, nil
+	}, nil, nil
 }
 
 func (flavorHelperFactory) NewAPIObjectAdapter(obj orcObjectPT) adapterI {
 	return flavorAdapter{obj}
 }
 
 func (flavorHelperFactory) NewCreateActuator(ctx context.Context, orcObject orcObjectPT, controller generic.ResourceController) ([]generic.ProgressStatus, createResourceActuator, error) {
-	actuator, err := newActuator(ctx, orcObject, controller)
-	return nil, actuator, err
+	actuator, progressStatus, err := newActuator(ctx, orcObject, controller)
+	return progressStatus, actuator, err
 }
 
 func (flavorHelperFactory) NewDeleteActuator(ctx context.Context, orcObject orcObjectPT, controller generic.ResourceController) ([]generic.ProgressStatus, deleteResourceActuator, error) {
-	actuator, err := newActuator(ctx, orcObject, controller)
-	return nil, actuator, err
+	actuator, progressStatus, err := newActuator(ctx, orcObject, controller)
+	return progressStatus, actuator, err
 }

internal/controllers/flavor/controller.go

@@ -18,6 +18,7 @@ package flavor
 
 import (
 	"context"
+	"errors"
 
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/controller"
@@ -27,8 +28,11 @@ import (
 	ctrlexport "github.com/k-orc/openstack-resource-controller/internal/controllers/export"
 	"github.com/k-orc/openstack-resource-controller/internal/controllers/generic"
 	"github.com/k-orc/openstack-resource-controller/internal/scope"
+	"github.com/k-orc/openstack-resource-controller/internal/util/credentials"
 )
 
+const controllerName = "flavor"
+
 // +kubebuilder:rbac:groups=openstack.k-orc.cloud,resources=flavors,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=openstack.k-orc.cloud,resources=flavors/status,verbs=get;update;patch
 
@@ -41,15 +45,24 @@ func New(scopeFactory scope.Factory) ctrlexport.Controller {
 }
 
 func (flavorReconcilerConstructor) GetName() string {
-	return "flavor"
+	return controllerName
 }
 
 // SetupWithManager sets up the controller with the Manager.
 func (c flavorReconcilerConstructor) SetupWithManager(ctx context.Context, mgr ctrl.Manager, options controller.Options) error {
-	reconciler := generic.NewController(c.GetName(), mgr.GetClient(), c.scopeFactory, flavorHelperFactory{}, flavorStatusWriter{})
+	log := ctrl.LoggerFrom(ctx)
 
-	return ctrl.NewControllerManagedBy(mgr).
-		For(&orcv1alpha1.Flavor{}).
+	builder := ctrl.NewControllerManagedBy(mgr).
 		WithOptions(options).
-		Complete(&reconciler)
+		For(&orcv1alpha1.Flavor{})
+
+	if err := errors.Join(
+		credentialsDependency.AddToManager(ctx, mgr),
+		credentials.AddCredentialsWatch(log, mgr.GetClient(), builder, credentialsDependency),
+	); err != nil {
+		return err
+	}
+
+	reconciler := generic.NewController(controllerName, mgr.GetClient(), c.scopeFactory, flavorHelperFactory{}, flavorStatusWriter{})
+	return builder.Complete(&reconciler)
 }

internal/controllers/image/actuator.go

@@ -24,6 +24,7 @@ import (
 	"slices"
 
 	"github.com/gophercloud/gophercloud/v2/openstack/image/v2/images"
+	corev1 "k8s.io/api/core/v1"
 	"k8s.io/utils/ptr"
 	ctrl "sigs.k8s.io/controller-runtime"
 
@@ -45,21 +46,27 @@ type imageActuator struct {
 	osClient osclients.ImageClient
 }
 
-func newActuator(ctx context.Context, controller generic.ResourceController, orcObject *orcv1alpha1.Image) (imageActuator, error) {
+func newActuator(ctx context.Context, controller generic.ResourceController, orcObject *orcv1alpha1.Image) (imageActuator, []generic.ProgressStatus, error) {
 	log := ctrl.LoggerFrom(ctx)
 
+	// Ensure credential secrets exist and have our finalizer
+	_, progressStatus, err := credentialsDependency.GetDependencies(ctx, controller.GetK8sClient(), orcObject, func(*corev1.Secret) bool { return true })
+	if len(progressStatus) > 0 || err != nil {
+		return imageActuator{}, progressStatus, err
+	}
+
 	clientScope, err := controller.GetScopeFactory().NewClientScopeFromObject(ctx, controller.GetK8sClient(), log, orcObject)
 	if err != nil {
-		return imageActuator{}, err
+		return imageActuator{}, nil, err
 	}
 	osClient, err := clientScope.NewImageClient()
 	if err != nil {
-		return imageActuator{}, err
+		return imageActuator{}, nil, err
 	}
 
 	return imageActuator{
 		osClient: osClient,
-	}, nil
+	}, nil, nil
 }
 
 var _ createResourceActuator = imageActuator{}

internal/controllers/image/controller.go

@@ -18,6 +18,7 @@ package image
 
 import (
 	"context"
+	"errors"
 	"time"
 
 	"k8s.io/client-go/tools/record"
@@ -30,12 +31,15 @@ import (
 	ctrlexport "github.com/k-orc/openstack-resource-controller/internal/controllers/export"
 	"github.com/k-orc/openstack-resource-controller/internal/controllers/generic"
 	"github.com/k-orc/openstack-resource-controller/internal/scope"
+	"github.com/k-orc/openstack-resource-controller/internal/util/credentials"
 )
 
 const (
 	FieldOwner = "openstack.k-orc.cloud/imagecontroller"
 	// Field owner of transient status.
 	SSAStatusTxn = "status"
+
+	controllerName = "image"
 )
 
 // ssaFieldOwner returns the field owner for a specific named SSA transaction.
@@ -63,7 +67,7 @@ func New(scopeFactory scope.Factory) ctrlexport.Controller {
 }
 
 func (imageReconcilerConstructor) GetName() string {
-	return "image"
+	return controllerName
 }
 
 // orcImageReconciler reconciles an ORC Image.
@@ -85,16 +89,25 @@ func (r *orcImageReconciler) GetScopeFactory() scope.Factory {
 }
 
 // SetupWithManager sets up the controller with the Manager.
-func (c imageReconcilerConstructor) SetupWithManager(_ context.Context, mgr ctrl.Manager, options controller.Options) error {
+func (c imageReconcilerConstructor) SetupWithManager(ctx context.Context, mgr ctrl.Manager, options controller.Options) error {
+	log := ctrl.LoggerFrom(ctx)
+
+	builder := ctrl.NewControllerManagedBy(mgr).
+		WithOptions(options).
+		For(&orcv1alpha1.Image{})
+
+	if err := errors.Join(
+		credentialsDependency.AddToManager(ctx, mgr),
+		credentials.AddCredentialsWatch(log, mgr.GetClient(), builder, credentialsDependency),
+	); err != nil {
+		return err
+	}
+
 	reconciler := orcImageReconciler{
 		client:   mgr.GetClient(),
 		recorder: mgr.GetEventRecorderFor("orc-image-controller"),
 
 		imageReconcilerConstructor: c,
 	}
-
-	return ctrl.NewControllerManagedBy(mgr).
-		For(&orcv1alpha1.Image{}).
-		WithOptions(options).
-		Complete(&reconciler)
+	return builder.Complete(&reconciler)
 }

internal/controllers/image/reconcile.go

@@ -76,8 +76,9 @@ func (r *orcImageReconciler) reconcileNormal(ctx context.Context, orcObject *orc
 		}
 	}()
 
-	actuator, err := newActuator(ctx, r, orcObject)
-	if err != nil {
+	actuator, progressStatus, err := newActuator(ctx, r, orcObject)
+	if len(progressStatus) > 0 || err != nil {
+		addStatus(withProgressStatus(progressStatus...))
 		return ctrl.Result{}, err
 	}
 
@@ -197,8 +198,9 @@ func (r *orcImageReconciler) reconcileDelete(ctx context.Context, orcObject *orc
 		}
 	}()
 
-	actuator, err := newActuator(ctx, r, orcObject)
-	if err != nil {
+	actuator, progressStatus, err := newActuator(ctx, r, orcObject)
+	if len(progressStatus) > 0 || err != nil {
+		addStatus(withProgressStatus(progressStatus...))
 		return ctrl.Result{}, err
 	}