Skip to content

AppCred support #1430

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
+3,657 −86
Open

AppCred support #1430

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
658 changes: 658 additions & 0 deletions apis/bases/core.openstack.org_openstackcontrolplanes.yaml
View file
Open in desktop

Large diffs are not rendered by default.

194 changes: 194 additions & 0 deletions apis/core/v1beta1/openstackcontrolplane_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -225,6 +225,14 @@ type OpenStackControlPlaneSpec struct {
// +operator-sdk:csv:customresourcedefinitions:type=spec
// Watcher - Parameters related to the Watcher service
Watcher WatcherSection `json:"watcher,omitempty"`

// +kubebuilder:validation:Optional
// +operator-sdk:csv:customresourcedefinitions:type=spec
// ApplicationCredential - Global configuration for ApplicationCredentials.
// Both this global section AND the per-service applicationCredential section
// must be enabled for a service to use ApplicationCredentials.
// If omitted, defaults to enabled=false with standard expiration/grace periods.
ApplicationCredential ApplicationCredentialSection `json:"applicationCredential,omitempty"`
}

// TLSSection defines the desired state of TLS configuration
Expand Down Expand Up @@ -419,6 +427,13 @@ type PlacementSection struct {
// +operator-sdk:csv:customresourcedefinitions:type=spec
// APIOverride, provides the ability to override the generated manifest of several child resources.
APIOverride Override `json:"apiOverride,omitempty"`

// ApplicationCredential allows service-specific overrides of the global AC configuration.
// +operator-sdk:csv:customresourcedefinitions:type=spec
// +kubebuilder:validation:Optional
// +nullable
// +kubebuilder:default={enabled:false}
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
}

// GlanceSection defines the desired state of Glance service
Expand All @@ -445,6 +460,13 @@ type GlanceSection struct {
// Convenient to avoid podname (and thus hostname) collision between different deployments.
// Useful for CI jobs as well as preproduction and production environments that use the same storage backend, etc.
UniquePodNames bool `json:"uniquePodNames"`

// ApplicationCredential allows service-specific overrides of the global AC configuration.
// +operator-sdk:csv:customresourcedefinitions:type=spec
// +kubebuilder:validation:Optional
// +nullable
// +kubebuilder:default={enabled:false}
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
}

// CinderSection defines the desired state of Cinder service
Expand All @@ -471,6 +493,13 @@ type CinderSection struct {
// Convenient to avoid podname (and thus hostname) collision between different deployments.
// Useful for CI jobs as well as preproduction and production environments that use the same storage backend, etc.
UniquePodNames bool `json:"uniquePodNames"`

// ApplicationCredential allows service-specific overrides of the global AC configuration.
// +operator-sdk:csv:customresourcedefinitions:type=spec
// +kubebuilder:validation:Optional
// +nullable
// +kubebuilder:default={enabled:false}
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
}

// GaleraSection defines the desired state of Galera services
Expand Down Expand Up @@ -564,6 +593,13 @@ type NeutronSection struct {
// +operator-sdk:csv:customresourcedefinitions:type=spec
// APIOverride, provides the ability to override the generated manifest of several child resources.
APIOverride Override `json:"apiOverride,omitempty"`

// ApplicationCredential allows service-specific overrides of the global AC configuration.
// +operator-sdk:csv:customresourcedefinitions:type=spec
// +kubebuilder:validation:Optional
// +nullable
// +kubebuilder:default={enabled:false}
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
}

// NovaSection defines the desired state of Nova services
Expand All @@ -590,6 +626,13 @@ type NovaSection struct {
// for a nova cell. cell0 never have compute nodes and therefore it won't have a noVNCProxy deployed.
// Providing an override for cell0 noVNCProxy does not have an effect.
CellOverride map[string]NovaCellOverrideSpec `json:"cellOverride,omitempty"`

// ApplicationCredential allows service-specific overrides of the global AC configuration.
// +operator-sdk:csv:customresourcedefinitions:type=spec
// +kubebuilder:validation:Optional
// +nullable
// +kubebuilder:default={enabled:false}
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
}

// NovaCellOverrideSpec to override the generated manifest of several child resources.
Expand Down Expand Up @@ -620,6 +663,13 @@ type HeatSection struct {
// +operator-sdk:csv:customresourcedefinitions:type=spec
// CnfAPIOverride, provides the ability to override the generated manifest of several child resources.
CnfAPIOverride Override `json:"cnfAPIOverride,omitempty"`

// ApplicationCredential allows service-specific overrides of the global AC configuration.
// +operator-sdk:csv:customresourcedefinitions:type=spec
// +kubebuilder:validation:Optional
// +nullable
// +kubebuilder:default={enabled:false}
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
}

// IronicSection defines the desired state of Ironic services
Expand All @@ -644,6 +694,13 @@ type IronicSection struct {
// +operator-sdk:csv:customresourcedefinitions:type=spec
// InspectorOverride, provides the ability to override the generated manifest of several child resources.
InspectorOverride Override `json:"inspectorOverride,omitempty"`

// ApplicationCredential allows service-specific overrides of the global AC configuration.
// +operator-sdk:csv:customresourcedefinitions:type=spec
// +kubebuilder:validation:Optional
// +nullable
// +kubebuilder:default={enabled:false}
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
}

// ManilaSection defines the desired state of Manila service
Expand All @@ -663,6 +720,13 @@ type ManilaSection struct {
// +operator-sdk:csv:customresourcedefinitions:type=spec
// APIOverride, provides the ability to override the generated manifest of several child resources.
APIOverride Override `json:"apiOverride,omitempty"`

// ApplicationCredential allows service-specific overrides of the global AC configuration.
// +operator-sdk:csv:customresourcedefinitions:type=spec
// +kubebuilder:validation:Optional
// +nullable
// +kubebuilder:default={enabled:false}
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
}

// HorizonSection defines the desired state of Horizon services
Expand Down Expand Up @@ -711,6 +775,20 @@ type TelemetrySection struct {
// +operator-sdk:csv:customresourcedefinitions:type=spec
// AlertmanagerOverride, provides the ability to override the generated manifest of several child resources.
AlertmanagerOverride Override `json:"alertmanagerOverride,omitempty"`

// ApplicationCredential allows service-specific overrides of the global AC configuration.
// +operator-sdk:csv:customresourcedefinitions:type=spec
// +kubebuilder:validation:Optional
// +nullable
// +kubebuilder:default={enabled:false}
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`

// AodhApplicationCredential allows service-specific overrides of the global AC configuration for Aodh.
// +operator-sdk:csv:customresourcedefinitions:type=spec
// +kubebuilder:validation:Optional
// +nullable
// +kubebuilder:default={enabled:false}
AodhApplicationCredential *ServiceAppCredSection `json:"aodhApplicationCredential"`
}

// SwiftSection defines the desired state of Swift service
Expand All @@ -730,6 +808,13 @@ type SwiftSection struct {
// +operator-sdk:csv:customresourcedefinitions:type=spec
// ProxyOverride, provides the ability to override the generated manifest of several child resources.
ProxyOverride Override `json:"proxyOverride,omitempty"`

// ApplicationCredential allows service-specific overrides of the global AC configuration.
// +operator-sdk:csv:customresourcedefinitions:type=spec
// +kubebuilder:validation:Optional
// +nullable
// +kubebuilder:default={enabled:false}
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
}

// OctaviaSection defines the desired state of the Octavia service
Expand All @@ -749,6 +834,13 @@ type OctaviaSection struct {
// +operator-sdk:csv:customresourcedefinitions:type=spec
// APIOverride, provides the ability to override the generated manifest of several child resources.
APIOverride Override `json:"apiOverride,omitempty"`

// ApplicationCredential allows service-specific overrides of the global AC configuration.
// +operator-sdk:csv:customresourcedefinitions:type=spec
// +kubebuilder:validation:Optional
// +nullable
// +kubebuilder:default={enabled:false}
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
}

// DesignateSection defines the desired state of the Designate service
Expand All @@ -768,6 +860,13 @@ type DesignateSection struct {
// +operator-sdk:csv:customresourcedefinitions:type=spec
// APIOverride, provides the ability to override the generated manifest of several child resources.
APIOverride Override `json:"apiOverride,omitempty"`

// ApplicationCredential allows service-specific overrides of the global AC configuration.
// +operator-sdk:csv:customresourcedefinitions:type=spec
// +kubebuilder:validation:Optional
// +nullable
// +kubebuilder:default={enabled:false}
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
}

// BarbicanSection defines the desired state of Barbican service
Expand All @@ -787,6 +886,13 @@ type BarbicanSection struct {
// +operator-sdk:csv:customresourcedefinitions:type=spec
// APIOverride, provides the ability to override the generated manifest of several child resources.
APIOverride Override `json:"apiOverride,omitempty"`

// ApplicationCredential allows service-specific overrides of the global AC configuration.
// +operator-sdk:csv:customresourcedefinitions:type=spec
// +kubebuilder:validation:Optional
// +nullable
// +kubebuilder:default={enabled:false}
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
}

// RedisSection defines the desired state of the Redis service
Expand Down Expand Up @@ -828,6 +934,94 @@ type WatcherSection struct {
// +operator-sdk:csv:customresourcedefinitions:type=spec
// APIOverride, provides the ability to override the generated manifest of several child resources.
APIOverride Override `json:"apiOverride,omitempty"`

// ApplicationCredential allows service-specific overrides of the global AC configuration.
// +operator-sdk:csv:customresourcedefinitions:type=spec
// +kubebuilder:validation:Optional
// +nullable
// +kubebuilder:default={enabled:false}
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
}

// +kubebuilder:validation:XValidation:rule="self.gracePeriodDays < self.expirationDays",message="gracePeriodDays must be smaller than expirationDays"
// ApplicationCredentialSection defines the desired configuration for ApplicationCredentials
type ApplicationCredentialSection struct {
// Enabled indicates whether an ApplicationCredential should be created
// +kubebuilder:validation:Optional
// +kubebuilder:default=false
Enabled bool `json:"enabled"`

// ExpirationDays sets the lifetime in days for the AC
// +kubebuilder:validation:Optional
// +kubebuilder:default=365
// +kubebuilder:validation:Minimum=2
ExpirationDays *int `json:"expirationDays"`

// GracePeriodDays sets how many days before expiration the AC should be rotated
// +kubebuilder:validation:Optional
// +kubebuilder:default=182
// +kubebuilder:validation:Minimum=1
GracePeriodDays *int `json:"gracePeriodDays"`

// +kubebuilder:validation:Optional
// +kubebuilder:default={"service"}
// +kubebuilder:validation:MinItems=1
// Roles to assign to the ApplicationCredential
Roles []string `json:"roles"`

// +kubebuilder:validation:Optional
// +kubebuilder:default=false
// Whether the AC should be unrestricted
Unrestricted *bool `json:"unrestricted"`

// AccessRules lets supply a custom list of rules
// If unset, no accessRules field is emitted
// +kubebuilder:validation:Optional
// +listType=atomic
AccessRules []ACRule `json:"accessRules,omitempty"`
}

// +kubebuilder:validation:XValidation:rule="!(has(self.expirationDays) && has(self.gracePeriodDays)) || self.gracePeriodDays < self.expirationDays",message="gracePeriodDays must be smaller than expirationDays"
// ServiceAppCredSection allows service-specific overrides of the global AC configuration
type ServiceAppCredSection struct {
// +kubebuilder:validation:Optional
// +kubebuilder:default=false
Enabled bool `json:"enabled"`

// +kubebuilder:validation:Optional
// +kubebuilder:validation:Minimum=2
ExpirationDays *int `json:"expirationDays,omitempty"`

// +kubebuilder:validation:Optional
// +kubebuilder:validation:Minimum=1
GracePeriodDays *int `json:"gracePeriodDays,omitempty"`

// +kubebuilder:validation:Optional
// Roles to assign to the ApplicationCredential
Roles []string `json:"roles,omitempty"`

// +kubebuilder:validation:Optional
// Whether the AC should be unrestricted
Unrestricted *bool `json:"unrestricted,omitempty"`

// AccessRules lets the service override either the global rules
// +kubebuilder:validation:Optional
// +listType=atomic
AccessRules []ACRule `json:"accessRules,omitempty"`
}

// ACRule describes a single access rule for an ApplicationCredential
// +k8s:openapi-gen=true
type ACRule struct {
// Service is the name of the service to target (e.g. "identity").
// +kubebuilder:validation:Required
Service string `json:"service"`
// Path is the HTTP path (e.g. "/v3/auth/tokens").
// +kubebuilder:validation:Required
Path string `json:"path"`
// Method is the HTTP method to allow (e.g. "POST").
// +kubebuilder:validation:Required
Method string `json:"method"`
}

// OpenStackControlPlaneStatus defines the observed state of OpenStackControlPlane
Expand Down
Loading
Loading