Merge pull request #29 from slauger/feature/pool-refactoring

refactor: move pool membership to Server poolRefs

Author: slauger

README.md

@@ -51,7 +51,7 @@ graph TD
     CN_D -->|mounts| Code
 ```
 
-A **Config** is the root resource - it holds shared configuration (puppet.conf, PuppetDB connection), manages code deployment, and references a **CertificateAuthority** via `authorityRef`. A **CertificateAuthority** initializes the CA infrastructure and periodically refreshes the CRL. Each **Certificate** is signed by the CA and stored as a Kubernetes Secret. A **Server** references a Certificate and creates a Deployment - it can run as CA, catalog server, or both. **Pools** create Services that select Server pods by label, with optional Gateway API TLSRoute for SNI-based routing.
+A **Config** is the root resource - it holds shared configuration (puppet.conf, PuppetDB connection), manages code deployment, and references a **CertificateAuthority** via `authorityRef`. A **CertificateAuthority** initializes the CA infrastructure and periodically refreshes the CRL. Each **Certificate** is signed by the CA and stored as a Kubernetes Secret. A **Server** references a Certificate and creates a Deployment - it can run as CA, catalog server, or both. Servers declare pool membership via `poolRefs`. **Pools** are pure networking resources that create Services selecting Server pods by pool label, with optional Gateway API TLSRoute for SNI-based routing.
 
 Puppet code is mounted into Server pods via **OCI image volumes** (immutable, automatic rollout on image change, K8s 1.31+) or a **PVC** (mutable, externally managed). See [Code Deployment](docs/concepts/code-deployment.md) for details.
 
@@ -111,8 +111,8 @@ All resources use the API group `openvox.voxpupuli.org/v1alpha1`.
 | **`SigningPolicy`** | Declarative CSR signing policy (any, pattern, DNS SANs, CSR attributes) | *(rendered into Config's autosign Secret)* |
 | **`NodeClassifier`** | External Node Classifier (ENC) endpoint (Foreman, PE, custom HTTP) | *(rendered into Config's ENC Secret)* |
 | **`Certificate`** | Lifecycle of a single certificate (request, sign) | TLS Secret |
-| **`Server`** | OpenVox Server instance pool (CA and/or server role) | Deployment |
-| **`Pool`** | Service + optional Gateway API TLSRoute for Server Pods | Service, TLSRoute (optional) |
+| **`Server`** | OpenVox Server instance pool (CA and/or server role), declares pool membership via `poolRefs` | Deployment |
+| **`Pool`** | Networking resource: Service + optional Gateway API TLSRoute for Servers that reference this Pool | Service, TLSRoute (optional) |
 
 ### Planned (not yet implemented)
 

api/v1alpha1/config_types.go

@@ -219,8 +219,8 @@ type GraphiteSpec struct {
 
 // CodeSpec defines the source of Puppet code to mount into Server pods.
 // Either ClaimName (PVC) or Image (OCI image volume) may be set, not both.
-// +kubebuilder:validation:XValidation:rule="!(has(self.image) && self.image != '' && has(self.claimName) && self.claimName != '')",message="image and claimName are mutually exclusive"
-// +kubebuilder:validation:XValidation:rule="(has(self.image) && self.image != '') || (has(self.claimName) && self.claimName != '')",message="either image or claimName must be set"
+// +kubebuilder:validation:XValidation:rule="!(has(self.image) && size(self.image) > 0 && has(self.claimName) && size(self.claimName) > 0)",message="image and claimName are mutually exclusive"
+// +kubebuilder:validation:XValidation:rule="(has(self.image) && size(self.image) > 0) || (has(self.claimName) && size(self.claimName) > 0)",message="either image or claimName must be set"
 type CodeSpec struct {
 	// ClaimName references an existing PVC containing Puppet code.
 	// Mutually exclusive with Image.

api/v1alpha1/nodeclassifier_types.go

@@ -58,7 +58,7 @@ type NodeClassifierSpec struct {
 
 // NodeClassifierRequest defines the HTTP request to the classifier.
 // +kubebuilder:validation:XValidation:rule="self.method == 'GET' || self.method == 'POST'",message="method must be GET or POST"
-// +kubebuilder:validation:XValidation:rule="self.method == 'POST' || !has(self.body) || self.body == ''",message="body is only allowed with POST method"
+// +kubebuilder:validation:XValidation:rule="self.method == 'POST' || !has(self.body) || size(self.body) == 0",message="body is only allowed with POST method"
 type NodeClassifierRequest struct {
 	// Method is the HTTP method (GET or POST).
 	// +kubebuilder:default="GET"

api/v1alpha1/pool_types.go

@@ -7,13 +7,12 @@ import (
 
 // +kubebuilder:object:root=true
 // +kubebuilder:subresource:status
-// +kubebuilder:printcolumn:name="Config",type=string,JSONPath=`.spec.configRef`
 // +kubebuilder:printcolumn:name="Type",type=string,JSONPath=`.spec.service.type`
 // +kubebuilder:printcolumn:name="Endpoints",type=integer,JSONPath=`.status.endpoints`
 // +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
 
 // Pool is the Schema for the pools API.
-// It owns a Kubernetes Service that selects Server Pods matching the Pool's Selector.
+// It owns a Kubernetes Service that selects Server Pods whose poolRefs include this Pool.
 type Pool struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
@@ -33,15 +32,6 @@ type PoolList struct {
 
 // PoolSpec defines the desired state of Pool.
 type PoolSpec struct {
-	// ConfigRef references the Config this Pool belongs to.
-	ConfigRef string `json:"configRef"`
-
-	// Selector is a set of labels used to select Server Pods for this Pool's Service.
-	// The config label is always added automatically.
-	// If empty or nil, the Pool selects all Server Pods in the Config.
-	// +optional
-	Selector map[string]string `json:"selector,omitempty"`
-
 	// Service defines the Kubernetes Service configuration.
 	// +optional
 	Service PoolServiceSpec `json:"service,omitempty"`

api/v1alpha1/server_types.go

@@ -40,6 +40,12 @@ type ServerSpec struct {
 	// CertificateRef references the Certificate whose SSL Secret is mounted into the Server pods.
 	CertificateRef string `json:"certificateRef"`
 
+	// PoolRefs lists the Pools this Server joins.
+	// The Server controller adds a pool label for each entry, making the pod
+	// selectable by the corresponding Pool's Service.
+	// +optional
+	PoolRefs []string `json:"poolRefs,omitempty"`
+
 	// Image overrides the Config's default image.
 	// +optional
 	Image ImageSpec `json:"image,omitempty"`

api/v1alpha1/zz_generated.deepcopy.go

@@ -84,11 +84,11 @@ spec:
                 type: object
                 x-kubernetes-validations:
                 - message: image and claimName are mutually exclusive
-                  rule: '!(has(self.image) && self.image != '''' && has(self.claimName)
-                    && self.claimName != '''')'
+                  rule: '!(has(self.image) && size(self.image) > 0 && has(self.claimName)
+                    && size(self.claimName) > 0)'
                 - message: either image or claimName must be set
-                  rule: (has(self.image) && self.image != '') || (has(self.claimName)
-                    && self.claimName != '')
+                  rule: (has(self.image) && size(self.image) > 0) || (has(self.claimName)
+                    && size(self.claimName) > 0)
               image:
                 description: Image defines the default container image for all Servers
                   in this Config.

charts/openvox-operator/crds/openvox.voxpupuli.org_configs.yaml

@@ -188,7 +188,8 @@ spec:
                 - message: method must be GET or POST
                   rule: self.method == 'GET' || self.method == 'POST'
                 - message: body is only allowed with POST method
-                  rule: self.method == 'POST' || !has(self.body) || self.body == ''
+                  rule: self.method == 'POST' || !has(self.body) || size(self.body)
+                    == 0
               response:
                 description: Response defines how to interpret the classifier response.
                 properties:

charts/openvox-operator/crds/openvox.voxpupuli.org_nodeclassifiers.yaml

@@ -15,9 +15,6 @@ spec:
   scope: Namespaced
   versions:
   - additionalPrinterColumns:
-    - jsonPath: .spec.configRef
-      name: Config
-      type: string
     - jsonPath: .spec.service.type
       name: Type
       type: string
@@ -32,7 +29,7 @@ spec:
       openAPIV3Schema:
         description: |-
           Pool is the Schema for the pools API.
-          It owns a Kubernetes Service that selects Server Pods matching the Pool's Selector.
+          It owns a Kubernetes Service that selects Server Pods whose poolRefs include this Pool.
         properties:
           apiVersion:
             description: |-
@@ -54,9 +51,6 @@ spec:
           spec:
             description: PoolSpec defines the desired state of Pool.
             properties:
-              configRef:
-                description: ConfigRef references the Config this Pool belongs to.
-                type: string
               route:
                 description: Route configures external access via Gateway API TLSRoute.
                 properties:
@@ -94,14 +88,6 @@ spec:
                   rule: '!self.enabled || size(self.hostname) > 0'
                 - message: gatewayRef.name is required when route is enabled
                   rule: '!self.enabled || size(self.gatewayRef.name) > 0'
-              selector:
-                additionalProperties:
-                  type: string
-                description: |-
-                  Selector is a set of labels used to select Server Pods for this Pool's Service.
-                  The config label is always added automatically.
-                  If empty or nil, the Pool selects all Server Pods in the Config.
-                type: object
               service:
                 description: Service defines the Kubernetes Service configuration.
                 properties:
@@ -139,8 +125,6 @@ spec:
                       NodePort).
                     type: string
                 type: object
-            required:
-            - configRef
             type: object
           status:
             description: PoolStatus defines the observed state of Pool.

charts/openvox-operator/crds/openvox.voxpupuli.org_pools.yaml

@@ -117,11 +117,11 @@ spec:
                 type: object
                 x-kubernetes-validations:
                 - message: image and claimName are mutually exclusive
-                  rule: '!(has(self.image) && self.image != '''' && has(self.claimName)
-                    && self.claimName != '''')'
+                  rule: '!(has(self.image) && size(self.image) > 0 && has(self.claimName)
+                    && size(self.claimName) > 0)'
                 - message: either image or claimName must be set
-                  rule: (has(self.image) && self.image != '') || (has(self.claimName)
-                    && self.claimName != '')
+                  rule: (has(self.image) && size(self.image) > 0) || (has(self.claimName)
+                    && size(self.claimName) > 0)
               configRef:
                 description: ConfigRef references the Config this Server belongs to.
                 type: string
@@ -170,6 +170,14 @@ spec:
                   Pod.
                 format: int32
                 type: integer
+              poolRefs:
+                description: |-
+                  PoolRefs lists the Pools this Server joins.
+                  The Server controller adds a pool label for each entry, making the pod
+                  selectable by the corresponding Pool's Service.
+                items:
+                  type: string
+                type: array
               replicas:
                 default: 1
                 description: Replicas is the number of Server instances.