Skip to content

Commit 93346ce

Browse files
Deydra71Deydra71
committed
AppCred support
1 parent c14431f commit 93346ce

32 files changed

+2335
-32
lines changed

‎apis/bases/core.openstack.org_openstackcontrolplanes.yaml‎

Lines changed: 372 additions & 0 deletions
Large diffs are not rendered by default.

‎apis/core/v1beta1/openstackcontrolplane_types.go‎

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -225,6 +225,9 @@ type OpenStackControlPlaneSpec struct {
225225
// +operator-sdk:csv:customresourcedefinitions:type=spec
226226
// Watcher - Parameters related to the Watcher service
227227
Watcher WatcherSection `json:"watcher,omitempty"`
228+
229+
// ApplicationCredential - Parameters related to the ApplicationCredential
230+
ApplicationCredential ApplicationCredentialSection `json:"applicationCredential"`
228231
}
229232

230233
// TLSSection defines the desired state of TLS configuration
@@ -419,6 +422,13 @@ type PlacementSection struct {
419422
// +operator-sdk:csv:customresourcedefinitions:type=spec
420423
// APIOverride, provides the ability to override the generated manifest of several child resources.
421424
APIOverride Override `json:"apiOverride,omitempty"`
425+
426+
// ApplicationCredential allows service-specific overrides of the global AC configuration.
427+
// +operator-sdk:csv:customresourcedefinitions:type=spec
428+
// +kubebuilder:validation:Optional
429+
// +nullable
430+
// +kubebuilder:default={enabled:false}
431+
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
422432
}
423433

424434
// GlanceSection defines the desired state of Glance service
@@ -445,6 +455,13 @@ type GlanceSection struct {
445455
// Convenient to avoid podname (and thus hostname) collision between different deployments.
446456
// Useful for CI jobs as well as preproduction and production environments that use the same storage backend, etc.
447457
UniquePodNames bool `json:"uniquePodNames"`
458+
459+
// ApplicationCredential allows service-specific overrides of the global AC configuration.
460+
// +operator-sdk:csv:customresourcedefinitions:type=spec
461+
// +kubebuilder:validation:Optional
462+
// +nullable
463+
// +kubebuilder:default={enabled:false}
464+
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
448465
}
449466

450467
// CinderSection defines the desired state of Cinder service
@@ -471,6 +488,13 @@ type CinderSection struct {
471488
// Convenient to avoid podname (and thus hostname) collision between different deployments.
472489
// Useful for CI jobs as well as preproduction and production environments that use the same storage backend, etc.
473490
UniquePodNames bool `json:"uniquePodNames"`
491+
492+
// ApplicationCredential allows service-specific overrides of the global AC configuration.
493+
// +operator-sdk:csv:customresourcedefinitions:type=spec
494+
// +kubebuilder:validation:Optional
495+
// +nullable
496+
// +kubebuilder:default={enabled:false}
497+
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
474498
}
475499

476500
// GaleraSection defines the desired state of Galera services
@@ -564,6 +588,13 @@ type NeutronSection struct {
564588
// +operator-sdk:csv:customresourcedefinitions:type=spec
565589
// APIOverride, provides the ability to override the generated manifest of several child resources.
566590
APIOverride Override `json:"apiOverride,omitempty"`
591+
592+
// ApplicationCredential allows service-specific overrides of the global AC configuration.
593+
// +operator-sdk:csv:customresourcedefinitions:type=spec
594+
// +kubebuilder:validation:Optional
595+
// +nullable
596+
// +kubebuilder:default={enabled:false}
597+
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
567598
}
568599

569600
// NovaSection defines the desired state of Nova services
@@ -590,6 +621,13 @@ type NovaSection struct {
590621
// for a nova cell. cell0 never have compute nodes and therefore it won't have a noVNCProxy deployed.
591622
// Providing an override for cell0 noVNCProxy does not have an effect.
592623
CellOverride map[string]NovaCellOverrideSpec `json:"cellOverride,omitempty"`
624+
625+
// ApplicationCredential allows service-specific overrides of the global AC configuration.
626+
// +operator-sdk:csv:customresourcedefinitions:type=spec
627+
// +kubebuilder:validation:Optional
628+
// +nullable
629+
// +kubebuilder:default={enabled:false}
630+
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
593631
}
594632

595633
// NovaCellOverrideSpec to override the generated manifest of several child resources.
@@ -711,6 +749,13 @@ type TelemetrySection struct {
711749
// +operator-sdk:csv:customresourcedefinitions:type=spec
712750
// AlertmanagerOverride, provides the ability to override the generated manifest of several child resources.
713751
AlertmanagerOverride Override `json:"alertmanagerOverride,omitempty"`
752+
753+
// ApplicationCredential allows service-specific overrides of the global AC configuration.
754+
// +operator-sdk:csv:customresourcedefinitions:type=spec
755+
// +kubebuilder:validation:Optional
756+
// +nullable
757+
// +kubebuilder:default={enabled:false}
758+
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
714759
}
715760

716761
// SwiftSection defines the desired state of Swift service
@@ -730,6 +775,13 @@ type SwiftSection struct {
730775
// +operator-sdk:csv:customresourcedefinitions:type=spec
731776
// ProxyOverride, provides the ability to override the generated manifest of several child resources.
732777
ProxyOverride Override `json:"proxyOverride,omitempty"`
778+
779+
// ApplicationCredential allows service-specific overrides of the global AC configuration.
780+
// +operator-sdk:csv:customresourcedefinitions:type=spec
781+
// +kubebuilder:validation:Optional
782+
// +nullable
783+
// +kubebuilder:default={enabled:false}
784+
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
733785
}
734786

735787
// OctaviaSection defines the desired state of the Octavia service
@@ -787,6 +839,13 @@ type BarbicanSection struct {
787839
// +operator-sdk:csv:customresourcedefinitions:type=spec
788840
// APIOverride, provides the ability to override the generated manifest of several child resources.
789841
APIOverride Override `json:"apiOverride,omitempty"`
842+
843+
// ApplicationCredential allows service-specific overrides of the global AC configuration.
844+
// +operator-sdk:csv:customresourcedefinitions:type=spec
845+
// +kubebuilder:validation:Optional
846+
// +nullable
847+
// +kubebuilder:default={enabled:false}
848+
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
790849
}
791850

792851
// RedisSection defines the desired state of the Redis service
@@ -830,6 +889,87 @@ type WatcherSection struct {
830889
APIOverride Override `json:"apiOverride,omitempty"`
831890
}
832891

892+
// +kubebuilder:validation:XValidation:rule="self.gracePeriodDays < self.expirationDays",message="gracePeriodDays must be smaller than expirationDays"
893+
// ApplicationCredentialSection defines the desired configuration for ApplicationCredentials
894+
type ApplicationCredentialSection struct {
895+
// Enabled indicates whether an ApplicationCredential should be created
896+
// +kubebuilder:validation:Optional
897+
// +kubebuilder:default=false
898+
Enabled bool `json:"enabled"`
899+
900+
// ExpirationDays sets the lifetime in days for the AC
901+
// +kubebuilder:validation:Optional
902+
// +kubebuilder:default=365
903+
// +kubebuilder:validation:Minimum=2
904+
ExpirationDays *int `json:"expirationDays,omitempty"`
905+
906+
// GracePeriodDays sets how many days before expiration the AC should be rotated
907+
// +kubebuilder:validation:Optional
908+
// +kubebuilder:default=182
909+
// +kubebuilder:validation:Minimum=1
910+
GracePeriodDays *int `json:"gracePeriodDays,omitempty"`
911+
912+
// +kubebuilder:validation:Optional
913+
// +kubebuilder:default={"service"}
914+
// +kubebuilder:validation:MinItems=1
915+
// Roles to assign to the ApplicationCredential
916+
Roles []string `json:"roles,omitempty"`
917+
918+
// +kubebuilder:validation:Optional
919+
// +kubebuilder:default=false
920+
// Whether the AC should be unrestricted
921+
Unrestricted *bool `json:"unrestricted,omitempty"`
922+
923+
// AccessRules lets supply a custom list of rules
924+
// If unset, no accessRules field is emitted
925+
// +kubebuilder:validation:Optional
926+
// +listType=atomic
927+
AccessRules []ACRule `json:"accessRules,omitempty"`
928+
}
929+
930+
// +kubebuilder:validation:XValidation:rule="!(has(self.expirationDays) && has(self.gracePeriodDays)) || self.gracePeriodDays < self.expirationDays",message="gracePeriodDays must be smaller than expirationDays"
931+
// ServiceAppCredSection allows service-specific overrides of the global AC configuration
932+
type ServiceAppCredSection struct {
933+
// +kubebuilder:validation:Optional
934+
// +kubebuilder:default=false
935+
Enabled bool `json:"enabled"`
936+
937+
// +kubebuilder:validation:Optional
938+
// +kubebuilder:validation:Minimum=2
939+
ExpirationDays *int `json:"expirationDays,omitempty"`
940+
941+
// +kubebuilder:validation:Optional
942+
// +kubebuilder:validation:Minimum=1
943+
GracePeriodDays *int `json:"gracePeriodDays,omitempty"`
944+
945+
// +kubebuilder:validation:Optional
946+
// Roles to assign to the ApplicationCredential
947+
Roles []string `json:"roles,omitempty"`
948+
949+
// +kubebuilder:validation:Optional
950+
// Whether the AC should be unrestricted
951+
Unrestricted *bool `json:"unrestricted,omitempty"`
952+
953+
// AccessRules lets the service override either the global rules
954+
// +kubebuilder:validation:Optional
955+
// +listType=atomic
956+
AccessRules []ACRule `json:"accessRules,omitempty"`
957+
}
958+
959+
// ACRule describes a single access rule for an ApplicationCredential
960+
// +k8s:openapi-gen=true
961+
type ACRule struct {
962+
// Service is the name of the service to target (e.g. "identity").
963+
// +kubebuilder:validation:Required
964+
Service string `json:"service"`
965+
// Path is the HTTP path (e.g. "/v3/auth/tokens").
966+
// +kubebuilder:validation:Required
967+
Path string `json:"path"`
968+
// Method is the HTTP method to allow (e.g. "POST").
969+
// +kubebuilder:validation:Required
970+
Method string `json:"method"`
971+
}
972+
833973
// OpenStackControlPlaneStatus defines the observed state of OpenStackControlPlane
834974
type OpenStackControlPlaneStatus struct {
835975
// +operator-sdk:csv:customresourcedefinitions:type=status,xDescriptors={"urn:alm:descriptor:io.kubernetes.conditions"}

0 commit comments

Comments
 (0)