Add support for External Keystone Service#653
Add support for External Keystone Service#653openshift-merge-bot[bot] merged 11 commits intoopenstack-k8s-operators:mainfrom
Conversation
|
Build failed (check pipeline). Post https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/0636e0d41791487589955f58fe17b071 ❌ openstack-k8s-operators-content-provider FAILURE in 8m 57s |
dmendiza
force-pushed
the
external-keystone
branch
from
3ccee68 to
4ebeb65
Compare
|
Build failed (check pipeline). Post https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/aac4c90d99a04ad1beac31fb4502f812 ❌ openstack-k8s-operators-content-provider FAILURE in 9m 33s |
dmendiza
force-pushed
the
external-keystone
branch
from
4ebeb65 to
227b00b
Compare
|
Build failed (check pipeline). Post https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/13d740041bf24217a22f1de016ce4efa ❌ openstack-k8s-operators-content-provider FAILURE in 9m 05s |
This patch adds a new `ExternalKeystoneAPI` property to KeystoneAPI to enable the use of an existing Keystone Service that is external to the OpenShift environment used to run this operator. For example, a multi-region deployment where one region is running a centralized Keystone service can use this to deploy additional regions that can use the centralized Keystone service without the need to run their own instance of Keystone. Assisted-by: Cursor (Auto Model)
dmendiza
force-pushed
the
external-keystone
branch
from
227b00b to
0e4e747
Compare
api/v1beta1/keystoneapi_types.go
Outdated
| ) | ||
|
|
||
| var ( | ||
| // interfaceBundleKeys maps endpoint winterfaces to their corresponding key in the CA bundle secret |
There was a problem hiding this comment.
s/winterfaces/interfaces/
|
Build failed (check pipeline). Post https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/ef704189ca0d4a08ac566e2756bb91c0 ❌ openstack-k8s-operators-content-provider FAILURE in 8m 57s |
|
Build failed (check pipeline). Post https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/b5471949529848f0aae25cd0855f98aa ❌ openstack-k8s-operators-content-provider FAILURE in 9m 21s |
|
recheck |
|
Build failed (check pipeline). Post https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/8e97f5c52be1434c822b2bc4304b1a95 ❌ openstack-k8s-operators-content-provider FAILURE in 9m 16s |
|
/recheck |
|
/test keystone-operator-build-deploy-kuttl |
Generate the clouds.yaml for the External Keystone API.
|
Build failed (check pipeline). Post https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/15db4974754f4f8dbeab5a62c88255c3 ❌ openstack-k8s-operators-content-provider FAILURE in 10m 02s |
Refactor the change added in this branch to pick the right bundle internally based on KeystoneAPI spec instead of making callers of GetAdminServiceClient figure that out. The client will continue to default to the internal interface, but use the public interface when using an external Keytone API.
|
Build failed (check pipeline). Post https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/63d602ef9db54a5e850cc9eac9415232 ❌ openstack-k8s-operators-content-provider FAILURE in 11m 38s |
|
recheck |
|
Build failed (check pipeline). Post https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/2385a873c8954c189a1fdf321f50559f ❌ openstack-k8s-operators-content-provider FAILURE in 9m 22s |
|
recheck |
|
Build failed (check pipeline). Post https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/5b01fa6733d54721be36fcdf0bd1d8ae ❌ openstack-k8s-operators-content-provider FAILURE in 12m 58s |
|
recheck |
vakwetu
force-pushed
the
external-keystone
branch
from
6fc2864 to
a731b7f
Compare
vakwetu
changed the title
This commit adds webhook validation to ensure proper configuration when using external Keystone API. The validation: - Requires service override configuration when ExternalKeystoneAPI is true - Ensures both public and internal endpoints are defined - Ensures both endpoints have EndpointURL set This prevents reconciliation from starting with invalid configuration and avoids template rendering failures in services (like Glance) that depend on both endpoints. The validation is integrated into both ValidateCreate and ValidateUpdate webhook functions to catch configuration errors early. Related: PR comments requesting early validation for external Keystone API
|
Added the webhook as requested by @fmount . I'll test the webhook in the morning and then remove the DNM tag. |
|
Build failed (check pipeline). Post https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/f5524f39482c44b091e35abd7a858ae1 ❌ openstack-k8s-operators-content-provider FAILURE in 8m 24s |
This commit enhances the external Keystone API webhook validation by: 1. Adding URL format validation using net/url.Parse() to ensure endpointURL values are valid URLs for both public and internal endpoints. The validation checks both for parsing errors and requires a URL scheme (http:// or https://) to catch URLs without schemes that url.Parse() would otherwise accept. 2. Removing the redundant check for nil or empty service override. As noted in PR comments, this check could be bypassed by providing an empty map or invalid keys. The actual validation that matters is whether hasPublic and hasInternal are both true, which is checked later in the function. This makes the validation more robust and prevents bypassing the check. 3. Adding comprehensive test coverage for external Keystone API validation including: - Rejection when service override is nil (checks for missing endpoints) - Rejection when service override is empty (checks for missing endpoints) - Rejection when only admin endpoint is provided (missing public/internal) - Rejection when public endpoint is missing - Rejection when internal endpoint is missing - Rejection when endpointURL is empty string - Rejection of URLs without scheme for public endpoint - Rejection of malformed URLs for internal endpoint - Acceptance when both public and internal endpoints are valid All 79 tests pass, including 9 new tests for external Keystone API validation. Related: PR comments requesting URL validation, test coverage, and removing bypassable validation checks
vakwetu
force-pushed
the
external-keystone
branch
from
e06fc42 to
18daecb
Compare
|
Build failed (check pipeline). Post https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/cadf83a91a194f36a70dd09535b46513 ❌ openstack-k8s-operators-content-provider FAILURE in 5m 03s |
|
Added webhook appears to work just fine! Please review! |
|
recheck |
Instead of marking all conditions as True for external Keystone API (which is misleading), conditionally initialize conditions only when ExternalKeystoneAPI is false (regular use case), similar to how Topology conditions are handled. This removes the need to set misleading True conditions for external Keystone API, as those conditions are not relevant when using an external service. Also updates the functional test to not check for conditions that don't exist for external Keystone API (DBReadyCondition and DeploymentReadyCondition).
vakwetu
force-pushed
the
external-keystone
branch
from
600b76b to
0fa5470
Compare
…l Keystone API - Always initialize InputReadyCondition and TLSInputReadyCondition (needed for both internal and external) - Only initialize deployment-related conditions when ExternalKeystoneAPI is false - Reorder processing in reconcileExternalKeystoneAPI: - Verify secret first - Verify endpoints (both public and internal must be defined with valid EndpointURL) - Set InputReadyCondition after both secret and endpoints are verified - Then verify TLS input - Improve endpoint validation to check both public and internal endpoints are present - Remove MarkTrue from verifySecret (it only sets False on errors now) - Set InputReadyCondition in main reconciliation loop after verification completes
vakwetu
force-pushed
the
external-keystone
branch
from
385231a to
7b795e5
Compare
…dling - Remove unused ExternalKeystoneAPI condition messages that are no longer needed since we conditionally initialize conditions - Move Topology condition initialization into cl.Set() before Init() call - Remove unnecessary serviceLabels comment
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: dmendiza, fmount The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-merge-bot
bot
merged commit f54dd51
into
openstack-k8s-operators:main
4 participants
This patch adds a new
ExternalKeystoneAPIproperty to KeystoneAPI to enable the use of an existing Keystone Service that is external to the OpenShift environment used to run this operator.For example, a multi-region deployment where one region is running a centralized Keystone service can use this to deploy additional regions that can use the centralized Keystone service without the need to run their own instance of Keystone.
Assisted-by: Cursor (Auto Model)