Skip to content

Commit 5fbafa0

Browse files
Deydra71Deydra71
committed
AppCred support
1 parent 5cc8994 commit 5fbafa0

30 files changed

+3568
-79
lines changed

‎apis/bases/core.openstack.org_openstackcontrolplanes.yaml‎

Lines changed: 659 additions & 0 deletions
Large diffs are not rendered by default.

‎apis/core/v1beta1/openstackcontrolplane_types.go‎

Lines changed: 189 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -225,6 +225,9 @@ type OpenStackControlPlaneSpec struct {
225225
// +operator-sdk:csv:customresourcedefinitions:type=spec
226226
// Watcher - Parameters related to the Watcher service
227227
Watcher WatcherSection `json:"watcher,omitempty"`
228+
229+
// ApplicationCredential - Parameters related to the ApplicationCredential
230+
ApplicationCredential ApplicationCredentialSection `json:"applicationCredential"`
228231
}
229232

230233
// TLSSection defines the desired state of TLS configuration
@@ -419,6 +422,13 @@ type PlacementSection struct {
419422
// +operator-sdk:csv:customresourcedefinitions:type=spec
420423
// APIOverride, provides the ability to override the generated manifest of several child resources.
421424
APIOverride Override `json:"apiOverride,omitempty"`
425+
426+
// ApplicationCredential allows service-specific overrides of the global AC configuration.
427+
// +operator-sdk:csv:customresourcedefinitions:type=spec
428+
// +kubebuilder:validation:Optional
429+
// +nullable
430+
// +kubebuilder:default={enabled:false}
431+
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
422432
}
423433

424434
// GlanceSection defines the desired state of Glance service
@@ -445,6 +455,13 @@ type GlanceSection struct {
445455
// Convenient to avoid podname (and thus hostname) collision between different deployments.
446456
// Useful for CI jobs as well as preproduction and production environments that use the same storage backend, etc.
447457
UniquePodNames bool `json:"uniquePodNames"`
458+
459+
// ApplicationCredential allows service-specific overrides of the global AC configuration.
460+
// +operator-sdk:csv:customresourcedefinitions:type=spec
461+
// +kubebuilder:validation:Optional
462+
// +nullable
463+
// +kubebuilder:default={enabled:false}
464+
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
448465
}
449466

450467
// CinderSection defines the desired state of Cinder service
@@ -471,6 +488,13 @@ type CinderSection struct {
471488
// Convenient to avoid podname (and thus hostname) collision between different deployments.
472489
// Useful for CI jobs as well as preproduction and production environments that use the same storage backend, etc.
473490
UniquePodNames bool `json:"uniquePodNames"`
491+
492+
// ApplicationCredential allows service-specific overrides of the global AC configuration.
493+
// +operator-sdk:csv:customresourcedefinitions:type=spec
494+
// +kubebuilder:validation:Optional
495+
// +nullable
496+
// +kubebuilder:default={enabled:false}
497+
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
474498
}
475499

476500
// GaleraSection defines the desired state of Galera services
@@ -564,6 +588,13 @@ type NeutronSection struct {
564588
// +operator-sdk:csv:customresourcedefinitions:type=spec
565589
// APIOverride, provides the ability to override the generated manifest of several child resources.
566590
APIOverride Override `json:"apiOverride,omitempty"`
591+
592+
// ApplicationCredential allows service-specific overrides of the global AC configuration.
593+
// +operator-sdk:csv:customresourcedefinitions:type=spec
594+
// +kubebuilder:validation:Optional
595+
// +nullable
596+
// +kubebuilder:default={enabled:false}
597+
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
567598
}
568599

569600
// NovaSection defines the desired state of Nova services
@@ -590,6 +621,13 @@ type NovaSection struct {
590621
// for a nova cell. cell0 never have compute nodes and therefore it won't have a noVNCProxy deployed.
591622
// Providing an override for cell0 noVNCProxy does not have an effect.
592623
CellOverride map[string]NovaCellOverrideSpec `json:"cellOverride,omitempty"`
624+
625+
// ApplicationCredential allows service-specific overrides of the global AC configuration.
626+
// +operator-sdk:csv:customresourcedefinitions:type=spec
627+
// +kubebuilder:validation:Optional
628+
// +nullable
629+
// +kubebuilder:default={enabled:false}
630+
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
593631
}
594632

595633
// NovaCellOverrideSpec to override the generated manifest of several child resources.
@@ -620,6 +658,13 @@ type HeatSection struct {
620658
// +operator-sdk:csv:customresourcedefinitions:type=spec
621659
// CnfAPIOverride, provides the ability to override the generated manifest of several child resources.
622660
CnfAPIOverride Override `json:"cnfAPIOverride,omitempty"`
661+
662+
// ApplicationCredential allows service-specific overrides of the global AC configuration.
663+
// +operator-sdk:csv:customresourcedefinitions:type=spec
664+
// +kubebuilder:validation:Optional
665+
// +nullable
666+
// +kubebuilder:default={enabled:false}
667+
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
623668
}
624669

625670
// IronicSection defines the desired state of Ironic services
@@ -644,6 +689,13 @@ type IronicSection struct {
644689
// +operator-sdk:csv:customresourcedefinitions:type=spec
645690
// InspectorOverride, provides the ability to override the generated manifest of several child resources.
646691
InspectorOverride Override `json:"inspectorOverride,omitempty"`
692+
693+
// ApplicationCredential allows service-specific overrides of the global AC configuration.
694+
// +operator-sdk:csv:customresourcedefinitions:type=spec
695+
// +kubebuilder:validation:Optional
696+
// +nullable
697+
// +kubebuilder:default={enabled:false}
698+
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
647699
}
648700

649701
// ManilaSection defines the desired state of Manila service
@@ -663,6 +715,13 @@ type ManilaSection struct {
663715
// +operator-sdk:csv:customresourcedefinitions:type=spec
664716
// APIOverride, provides the ability to override the generated manifest of several child resources.
665717
APIOverride Override `json:"apiOverride,omitempty"`
718+
719+
// ApplicationCredential allows service-specific overrides of the global AC configuration.
720+
// +operator-sdk:csv:customresourcedefinitions:type=spec
721+
// +kubebuilder:validation:Optional
722+
// +nullable
723+
// +kubebuilder:default={enabled:false}
724+
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
666725
}
667726

668727
// HorizonSection defines the desired state of Horizon services
@@ -711,6 +770,20 @@ type TelemetrySection struct {
711770
// +operator-sdk:csv:customresourcedefinitions:type=spec
712771
// AlertmanagerOverride, provides the ability to override the generated manifest of several child resources.
713772
AlertmanagerOverride Override `json:"alertmanagerOverride,omitempty"`
773+
774+
// ApplicationCredential allows service-specific overrides of the global AC configuration.
775+
// +operator-sdk:csv:customresourcedefinitions:type=spec
776+
// +kubebuilder:validation:Optional
777+
// +nullable
778+
// +kubebuilder:default={enabled:false}
779+
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
780+
781+
// AodhApplicationCredential allows service-specific overrides of the global AC configuration for Aodh.
782+
// +operator-sdk:csv:customresourcedefinitions:type=spec
783+
// +kubebuilder:validation:Optional
784+
// +nullable
785+
// +kubebuilder:default={enabled:false}
786+
AodhApplicationCredential *ServiceAppCredSection `json:"aodhApplicationCredential"`
714787
}
715788

716789
// SwiftSection defines the desired state of Swift service
@@ -730,6 +803,13 @@ type SwiftSection struct {
730803
// +operator-sdk:csv:customresourcedefinitions:type=spec
731804
// ProxyOverride, provides the ability to override the generated manifest of several child resources.
732805
ProxyOverride Override `json:"proxyOverride,omitempty"`
806+
807+
// ApplicationCredential allows service-specific overrides of the global AC configuration.
808+
// +operator-sdk:csv:customresourcedefinitions:type=spec
809+
// +kubebuilder:validation:Optional
810+
// +nullable
811+
// +kubebuilder:default={enabled:false}
812+
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
733813
}
734814

735815
// OctaviaSection defines the desired state of the Octavia service
@@ -749,6 +829,13 @@ type OctaviaSection struct {
749829
// +operator-sdk:csv:customresourcedefinitions:type=spec
750830
// APIOverride, provides the ability to override the generated manifest of several child resources.
751831
APIOverride Override `json:"apiOverride,omitempty"`
832+
833+
// ApplicationCredential allows service-specific overrides of the global AC configuration.
834+
// +operator-sdk:csv:customresourcedefinitions:type=spec
835+
// +kubebuilder:validation:Optional
836+
// +nullable
837+
// +kubebuilder:default={enabled:false}
838+
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
752839
}
753840

754841
// DesignateSection defines the desired state of the Designate service
@@ -768,6 +855,13 @@ type DesignateSection struct {
768855
// +operator-sdk:csv:customresourcedefinitions:type=spec
769856
// APIOverride, provides the ability to override the generated manifest of several child resources.
770857
APIOverride Override `json:"apiOverride,omitempty"`
858+
859+
// ApplicationCredential allows service-specific overrides of the global AC configuration.
860+
// +operator-sdk:csv:customresourcedefinitions:type=spec
861+
// +kubebuilder:validation:Optional
862+
// +nullable
863+
// +kubebuilder:default={enabled:false}
864+
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
771865
}
772866

773867
// BarbicanSection defines the desired state of Barbican service
@@ -787,6 +881,13 @@ type BarbicanSection struct {
787881
// +operator-sdk:csv:customresourcedefinitions:type=spec
788882
// APIOverride, provides the ability to override the generated manifest of several child resources.
789883
APIOverride Override `json:"apiOverride,omitempty"`
884+
885+
// ApplicationCredential allows service-specific overrides of the global AC configuration.
886+
// +operator-sdk:csv:customresourcedefinitions:type=spec
887+
// +kubebuilder:validation:Optional
888+
// +nullable
889+
// +kubebuilder:default={enabled:false}
890+
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
790891
}
791892

792893
// RedisSection defines the desired state of the Redis service
@@ -828,6 +929,94 @@ type WatcherSection struct {
828929
// +operator-sdk:csv:customresourcedefinitions:type=spec
829930
// APIOverride, provides the ability to override the generated manifest of several child resources.
830931
APIOverride Override `json:"apiOverride,omitempty"`
932+
933+
// ApplicationCredential allows service-specific overrides of the global AC configuration.
934+
// +operator-sdk:csv:customresourcedefinitions:type=spec
935+
// +kubebuilder:validation:Optional
936+
// +nullable
937+
// +kubebuilder:default={enabled:false}
938+
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
939+
}
940+
941+
// +kubebuilder:validation:XValidation:rule="self.gracePeriodDays < self.expirationDays",message="gracePeriodDays must be smaller than expirationDays"
942+
// ApplicationCredentialSection defines the desired configuration for ApplicationCredentials
943+
type ApplicationCredentialSection struct {
944+
// Enabled indicates whether an ApplicationCredential should be created
945+
// +kubebuilder:validation:Optional
946+
// +kubebuilder:default=false
947+
Enabled bool `json:"enabled"`
948+
949+
// ExpirationDays sets the lifetime in days for the AC
950+
// +kubebuilder:validation:Optional
951+
// +kubebuilder:default=365
952+
// +kubebuilder:validation:Minimum=2
953+
ExpirationDays *int `json:"expirationDays"`
954+
955+
// GracePeriodDays sets how many days before expiration the AC should be rotated
956+
// +kubebuilder:validation:Optional
957+
// +kubebuilder:default=182
958+
// +kubebuilder:validation:Minimum=1
959+
GracePeriodDays *int `json:"gracePeriodDays"`
960+
961+
// +kubebuilder:validation:Optional
962+
// +kubebuilder:default={"service"}
963+
// +kubebuilder:validation:MinItems=1
964+
// Roles to assign to the ApplicationCredential
965+
Roles []string `json:"roles"`
966+
967+
// +kubebuilder:validation:Optional
968+
// +kubebuilder:default=false
969+
// Whether the AC should be unrestricted
970+
Unrestricted *bool `json:"unrestricted"`
971+
972+
// AccessRules lets supply a custom list of rules
973+
// If unset, no accessRules field is emitted
974+
// +kubebuilder:validation:Optional
975+
// +listType=atomic
976+
AccessRules []ACRule `json:"accessRules,omitempty"`
977+
}
978+
979+
// +kubebuilder:validation:XValidation:rule="!(has(self.expirationDays) && has(self.gracePeriodDays)) || self.gracePeriodDays < self.expirationDays",message="gracePeriodDays must be smaller than expirationDays"
980+
// ServiceAppCredSection allows service-specific overrides of the global AC configuration
981+
type ServiceAppCredSection struct {
982+
// +kubebuilder:validation:Optional
983+
// +kubebuilder:default=false
984+
Enabled bool `json:"enabled"`
985+
986+
// +kubebuilder:validation:Optional
987+
// +kubebuilder:validation:Minimum=2
988+
ExpirationDays *int `json:"expirationDays,omitempty"`
989+
990+
// +kubebuilder:validation:Optional
991+
// +kubebuilder:validation:Minimum=1
992+
GracePeriodDays *int `json:"gracePeriodDays,omitempty"`
993+
994+
// +kubebuilder:validation:Optional
995+
// Roles to assign to the ApplicationCredential
996+
Roles []string `json:"roles,omitempty"`
997+
998+
// +kubebuilder:validation:Optional
999+
// Whether the AC should be unrestricted
1000+
Unrestricted *bool `json:"unrestricted,omitempty"`
1001+
1002+
// AccessRules lets the service override either the global rules
1003+
// +kubebuilder:validation:Optional
1004+
// +listType=atomic
1005+
AccessRules []ACRule `json:"accessRules,omitempty"`
1006+
}
1007+
1008+
// ACRule describes a single access rule for an ApplicationCredential
1009+
// +k8s:openapi-gen=true
1010+
type ACRule struct {
1011+
// Service is the name of the service to target (e.g. "identity").
1012+
// +kubebuilder:validation:Required
1013+
Service string `json:"service"`
1014+
// Path is the HTTP path (e.g. "/v3/auth/tokens").
1015+
// +kubebuilder:validation:Required
1016+
Path string `json:"path"`
1017+
// Method is the HTTP method to allow (e.g. "POST").
1018+
// +kubebuilder:validation:Required
1019+
Method string `json:"method"`
8311020
}
8321021

8331022
// OpenStackControlPlaneStatus defines the observed state of OpenStackControlPlane

0 commit comments

Comments
 (0)