Skip to content

Commit edb1584

Browse files
Deydra71Deydra71
committed
AppCred support
Signed-off-by: Veronika Fisarova <vfisarov@redhat.com>
1 parent acae36c commit edb1584

17 files changed

+1211
-96
lines changed

‎apis/bases/core.openstack.org_openstackcontrolplanes.yaml‎

Lines changed: 169 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,23 @@ spec:
4040
type: object
4141
spec:
4242
properties:
43+
applicationCredential:
44+
properties:
45+
enabled:
46+
default: false
47+
type: boolean
48+
expirationDays:
49+
default: 14
50+
minimum: 2
51+
type: integer
52+
gracePeriodDays:
53+
default: 7
54+
minimum: 1
55+
type: integer
56+
type: object
57+
x-kubernetes-validations:
58+
- message: gracePeriodDays must be smaller than expirationDays
59+
rule: self.gracePeriodDays < self.expirationDays
4360
barbican:
4461
properties:
4562
apiOverride:
@@ -166,6 +183,25 @@ spec:
166183
type: string
167184
type: object
168185
type: object
186+
applicationCredential:
187+
default:
188+
enabled: false
189+
nullable: true
190+
properties:
191+
enabled:
192+
default: false
193+
type: boolean
194+
expirationDays:
195+
minimum: 2
196+
type: integer
197+
gracePeriodDays:
198+
minimum: 1
199+
type: integer
200+
type: object
201+
x-kubernetes-validations:
202+
- message: gracePeriodDays must be smaller than expirationDays
203+
rule: '!(has(self.expirationDays) && has(self.gracePeriodDays))
204+
|| self.gracePeriodDays < self.expirationDays'
169205
enabled:
170206
default: true
171207
type: boolean
@@ -668,6 +704,25 @@ spec:
668704
type: string
669705
type: object
670706
type: object
707+
applicationCredential:
708+
default:
709+
enabled: false
710+
nullable: true
711+
properties:
712+
enabled:
713+
default: false
714+
type: boolean
715+
expirationDays:
716+
minimum: 2
717+
type: integer
718+
gracePeriodDays:
719+
minimum: 1
720+
type: integer
721+
type: object
722+
x-kubernetes-validations:
723+
- message: gracePeriodDays must be smaller than expirationDays
724+
rule: '!(has(self.expirationDays) && has(self.gracePeriodDays))
725+
|| self.gracePeriodDays < self.expirationDays'
671726
enabled:
672727
default: true
673728
type: boolean
@@ -3447,6 +3502,25 @@ spec:
34473502
type: object
34483503
type: object
34493504
type: object
3505+
applicationCredential:
3506+
default:
3507+
enabled: false
3508+
nullable: true
3509+
properties:
3510+
enabled:
3511+
default: false
3512+
type: boolean
3513+
expirationDays:
3514+
minimum: 2
3515+
type: integer
3516+
gracePeriodDays:
3517+
minimum: 1
3518+
type: integer
3519+
type: object
3520+
x-kubernetes-validations:
3521+
- message: gracePeriodDays must be smaller than expirationDays
3522+
rule: '!(has(self.expirationDays) && has(self.gracePeriodDays))
3523+
|| self.gracePeriodDays < self.expirationDays'
34503524
enabled:
34513525
default: true
34523526
type: boolean
@@ -8343,6 +8417,25 @@ spec:
83438417
type: string
83448418
type: object
83458419
type: object
8420+
applicationCredential:
8421+
default:
8422+
enabled: false
8423+
nullable: true
8424+
properties:
8425+
enabled:
8426+
default: false
8427+
type: boolean
8428+
expirationDays:
8429+
minimum: 2
8430+
type: integer
8431+
gracePeriodDays:
8432+
minimum: 1
8433+
type: integer
8434+
type: object
8435+
x-kubernetes-validations:
8436+
- message: gracePeriodDays must be smaller than expirationDays
8437+
rule: '!(has(self.expirationDays) && has(self.gracePeriodDays))
8438+
|| self.gracePeriodDays < self.expirationDays'
83468439
enabled:
83478440
default: true
83488441
type: boolean
@@ -9141,6 +9234,25 @@ spec:
91419234
type: string
91429235
type: object
91439236
type: object
9237+
applicationCredential:
9238+
default:
9239+
enabled: false
9240+
nullable: true
9241+
properties:
9242+
enabled:
9243+
default: false
9244+
type: boolean
9245+
expirationDays:
9246+
minimum: 2
9247+
type: integer
9248+
gracePeriodDays:
9249+
minimum: 1
9250+
type: integer
9251+
type: object
9252+
x-kubernetes-validations:
9253+
- message: gracePeriodDays must be smaller than expirationDays
9254+
rule: '!(has(self.expirationDays) && has(self.gracePeriodDays))
9255+
|| self.gracePeriodDays < self.expirationDays'
91449256
cellOverride:
91459257
additionalProperties:
91469258
properties:
@@ -11559,6 +11671,25 @@ spec:
1155911671
type: string
1156011672
type: object
1156111673
type: object
11674+
applicationCredential:
11675+
default:
11676+
enabled: false
11677+
nullable: true
11678+
properties:
11679+
enabled:
11680+
default: false
11681+
type: boolean
11682+
expirationDays:
11683+
minimum: 2
11684+
type: integer
11685+
gracePeriodDays:
11686+
minimum: 1
11687+
type: integer
11688+
type: object
11689+
x-kubernetes-validations:
11690+
- message: gracePeriodDays must be smaller than expirationDays
11691+
rule: '!(has(self.expirationDays) && has(self.gracePeriodDays))
11692+
|| self.gracePeriodDays < self.expirationDays'
1156211693
enabled:
1156311694
default: true
1156411695
type: boolean
@@ -16006,6 +16137,25 @@ spec:
1600616137
type: string
1600716138
swift:
1600816139
properties:
16140+
applicationCredential:
16141+
default:
16142+
enabled: false
16143+
nullable: true
16144+
properties:
16145+
enabled:
16146+
default: false
16147+
type: boolean
16148+
expirationDays:
16149+
minimum: 2
16150+
type: integer
16151+
gracePeriodDays:
16152+
minimum: 1
16153+
type: integer
16154+
type: object
16155+
x-kubernetes-validations:
16156+
- message: gracePeriodDays must be smaller than expirationDays
16157+
rule: '!(has(self.expirationDays) && has(self.gracePeriodDays))
16158+
|| self.gracePeriodDays < self.expirationDays'
1600916159
enabled:
1601016160
default: true
1601116161
type: boolean
@@ -16618,6 +16768,25 @@ spec:
1661816768
type: string
1661916769
type: object
1662016770
type: object
16771+
applicationCredential:
16772+
default:
16773+
enabled: false
16774+
nullable: true
16775+
properties:
16776+
enabled:
16777+
default: false
16778+
type: boolean
16779+
expirationDays:
16780+
minimum: 2
16781+
type: integer
16782+
gracePeriodDays:
16783+
minimum: 1
16784+
type: integer
16785+
type: object
16786+
x-kubernetes-validations:
16787+
- message: gracePeriodDays must be smaller than expirationDays
16788+
rule: '!(has(self.expirationDays) && has(self.gracePeriodDays))
16789+
|| self.gracePeriodDays < self.expirationDays'
1662116790
enabled:
1662216791
default: true
1662316792
type: boolean

‎apis/core/v1beta1/openstackcontrolplane_types.go‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -212,6 +212,11 @@ type OpenStackControlPlaneSpec struct {
212212
// TopologyRef to apply the Topology defined by the associated CR referenced
213213
// by name
214214
TopologyRef *topologyv1.TopoRef `json:"topologyRef,omitempty"`
215+
216+
// +kubebuilder:validation:Optional
217+
// +operator-sdk:csv:customresourcedefinitions:type=spec
218+
// ApplicationCredential - Parameters related to the ApplicationCredential
219+
ApplicationCredential ApplicationCredentialSection `json:"applicationCredential"`
215220
}
216221

217222
// TLSSection defines the desired state of TLS configuration
@@ -406,6 +411,13 @@ type PlacementSection struct {
406411
// +operator-sdk:csv:customresourcedefinitions:type=spec
407412
// APIOverride, provides the ability to override the generated manifest of several child resources.
408413
APIOverride Override `json:"apiOverride,omitempty"`
414+
415+
// ApplicationCredential allows service-specific overrides of the global AC configuration.
416+
// +operator-sdk:csv:customresourcedefinitions:type=spec
417+
// +kubebuilder:validation:Optional
418+
// +nullable
419+
// +kubebuilder:default={enabled:false}
420+
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
409421
}
410422

411423
// GlanceSection defines the desired state of Glance service
@@ -432,6 +444,13 @@ type GlanceSection struct {
432444
// Convenient to avoid podname (and thus hostname) collision between different deployments.
433445
// Useful for CI jobs as well as preproduction and production environments that use the same storage backend, etc.
434446
UniquePodNames bool `json:"uniquePodNames"`
447+
448+
// ApplicationCredential allows service-specific overrides of the global AC configuration.
449+
// +operator-sdk:csv:customresourcedefinitions:type=spec
450+
// +kubebuilder:validation:Optional
451+
// +nullable
452+
// +kubebuilder:default={enabled:false}
453+
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
435454
}
436455

437456
// CinderSection defines the desired state of Cinder service
@@ -458,6 +477,13 @@ type CinderSection struct {
458477
// Convenient to avoid podname (and thus hostname) collision between different deployments.
459478
// Useful for CI jobs as well as preproduction and production environments that use the same storage backend, etc.
460479
UniquePodNames bool `json:"uniquePodNames"`
480+
481+
// ApplicationCredential allows service-specific overrides of the global AC configuration.
482+
// +operator-sdk:csv:customresourcedefinitions:type=spec
483+
// +kubebuilder:validation:Optional
484+
// +nullable
485+
// +kubebuilder:default={enabled:false}
486+
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
461487
}
462488

463489
// GaleraSection defines the desired state of Galera services
@@ -551,6 +577,13 @@ type NeutronSection struct {
551577
// +operator-sdk:csv:customresourcedefinitions:type=spec
552578
// APIOverride, provides the ability to override the generated manifest of several child resources.
553579
APIOverride Override `json:"apiOverride,omitempty"`
580+
581+
// ApplicationCredential allows service-specific overrides of the global AC configuration.
582+
// +operator-sdk:csv:customresourcedefinitions:type=spec
583+
// +kubebuilder:validation:Optional
584+
// +nullable
585+
// +kubebuilder:default={enabled:false}
586+
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
554587
}
555588

556589
// NovaSection defines the desired state of Nova services
@@ -577,6 +610,13 @@ type NovaSection struct {
577610
// for a nova cell. cell0 never have compute nodes and therefore it won't have a noVNCProxy deployed.
578611
// Providing an override for cell0 noVNCProxy does not have an effect.
579612
CellOverride map[string]NovaCellOverrideSpec `json:"cellOverride,omitempty"`
613+
614+
// ApplicationCredential allows service-specific overrides of the global AC configuration.
615+
// +operator-sdk:csv:customresourcedefinitions:type=spec
616+
// +kubebuilder:validation:Optional
617+
// +nullable
618+
// +kubebuilder:default={enabled:false}
619+
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
580620
}
581621

582622
// NovaCellOverrideSpec to override the generated manifest of several child resources.
@@ -698,6 +738,13 @@ type TelemetrySection struct {
698738
// +operator-sdk:csv:customresourcedefinitions:type=spec
699739
// AlertmanagerOverride, provides the ability to override the generated manifest of several child resources.
700740
AlertmanagerOverride Override `json:"alertmanagerOverride,omitempty"`
741+
742+
// ApplicationCredential allows service-specific overrides of the global AC configuration.
743+
// +operator-sdk:csv:customresourcedefinitions:type=spec
744+
// +kubebuilder:validation:Optional
745+
// +nullable
746+
// +kubebuilder:default={enabled:false}
747+
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
701748
}
702749

703750
// SwiftSection defines the desired state of Swift service
@@ -717,6 +764,13 @@ type SwiftSection struct {
717764
// +operator-sdk:csv:customresourcedefinitions:type=spec
718765
// ProxyOverride, provides the ability to override the generated manifest of several child resources.
719766
ProxyOverride Override `json:"proxyOverride,omitempty"`
767+
768+
// ApplicationCredential allows service-specific overrides of the global AC configuration.
769+
// +operator-sdk:csv:customresourcedefinitions:type=spec
770+
// +kubebuilder:validation:Optional
771+
// +nullable
772+
// +kubebuilder:default={enabled:false}
773+
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
720774
}
721775

722776
// OctaviaSection defines the desired state of the Octavia service
@@ -774,6 +828,13 @@ type BarbicanSection struct {
774828
// +operator-sdk:csv:customresourcedefinitions:type=spec
775829
// APIOverride, provides the ability to override the generated manifest of several child resources.
776830
APIOverride Override `json:"apiOverride,omitempty"`
831+
832+
// ApplicationCredential allows service-specific overrides of the global AC configuration.
833+
// +operator-sdk:csv:customresourcedefinitions:type=spec
834+
// +kubebuilder:validation:Optional
835+
// +nullable
836+
// +kubebuilder:default={enabled:false}
837+
ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"`
777838
}
778839

779840
// RedisSection defines the desired state of the Redis service
@@ -798,6 +859,43 @@ type OpenStackClientSection struct {
798859
Template v1beta1.OpenStackClientSpecCore `json:"template,omitempty"`
799860
}
800861

862+
// +kubebuilder:validation:XValidation:rule="self.gracePeriodDays < self.expirationDays",message="gracePeriodDays must be smaller than expirationDays"
863+
// ApplicationCredentialSection defines the desired configuration for ApplicationCredentials
864+
type ApplicationCredentialSection struct {
865+
// Enabled indicates whether an ApplicationCredential should be created
866+
// +kubebuilder:validation:Optional
867+
// +kubebuilder:default=false
868+
Enabled bool `json:"enabled"`
869+
870+
// ExpirationDays sets the lifetime in days for the AC
871+
// +kubebuilder:validation:Optional
872+
// +kubebuilder:default=14
873+
// +kubebuilder:validation:Minimum=2
874+
ExpirationDays *int `json:"expirationDays,omitempty"`
875+
876+
// GracePeriodDays sets how many days before expiration the AC should be rotated
877+
// +kubebuilder:validation:Optional
878+
// +kubebuilder:default=7
879+
// +kubebuilder:validation:Minimum=1
880+
GracePeriodDays *int `json:"gracePeriodDays,omitempty"`
881+
}
882+
883+
// +kubebuilder:validation:XValidation:rule="!(has(self.expirationDays) && has(self.gracePeriodDays)) || self.gracePeriodDays < self.expirationDays",message="gracePeriodDays must be smaller than expirationDays"
884+
// ServiceAppCredSection allows service-specific overrides of the global AC configuration
885+
type ServiceAppCredSection struct {
886+
// +kubebuilder:validation:Optional
887+
// +kubebuilder:default=false
888+
Enabled bool `json:"enabled"`
889+
890+
// +kubebuilder:validation:Optional
891+
// +kubebuilder:validation:Minimum=2
892+
ExpirationDays *int `json:"expirationDays,omitempty"`
893+
894+
// +kubebuilder:validation:Optional
895+
// +kubebuilder:validation:Minimum=1
896+
GracePeriodDays *int `json:"gracePeriodDays,omitempty"`
897+
}
898+
801899
// OpenStackControlPlaneStatus defines the observed state of OpenStackControlPlane
802900
type OpenStackControlPlaneStatus struct {
803901
// +operator-sdk:csv:customresourcedefinitions:type=status,xDescriptors={"urn:alm:descriptor:io.kubernetes.conditions"}

0 commit comments

Comments
 (0)