Separate Openstack from Identity

As previously commented, having openstack state in a controlled
resource is a bad idea. This separates stuff out so that a shadow record
is created to hold state, so the managed resource is not required to be
updated.

charts/region/crds/region.unikorn-cloud.org_identities.yaml

@@ -57,40 +57,6 @@ spec:
           spec:
             description: IdentitySpec stores any state necessary to manage identity.
             properties:
-              openstack:
-                description: OpenStack is populated when the provider type is set
-                  to "openstack".
-                properties:
-                  applicationCredentialID:
-                    description: ApplicationCredentialID is the ID of the user's application
-                      credential.
-                    type: string
-                  applicationCredentialSecret:
-                    description: ApplicationCredentialSecret is the one-time secret
-                      for the application credential.
-                    type: string
-                  cloud:
-                    description: Cloud is the cloud name in the cloud config to use.
-                    type: string
-                  cloudConfig:
-                    description: CloudConfig is a client compatible cloud configuration.
-                    format: byte
-                    type: string
-                  password:
-                    description: Password is the login for the user.
-                    type: string
-                  projectID:
-                    description: ProjectID is the ID of the project created for the
-                      identity.
-                    type: string
-                  serverGroupID:
-                    description: ServerGroupID is the ID of the server group created
-                      for the identity.
-                    type: string
-                  userID:
-                    description: UserID is the ID of the user created for the identity.
-                    type: string
-                type: object
               pause:
                 description: Pause, if true, will inhibit reconciliation.
                 type: boolean

charts/region/crds/region.unikorn-cloud.org_openstackidentities.yaml

@@ -0,0 +1,87 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.14.0
+  name: openstackidentities.region.unikorn-cloud.org
+spec:
+  group: region.unikorn-cloud.org
+  names:
+    categories:
+    - unikorn
+    kind: OpenstackIdentity
+    listKind: OpenstackIdentityList
+    plural: openstackidentities
+    singular: openstackidentity
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .spec.provider
+      name: provider
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: OpenstackIdentity has no controller, its a database record of
+          state.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            properties:
+              applicationCredentialID:
+                description: ApplicationCredentialID is the ID of the user's application
+                  credential.
+                type: string
+              applicationCredentialSecret:
+                description: ApplicationCredentialSecret is the one-time secret for
+                  the application credential.
+                type: string
+              cloud:
+                description: Cloud is the cloud name in the cloud config to use.
+                type: string
+              cloudConfig:
+                description: CloudConfig is a client compatible cloud configuration.
+                format: byte
+                type: string
+              password:
+                description: Password is the login for the user.
+                type: string
+              projectID:
+                description: ProjectID is the ID of the project created for the identity.
+                type: string
+              serverGroupID:
+                description: ServerGroupID is the ID of the server group created for
+                  the identity.
+                type: string
+              userID:
+                description: UserID is the ID of the user created for the identity.
+                type: string
+            type: object
+          status:
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources: {}

charts/region/templates/identity-controller/clusterrole.yaml

@@ -21,6 +21,16 @@ rules:
   - identities/status
   verbs:
   - update
+- apiGroups:
+  - region.unikorn-cloud.org
+  resources:
+  - openstackidentities
+  verbs:
+  - list
+  - watch
+  - create
+  - update
+  - delete
 - apiGroups:
   - ""
   resources:
@@ -35,4 +45,3 @@ rules:
   verbs:
   - list
   - watch
-

charts/region/templates/region-controller/clusterrole.yaml

@@ -22,6 +22,13 @@ rules:
   - watch
   - create
   - delete
+- apiGroups:
+  - region.unikorn-cloud.org
+  resources:
+  - openstackidentities
+  verbs:
+  - list
+  - watch
 - apiGroups:
   - ""
   resources:

charts/region/templates/region-controller/ingress.yaml

@@ -6,6 +6,11 @@ metadata:
     {{- include "unikorn.labels" . | nindent 4 }}
   annotations:
     {{- include "unikorn.ingress.clusterIssuer.annotations" . | nindent 4 }}
+    # mTLS is used to authenticate other Unikorn services
+    nginx.ingress.kubernetes.io/auth-tls-verify-client: optional
+    nginx.ingress.kubernetes.io/auth-tls-secret: cert-manager/unikorn-client-ca
+    nginx.ingress.kubernetes.io/auth-tls-verify-depth: "1"
+    nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream: "true"
     {{- if (include "unikorn.ingress.externalDNS" .) }}
     external-dns.alpha.kubernetes.io/hostname: {{ include "unikorn.region.host" . }}
     {{- end }}

go.mod

@@ -96,3 +96,9 @@ require (
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
 )
+
+replace github.com/unikorn-cloud/core => github.com/unikorn-cloud/core v0.1.65-0.20240813085140-a05a6cc08ec0
+
+replace github.com/unikorn-cloud/identity => github.com/unikorn-cloud/identity v0.2.30-0.20240814141651-b9fd2252971e
+
+replace github.com/unikorn-cloud/region => github.com/unikorn-cloud/region v0.1.33-0.20240813105551-7bcbcff4171e

go.sum

@@ -138,12 +138,10 @@ github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsT
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/ugorji/go/codec v1.2.12 h1:9LC83zGrHhuUA9l16C9AHXAqEV/2wBQ4nkvumAE65EE=
 github.com/ugorji/go/codec v1.2.12/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZgYf6w6lg=
-github.com/unikorn-cloud/core v0.1.63 h1:Jl/xuoGRKESMXhS1+apcaS/1I776agTyT75BGz9AKBA=
-github.com/unikorn-cloud/core v0.1.63/go.mod h1:JcUIQW3+oiZPUQmOlENw3OCi35IBxPKa+J4MbP3TO7k=
-github.com/unikorn-cloud/core v0.1.64 h1:4GqACg1YOmUrDo5euXz0yi753Mzx1TBg7fioRKysb1g=
-github.com/unikorn-cloud/core v0.1.64/go.mod h1:JcUIQW3+oiZPUQmOlENw3OCi35IBxPKa+J4MbP3TO7k=
-github.com/unikorn-cloud/identity v0.2.29 h1:kKEJmh6tjjdvZWYdZhyRewG3aHf9wmWwG5C/kb+Rm9A=
-github.com/unikorn-cloud/identity v0.2.29/go.mod h1:ujrL+6kRUrPIk4Z0Yc12A+FDy6L4b2Hgzz6oGZlKfGI=
+github.com/unikorn-cloud/core v0.1.65-0.20240813085140-a05a6cc08ec0 h1:bSt/UfAZCtEruyPqPmK485ybuRBjbhzl/JDnGvZUvcY=
+github.com/unikorn-cloud/core v0.1.65-0.20240813085140-a05a6cc08ec0/go.mod h1:JcUIQW3+oiZPUQmOlENw3OCi35IBxPKa+J4MbP3TO7k=
+github.com/unikorn-cloud/identity v0.2.30-0.20240814141651-b9fd2252971e h1:VS735VW16SbuLmUiHBrhcRWIyuqr7Bsfdtup3nmLoGk=
+github.com/unikorn-cloud/identity v0.2.30-0.20240814141651-b9fd2252971e/go.mod h1:V8tke7F57cB5OVGfRBy76Sv8qZ8g1ShqJ+ZhhbzBBmU=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=

pkg/apis/unikorn/v1alpha1/register.go

@@ -50,6 +50,7 @@ var (
 func init() {
 	SchemeBuilder.Register(&Region{}, &RegionList{})
 	SchemeBuilder.Register(&Identity{}, &IdentityList{})
+	SchemeBuilder.Register(&OpenstackIdentity{}, &OpenstackIdentityList{})
 	SchemeBuilder.Register(&PhysicalNetwork{}, &PhysicalNetworkList{})
 }
 

pkg/apis/unikorn/v1alpha1/types.go

@@ -299,11 +299,35 @@ type IdentitySpec struct {
 	Tags TagList `json:"tags,omitempty"`
 	// Provider defines the provider type.
 	Provider Provider `json:"provider"`
-	// OpenStack is populated when the provider type is set to "openstack".
-	OpenStack *IdentitySpecOpenStack `json:"openstack,omitempty"`
 }
 
-type IdentitySpecOpenStack struct {
+type IdentityStatus struct {
+	// Current service state of a cluster manager.
+	Conditions []unikornv1core.Condition `json:"conditions,omitempty"`
+}
+
+// OpenstackIdentityList is a typed list of identities.
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type OpenstackIdentityList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []OpenstackIdentity `json:"items"`
+}
+
+// OpenstackIdentity has no controller, its a database record of state.
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +kubebuilder:resource:scope=Namespaced,categories=unikorn
+// +kubebuilder:printcolumn:name="provider",type="string",JSONPath=".spec.provider"
+// +kubebuilder:printcolumn:name="age",type="date",JSONPath=".metadata.creationTimestamp"
+type OpenstackIdentity struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+	Spec              OpenstackIdentitySpec   `json:"spec"`
+	Status            OpenstackIdentityStatus `json:"status,omitempty"`
+}
+
+type OpenstackIdentitySpec struct {
 	// CloudConfig is a client compatible cloud configuration.
 	CloudConfig []byte `json:"cloudConfig,omitempty"`
 	// Cloud is the cloud name in the cloud config to use.
@@ -322,10 +346,7 @@ type IdentitySpecOpenStack struct {
 	ServerGroupID *string `json:"serverGroupID,omitempty"`
 }
 
-type IdentityStatus struct {
-	// Current service state of a cluster manager.
-	Conditions []unikornv1core.Condition `json:"conditions,omitempty"`
-}
+type OpenstackIdentityStatus struct{}
 
 // PhysicalNetworkList s a typed list of physical networks.
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object