Separate Openstack from Identity

As previously commented, having openstack state in a controlled
resource is a bad idea. This separates stuff out so that a shadow record
is created to hold state, so the managed resource is not required to be
updated.

charts/region/crds/region.unikorn-cloud.org_identities.yaml

@@ -57,40 +57,6 @@ spec:
           spec:
             description: IdentitySpec stores any state necessary to manage identity.
             properties:
-              openstack:
-                description: OpenStack is populated when the provider type is set
-                  to "openstack".
-                properties:
-                  applicationCredentialID:
-                    description: ApplicationCredentialID is the ID of the user's application
-                      credential.
-                    type: string
-                  applicationCredentialSecret:
-                    description: ApplicationCredentialSecret is the one-time secret
-                      for the application credential.
-                    type: string
-                  cloud:
-                    description: Cloud is the cloud name in the cloud config to use.
-                    type: string
-                  cloudConfig:
-                    description: CloudConfig is a client compatible cloud configuration.
-                    format: byte
-                    type: string
-                  password:
-                    description: Password is the login for the user.
-                    type: string
-                  projectID:
-                    description: ProjectID is the ID of the project created for the
-                      identity.
-                    type: string
-                  serverGroupID:
-                    description: ServerGroupID is the ID of the server group created
-                      for the identity.
-                    type: string
-                  userID:
-                    description: UserID is the ID of the user created for the identity.
-                    type: string
-                type: object
               pause:
                 description: Pause, if true, will inhibit reconciliation.
                 type: boolean

charts/region/crds/region.unikorn-cloud.org_openstackidentities.yaml

@@ -0,0 +1,87 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.14.0
+  name: openstackidentities.region.unikorn-cloud.org
+spec:
+  group: region.unikorn-cloud.org
+  names:
+    categories:
+    - unikorn
+    kind: OpenstackIdentity
+    listKind: OpenstackIdentityList
+    plural: openstackidentities
+    singular: openstackidentity
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .spec.provider
+      name: provider
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: OpenstackIdentity has no controller, its a database record of
+          state.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            properties:
+              applicationCredentialID:
+                description: ApplicationCredentialID is the ID of the user's application
+                  credential.
+                type: string
+              applicationCredentialSecret:
+                description: ApplicationCredentialSecret is the one-time secret for
+                  the application credential.
+                type: string
+              cloud:
+                description: Cloud is the cloud name in the cloud config to use.
+                type: string
+              cloudConfig:
+                description: CloudConfig is a client compatible cloud configuration.
+                format: byte
+                type: string
+              password:
+                description: Password is the login for the user.
+                type: string
+              projectID:
+                description: ProjectID is the ID of the project created for the identity.
+                type: string
+              serverGroupID:
+                description: ServerGroupID is the ID of the server group created for
+                  the identity.
+                type: string
+              userID:
+                description: UserID is the ID of the user created for the identity.
+                type: string
+            type: object
+          status:
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources: {}

charts/region/templates/identity-controller/clusterrole.yaml

@@ -21,6 +21,16 @@ rules:
   - identities/status
   verbs:
   - update
+- apiGroups:
+  - region.unikorn-cloud.org
+  resources:
+  - openstackidentities
+  verbs:
+  - list
+  - watch
+  - create
+  - update
+  - delete
 - apiGroups:
   - ""
   resources:
@@ -35,4 +45,3 @@ rules:
   verbs:
   - list
   - watch
-

charts/region/templates/region-controller/clusterrole.yaml

@@ -22,6 +22,13 @@ rules:
   - watch
   - create
   - delete
+- apiGroups:
+  - region.unikorn-cloud.org
+  resources:
+  - openstackidentities
+  verbs:
+  - list
+  - watch
 - apiGroups:
   - ""
   resources:

pkg/apis/unikorn/v1alpha1/register.go

@@ -50,6 +50,7 @@ var (
 func init() {
 	SchemeBuilder.Register(&Region{}, &RegionList{})
 	SchemeBuilder.Register(&Identity{}, &IdentityList{})
+	SchemeBuilder.Register(&OpenstackIdentity{}, &OpenstackIdentityList{})
 	SchemeBuilder.Register(&PhysicalNetwork{}, &PhysicalNetworkList{})
 }
 

pkg/apis/unikorn/v1alpha1/types.go

@@ -299,11 +299,35 @@ type IdentitySpec struct {
 	Tags TagList `json:"tags,omitempty"`
 	// Provider defines the provider type.
 	Provider Provider `json:"provider"`
-	// OpenStack is populated when the provider type is set to "openstack".
-	OpenStack *IdentitySpecOpenStack `json:"openstack,omitempty"`
 }
 
-type IdentitySpecOpenStack struct {
+type IdentityStatus struct {
+	// Current service state of a cluster manager.
+	Conditions []unikornv1core.Condition `json:"conditions,omitempty"`
+}
+
+// OpenstackIdentityList is a typed list of identities.
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type OpenstackIdentityList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []OpenstackIdentity `json:"items"`
+}
+
+// OpenstackIdentity has no controller, its a database record of state.
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +kubebuilder:resource:scope=Namespaced,categories=unikorn
+// +kubebuilder:printcolumn:name="provider",type="string",JSONPath=".spec.provider"
+// +kubebuilder:printcolumn:name="age",type="date",JSONPath=".metadata.creationTimestamp"
+type OpenstackIdentity struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+	Spec              OpenstackIdentitySpec   `json:"spec"`
+	Status            OpenstackIdentityStatus `json:"status,omitempty"`
+}
+
+type OpenstackIdentitySpec struct {
 	// CloudConfig is a client compatible cloud configuration.
 	CloudConfig []byte `json:"cloudConfig,omitempty"`
 	// Cloud is the cloud name in the cloud config to use.
@@ -322,10 +346,7 @@ type IdentitySpecOpenStack struct {
 	ServerGroupID *string `json:"serverGroupID,omitempty"`
 }
 
-type IdentityStatus struct {
-	// Current service state of a cluster manager.
-	Conditions []unikornv1core.Condition `json:"conditions,omitempty"`
-}
+type OpenstackIdentityStatus struct{}
 
 // PhysicalNetworkList s a typed list of physical networks.
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object