Skip to content

WIP: Add support for External Keystone Service #653

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dmendiza wants to merge 5 commits into
base: main
Choose a base branch
from
+268 −62
Open

WIP: Add support for External Keystone Service #653

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
0e4e747
Add support for External Keystone Service
dmendiza Dec 4, 2025
cf6cdf0
Set region in status
vakwetu Dec 17, 2025
d2f5f27
Generate OpenStackClientConfig for External API
dmendiza Dec 18, 2025
9b6ca98
Remove interface from GetAdminServiceClient
dmendiza Dec 18, 2025
ebc9e38
Simplify verifyTLSInput function
dmendiza Jan 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions api/bases/keystone.openstack.org_keystoneapis.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,6 +98,11 @@ spec:
description: EnableSecureRBAC - Enable Consistent and Secure RBAC
policies
type: boolean
externalKeystoneAPI:
default: false
description: ExternalKeystoneAPI - Enable use of external Keystone
API endpoints instead of deploying a local Keystone API
type: boolean
extraMounts:
default: []
description: ExtraMounts containing conf files
Expand Down
21 changes: 21 additions & 0 deletions api/v1beta1/conditions.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,4 +111,25 @@ const (

// KeystoneServiceOSUserReadyErrorMessage
KeystoneServiceOSUserReadyErrorMessage = "Keystone Service user error occured %s"

//
// External Keystone API condition messages
//
// ExternalKeystoneAPIDBMessage
ExternalKeystoneAPIDBMessage = "External Keystone API configured - database is not managed by this operator"

// ExternalKeystoneAPIDBAccountMessage
ExternalKeystoneAPIDBAccountMessage = "External Keystone API configured - database account is not managed by this operator"

// ExternalKeystoneAPIRabbitMQTransportURLMessage
ExternalKeystoneAPIRabbitMQTransportURLMessage = "External Keystone API configured - RabbitMQ is not managed by this operator"

// ExternalKeystoneAPIMemcachedReadyMessage
ExternalKeystoneAPIMemcachedReadyMessage = "External Keystone API configured - memcached is not managed by this operator"

// ExternalKeystoneAPIServiceConfigReadyMessage
ExternalKeystoneAPIServiceMessage = "External Keystone API configured - service is not managed by this operator"

// ExternalKeystoneAPINetworkAttachmentsReadyMessage
ExternalKeystoneAPINetworkAttachmentsReadyMessage = "External Keystone API configured - network attachments are not managed by this operator"
)
12 changes: 8 additions & 4 deletions api/v1beta1/keystoneapi.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,6 @@ import (
"github.com/openstack-k8s-operators/lib-common/modules/common/endpoint"
"github.com/openstack-k8s-operators/lib-common/modules/common/helper"
"github.com/openstack-k8s-operators/lib-common/modules/common/secret"
"github.com/openstack-k8s-operators/lib-common/modules/common/tls"
"sigs.k8s.io/controller-runtime/pkg/client"
"sigs.k8s.io/controller-runtime/pkg/event"
"sigs.k8s.io/controller-runtime/pkg/predicate"
Expand Down Expand Up @@ -145,8 +144,13 @@ func GetScopedAdminServiceClient(
keystoneAPI *KeystoneAPI,
scope *gophercloud.AuthScope,
) (*openstack.OpenStack, ctrl.Result, error) {
// get public endpoint as authurl from keystone instance
authURL, err := keystoneAPI.GetEndpoint(endpoint.EndpointInternal)
// get endpoint as authurl from keystone instance
// default to internal endpoint if not specified
epInterface := endpoint.EndpointInternal
if keystoneAPI.Spec.ExternalKeystoneAPI {
epInterface = endpoint.Endpoint(endpoint.EndpointPublic)
}
authURL, err := keystoneAPI.GetEndpoint(epInterface)
if err != nil {
return nil, ctrl.Result{}, err
}
Expand All @@ -163,7 +167,7 @@ func GetScopedAdminServiceClient(
h,
keystoneAPI.Spec.TLS.CaBundleSecretName,
10*time.Second,
tls.InternalCABundleKey)
interfaceBundleKeys[epInterface])
if err != nil {
return nil, ctrl.Result{}, err
}
Expand Down
13 changes: 13 additions & 0 deletions api/v1beta1/keystoneapi_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,14 @@ const (
APIDefaultTimeout = 60
)

var (
// interfaceBundleKeys maps endpoint winterfaces to their corresponding key in the CA bundle secret
Copy link
Contributor Author

@dmendiza dmendiza Dec 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

s/winterfaces/interfaces/

interfaceBundleKeys = map[endpoint.Endpoint]string{
endpoint.EndpointInternal: tls.InternalCABundleKey,
endpoint.EndpointPublic: tls.CABundleKey,
}
)

// KeystoneAPISpec defines the desired state of KeystoneAPI
type KeystoneAPISpec struct {
KeystoneAPISpecCore `json:",inline"`
Expand Down Expand Up @@ -213,6 +221,11 @@ type KeystoneAPISpecCore struct {
// This is only needed when multiple realms are federated.
// Config files mount path is set to /var/lib/httpd/metadata/
FederatedRealmConfig string `json:"federatedRealmConfig"`

// +kubebuilder:validation:Optional
// +kubebuilder:default=false
// ExternalKeystoneAPI - Enable use of external Keystone API endpoints instead of deploying a local Keystone API
ExternalKeystoneAPI bool `json:"externalKeystoneAPI"`
}

// APIOverrideSpec to override the generated manifest of several child resources.
Expand Down
5 changes: 5 additions & 0 deletions config/crd/bases/keystone.openstack.org_keystoneapis.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,6 +98,11 @@ spec:
description: EnableSecureRBAC - Enable Consistent and Secure RBAC
policies
type: boolean
externalKeystoneAPI:
default: false
description: ExternalKeystoneAPI - Enable use of external Keystone
API endpoints instead of deploying a local Keystone API
type: boolean
extraMounts:
default: []
description: ExtraMounts containing conf files
Expand Down
Loading