Skip to content

Commit f5a74e2

Browse files
Deydra71Deydra71
committed
Adding roles, access rules and unrestricted AC support
Signed-off-by: Veronika Fisarova <vfisarov@redhat.com>
1 parent 6ed1e4b commit f5a74e2

File tree

11 files changed

+595
-9
lines changed

11 files changed

+595
-9
lines changed

‎apis/bases/core.openstack.org_openstackcontrolplanes.yaml‎

Lines changed: 147 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,17 @@ spec:
5353
default: 7
5454
minimum: 1
5555
type: integer
56+
roles:
57+
default:
58+
- admin
59+
- service
60+
items:
61+
type: string
62+
minItems: 1
63+
type: array
64+
unrestricted:
65+
default: false
66+
type: boolean
5667
type: object
5768
x-kubernetes-validations:
5869
- message: gracePeriodDays must be smaller than expirationDays
@@ -188,6 +199,17 @@ spec:
188199
enabled: false
189200
nullable: true
190201
properties:
202+
accessRules:
203+
items:
204+
properties:
205+
method:
206+
type: string
207+
path:
208+
type: string
209+
service:
210+
type: string
211+
type: object
212+
type: array
191213
enabled:
192214
default: false
193215
type: boolean
@@ -197,6 +219,12 @@ spec:
197219
gracePeriodDays:
198220
minimum: 1
199221
type: integer
222+
roles:
223+
items:
224+
type: string
225+
type: array
226+
unrestricted:
227+
type: boolean
200228
type: object
201229
x-kubernetes-validations:
202230
- message: gracePeriodDays must be smaller than expirationDays
@@ -709,6 +737,17 @@ spec:
709737
enabled: false
710738
nullable: true
711739
properties:
740+
accessRules:
741+
items:
742+
properties:
743+
method:
744+
type: string
745+
path:
746+
type: string
747+
service:
748+
type: string
749+
type: object
750+
type: array
712751
enabled:
713752
default: false
714753
type: boolean
@@ -718,6 +757,12 @@ spec:
718757
gracePeriodDays:
719758
minimum: 1
720759
type: integer
760+
roles:
761+
items:
762+
type: string
763+
type: array
764+
unrestricted:
765+
type: boolean
721766
type: object
722767
x-kubernetes-validations:
723768
- message: gracePeriodDays must be smaller than expirationDays
@@ -3507,6 +3552,17 @@ spec:
35073552
enabled: false
35083553
nullable: true
35093554
properties:
3555+
accessRules:
3556+
items:
3557+
properties:
3558+
method:
3559+
type: string
3560+
path:
3561+
type: string
3562+
service:
3563+
type: string
3564+
type: object
3565+
type: array
35103566
enabled:
35113567
default: false
35123568
type: boolean
@@ -3516,6 +3572,12 @@ spec:
35163572
gracePeriodDays:
35173573
minimum: 1
35183574
type: integer
3575+
roles:
3576+
items:
3577+
type: string
3578+
type: array
3579+
unrestricted:
3580+
type: boolean
35193581
type: object
35203582
x-kubernetes-validations:
35213583
- message: gracePeriodDays must be smaller than expirationDays
@@ -8422,6 +8484,17 @@ spec:
84228484
enabled: false
84238485
nullable: true
84248486
properties:
8487+
accessRules:
8488+
items:
8489+
properties:
8490+
method:
8491+
type: string
8492+
path:
8493+
type: string
8494+
service:
8495+
type: string
8496+
type: object
8497+
type: array
84258498
enabled:
84268499
default: false
84278500
type: boolean
@@ -8431,6 +8504,12 @@ spec:
84318504
gracePeriodDays:
84328505
minimum: 1
84338506
type: integer
8507+
roles:
8508+
items:
8509+
type: string
8510+
type: array
8511+
unrestricted:
8512+
type: boolean
84348513
type: object
84358514
x-kubernetes-validations:
84368515
- message: gracePeriodDays must be smaller than expirationDays
@@ -9239,6 +9318,17 @@ spec:
92399318
enabled: false
92409319
nullable: true
92419320
properties:
9321+
accessRules:
9322+
items:
9323+
properties:
9324+
method:
9325+
type: string
9326+
path:
9327+
type: string
9328+
service:
9329+
type: string
9330+
type: object
9331+
type: array
92429332
enabled:
92439333
default: false
92449334
type: boolean
@@ -9248,6 +9338,12 @@ spec:
92489338
gracePeriodDays:
92499339
minimum: 1
92509340
type: integer
9341+
roles:
9342+
items:
9343+
type: string
9344+
type: array
9345+
unrestricted:
9346+
type: boolean
92519347
type: object
92529348
x-kubernetes-validations:
92539349
- message: gracePeriodDays must be smaller than expirationDays
@@ -11691,6 +11787,17 @@ spec:
1169111787
enabled: false
1169211788
nullable: true
1169311789
properties:
11790+
accessRules:
11791+
items:
11792+
properties:
11793+
method:
11794+
type: string
11795+
path:
11796+
type: string
11797+
service:
11798+
type: string
11799+
type: object
11800+
type: array
1169411801
enabled:
1169511802
default: false
1169611803
type: boolean
@@ -11700,6 +11807,12 @@ spec:
1170011807
gracePeriodDays:
1170111808
minimum: 1
1170211809
type: integer
11810+
roles:
11811+
items:
11812+
type: string
11813+
type: array
11814+
unrestricted:
11815+
type: boolean
1170311816
type: object
1170411817
x-kubernetes-validations:
1170511818
- message: gracePeriodDays must be smaller than expirationDays
@@ -16163,6 +16276,17 @@ spec:
1616316276
enabled: false
1616416277
nullable: true
1616516278
properties:
16279+
accessRules:
16280+
items:
16281+
properties:
16282+
method:
16283+
type: string
16284+
path:
16285+
type: string
16286+
service:
16287+
type: string
16288+
type: object
16289+
type: array
1616616290
enabled:
1616716291
default: false
1616816292
type: boolean
@@ -16172,6 +16296,12 @@ spec:
1617216296
gracePeriodDays:
1617316297
minimum: 1
1617416298
type: integer
16299+
roles:
16300+
items:
16301+
type: string
16302+
type: array
16303+
unrestricted:
16304+
type: boolean
1617516305
type: object
1617616306
x-kubernetes-validations:
1617716307
- message: gracePeriodDays must be smaller than expirationDays
@@ -16794,6 +16924,17 @@ spec:
1679416924
enabled: false
1679516925
nullable: true
1679616926
properties:
16927+
accessRules:
16928+
items:
16929+
properties:
16930+
method:
16931+
type: string
16932+
path:
16933+
type: string
16934+
service:
16935+
type: string
16936+
type: object
16937+
type: array
1679716938
enabled:
1679816939
default: false
1679916940
type: boolean
@@ -16803,6 +16944,12 @@ spec:
1680316944
gracePeriodDays:
1680416945
minimum: 1
1680516946
type: integer
16947+
roles:
16948+
items:
16949+
type: string
16950+
type: array
16951+
unrestricted:
16952+
type: boolean
1680616953
type: object
1680716954
x-kubernetes-validations:
1680816955
- message: gracePeriodDays must be smaller than expirationDays

‎apis/core/v1beta1/openstackcontrolplane_types.go‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -878,6 +878,17 @@ type ApplicationCredentialSection struct {
878878
// +kubebuilder:default=7
879879
// +kubebuilder:validation:Minimum=1
880880
GracePeriodDays *int `json:"gracePeriodDays,omitempty"`
881+
882+
// +kubebuilder:validation:Optional
883+
// +kubebuilder:default={"admin","service"}
884+
// +kubebuilder:validation:MinItems=1
885+
// Roles to assign to the ApplicationCredential
886+
Roles []string `json:"roles,omitempty"`
887+
888+
// +kubebuilder:validation:Optional
889+
// +kubebuilder:default=false
890+
// Whether the AC should be unrestricted
891+
Unrestricted *bool `json:"unrestricted,omitempty"`
881892
}
882893

883894
// +kubebuilder:validation:XValidation:rule="!(has(self.expirationDays) && has(self.gracePeriodDays)) || self.gracePeriodDays < self.expirationDays",message="gracePeriodDays must be smaller than expirationDays"
@@ -894,6 +905,33 @@ type ServiceAppCredSection struct {
894905
// +kubebuilder:validation:Optional
895906
// +kubebuilder:validation:Minimum=1
896907
GracePeriodDays *int `json:"gracePeriodDays,omitempty"`
908+
909+
// +kubebuilder:validation:Optional
910+
// Roles to assign to the ApplicationCredential
911+
Roles []string `json:"roles,omitempty"`
912+
913+
// +kubebuilder:validation:Optional
914+
// Whether the AC should be unrestricted
915+
Unrestricted *bool `json:"unrestricted,omitempty"`
916+
917+
// +kubebuilder:validation:Optional
918+
// Set service specific AC access rules
919+
AccessRules []ACRule `json:"accessRules,omitempty"`
920+
}
921+
922+
// ACRule sets access rules for AC
923+
type ACRule struct {
924+
// Service is the OpenStack service type
925+
// +kubebuilder:validation:Optional
926+
Service string `json:"service"`
927+
928+
// Path is the API path to allow
929+
// +kubebuilder:validation:Optional
930+
Path string `json:"path,omitempty"`
931+
932+
// Method is the HTTP verb to allow (defaults to all if empty)
933+
// +kubebuilder:validation:Optional
934+
Method string `json:"method,omitempty"`
897935
}
898936

899937
// OpenStackControlPlaneStatus defines the observed state of OpenStackControlPlane

‎apis/core/v1beta1/zz_generated.deepcopy.go‎

Lines changed: 40 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎apis/go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -116,4 +116,4 @@ replace github.com/openshift/api => github.com/openshift/api v0.0.0-202408300231
116116
// custom RabbitmqClusterSpecCore for OpenStackControlplane (v2.9.0_patches_tag)
117117
replace github.com/rabbitmq/cluster-operator/v2 => github.com/openstack-k8s-operators/rabbitmq-cluster-operator/v2 v2.6.1-0.20241017142550-a3524acedd49 //allow-merging
118118

119-
replace github.com/openstack-k8s-operators/keystone-operator/api => github.com/Deydra71/keystone-operator/api v0.0.0-20250514070500-15fcdb912b2c
119+
replace github.com/openstack-k8s-operators/keystone-operator/api => github.com/Deydra71/keystone-operator/api v0.0.0-20250516124117-1428c333f73e

‎apis/go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
github.com/Deydra71/keystone-operator/api v0.0.0-20250514070500-15fcdb912b2c h1:DXnHQg/+AjMsoJqvQEusjkyjOsOPGbKJ8uRVLyTkseQ=
2-
github.com/Deydra71/keystone-operator/api v0.0.0-20250514070500-15fcdb912b2c/go.mod h1:VPkYswnrCtlSMTeYjgxTOpfNN7zvxqa+kZ8EWDJaFrg=
1+
github.com/Deydra71/keystone-operator/api v0.0.0-20250516124117-1428c333f73e h1:1fN4dK/dqIYoJrdkN+rdnaRdOVTIsxfs6a0RFyseSRQ=
2+
github.com/Deydra71/keystone-operator/api v0.0.0-20250516124117-1428c333f73e/go.mod h1:VPkYswnrCtlSMTeYjgxTOpfNN7zvxqa+kZ8EWDJaFrg=
33
github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
44
github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
55
github.com/cert-manager/cert-manager v1.14.7 h1:C2L59sMGMdSpd8SPx5qfPAL7ejZaNxJBRd24S7Ws5Ek=

0 commit comments

Comments
 (0)