Skip to content

Commit b704ab1

Browse files
stuggiclaude
stuggi
and
claude
committed
[b/r] Add OpenStackBackupConfig controller
Add the BackupConfig CRD, API types, controller, RBAC, samples, and envtests for the backup/restore labeling feature. The controller watches CRD instances across operators and labels resources (secrets, configmaps, NADs, cert-manager issuers) with backup.openstack.org labels for backup/restore integration. Supports annotation overrides on individual resources to customize restore ordering or exclude from backup. Jira: OSPRH-22912 Jira: OSPRH-22913 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Martin Schuppert <mschuppert@redhat.com>
1 parent 74d3795 commit b704ab1

36 files changed

Lines changed: 3524 additions & 5 deletions

‎PROJECT‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,4 +99,13 @@ resources:
9999
kind: OpenStack
100100
path: github.com/openstack-k8s-operators/openstack-operator/api/operator/v1beta1
101101
version: v1beta1
102+
- api:
103+
crdVersion: v1
104+
namespaced: true
105+
controller: true
106+
domain: openstack.org
107+
group: backup
108+
kind: OpenStackBackupConfig
109+
path: github.com/openstack-k8s-operators/openstack-operator/api/backup/v1beta1
110+
version: v1beta1
102111
version: "3"

‎api/backup/v1beta1/conditions.go‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
package v1beta1
2+
3+
import (
4+
condition "github.com/openstack-k8s-operators/lib-common/modules/common/condition"
5+
)
6+
7+
// Condition types for OpenStackBackupConfig
8+
const (
9+
// OpenStackBackupConfigSecretsReadyCondition - Secrets labeling status
10+
OpenStackBackupConfigSecretsReadyCondition condition.Type = "SecretsReady"
11+
12+
// OpenStackBackupConfigConfigMapsReadyCondition - ConfigMaps labeling status
13+
OpenStackBackupConfigConfigMapsReadyCondition condition.Type = "ConfigMapsReady"
14+
15+
// OpenStackBackupConfigNADsReadyCondition - NetworkAttachmentDefinitions labeling status
16+
OpenStackBackupConfigNADsReadyCondition condition.Type = "NADsReady"
17+
18+
// OpenStackBackupConfigIssuersReadyCondition - cert-manager Issuers labeling status
19+
OpenStackBackupConfigIssuersReadyCondition condition.Type = "IssuersReady"
20+
21+
// OpenStackBackupConfigCRsReadyCondition - CR instances labeling status
22+
OpenStackBackupConfigCRsReadyCondition condition.Type = "CRsReady"
23+
)

‎api/backup/v1beta1/groupversion_info.go‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
/*
2+
Copyright 2022.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
// Package v1beta1 contains API Schema definitions for the backup v1beta1 API group.
18+
// +kubebuilder:object:generate=true
19+
// +groupName=backup.openstack.org
20+
package v1beta1
21+
22+
import (
23+
"k8s.io/apimachinery/pkg/runtime/schema"
24+
"sigs.k8s.io/controller-runtime/pkg/scheme"
25+
)
26+
27+
var (
28+
// GroupVersion is group version used to register these objects.
29+
GroupVersion = schema.GroupVersion{Group: "backup.openstack.org", Version: "v1beta1"}
30+
31+
// SchemeBuilder is used to add go types to the GroupVersionKind scheme.
32+
SchemeBuilder = &scheme.Builder{GroupVersion: GroupVersion}
33+
34+
// AddToScheme adds the types in this group-version to the given scheme.
35+
AddToScheme = SchemeBuilder.AddToScheme
36+
)

‎api/backup/v1beta1/openstackbackupconfig_types.go‎

Lines changed: 158 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
/*
2+
Copyright 2022.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package v1beta1
18+
19+
import (
20+
condition "github.com/openstack-k8s-operators/lib-common/modules/common/condition"
21+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
22+
)
23+
24+
// BackupLabelingPolicy controls whether backup labeling is active for a resource type
25+
// +kubebuilder:validation:Enum=enabled;disabled
26+
type BackupLabelingPolicy string
27+
28+
const (
29+
// BackupLabelingEnabled enables backup labeling for the resource type
30+
BackupLabelingEnabled BackupLabelingPolicy = "enabled"
31+
// BackupLabelingDisabled disables backup labeling for the resource type
32+
BackupLabelingDisabled BackupLabelingPolicy = "disabled"
33+
)
34+
35+
// OpenStackBackupConfigSpec defines the desired state of OpenStackBackupConfig.
36+
type OpenStackBackupConfigSpec struct {
37+
// DefaultRestoreOrder is the restore order assigned to user-provided resources
38+
// +kubebuilder:validation:Optional
39+
// +kubebuilder:default="10"
40+
DefaultRestoreOrder string `json:"defaultRestoreOrder"`
41+
42+
// Secrets configuration for backup labeling
43+
// +kubebuilder:validation:Optional
44+
// +kubebuilder:default={labeling:enabled}
45+
Secrets ResourceBackupConfig `json:"secrets"`
46+
47+
// ConfigMaps configuration for backup labeling
48+
// Defaults: Excludes kube-root-ca.crt and openshift-service-ca.crt
49+
// +kubebuilder:validation:Optional
50+
// +kubebuilder:default={labeling:enabled,excludeNames:{"kube-root-ca.crt","openshift-service-ca.crt"}}
51+
ConfigMaps ResourceBackupConfig `json:"configMaps"`
52+
53+
// NetworkAttachmentDefinitions configuration for backup labeling
54+
// +kubebuilder:validation:Optional
55+
// +kubebuilder:default={labeling:enabled}
56+
NetworkAttachmentDefinitions ResourceBackupConfig `json:"networkAttachmentDefinitions"`
57+
58+
// Issuers configuration for backup labeling of cert-manager Issuers.
59+
// Only custom (user-provided) Issuers without ownerReferences are labeled.
60+
// Operator-created Issuers (rootca-*, selfsigned-issuer) have ownerRefs
61+
// and are recreated by the operator during reconciliation.
62+
// Custom Issuers default to restore order 20 (after secrets at order 10,
63+
// since Issuers reference CA secrets).
64+
// +kubebuilder:validation:Optional
65+
// +kubebuilder:default={labeling:enabled,restoreOrder:"20"}
66+
Issuers ResourceBackupConfig `json:"issuers"`
67+
}
68+
69+
// ResourceBackupConfig defines backup labeling rules for a resource type
70+
type ResourceBackupConfig struct {
71+
// Labeling controls whether to label this resource type for backup
72+
// +kubebuilder:validation:Optional
73+
Labeling *BackupLabelingPolicy `json:"labeling,omitempty"`
74+
75+
// RestoreOrder overrides the default restore order for this resource type.
76+
// If empty, the global DefaultRestoreOrder is used.
77+
// +kubebuilder:validation:Optional
78+
RestoreOrder string `json:"restoreOrder,omitempty"`
79+
80+
// ExcludeLabelKeys is a list of label keys - resources with any of these labels are excluded
81+
// Example: ["service-cert", "osdp-service"] excludes service-cert and dataplane service secrets
82+
// +kubebuilder:validation:Optional
83+
ExcludeLabelKeys []string `json:"excludeLabelKeys,omitempty"`
84+
85+
// ExcludeNames is a list of resource names to exclude from backup labeling
86+
// Example: ["kube-root-ca.crt", "openshift-service-ca.crt"] for system ConfigMaps
87+
// +kubebuilder:validation:Optional
88+
ExcludeNames []string `json:"excludeNames,omitempty"`
89+
90+
// IncludeLabelSelector allows filtering resources by label selector
91+
// Only resources matching this selector will be labeled (in addition to ownerRef check)
92+
// +kubebuilder:validation:Optional
93+
IncludeLabelSelector map[string]string `json:"includeLabelSelector,omitempty"`
94+
}
95+
96+
// OpenStackBackupConfigStatus defines the observed state of OpenStackBackupConfig.
97+
type OpenStackBackupConfigStatus struct {
98+
// LabeledResources tracks how many resources of each type were labeled
99+
// +kubebuilder:validation:Optional
100+
LabeledResources ResourceCounts `json:"labeledResources,omitempty"`
101+
102+
// Conditions represents the latest available observations of the resource's current state
103+
// +operator-sdk:csv:customresourcedefinitions:type=status
104+
Conditions condition.Conditions `json:"conditions,omitempty"`
105+
}
106+
107+
// ResourceCounts tracks labeled resource counts by type
108+
type ResourceCounts struct {
109+
// Secrets is the number of secrets labeled for backup
110+
// +kubebuilder:validation:Optional
111+
Secrets int `json:"secrets,omitempty"`
112+
113+
// ConfigMaps is the number of configmaps labeled for backup
114+
// +kubebuilder:validation:Optional
115+
ConfigMaps int `json:"configMaps,omitempty"`
116+
117+
// NetworkAttachmentDefinitions is the number of NADs labeled for backup
118+
// +kubebuilder:validation:Optional
119+
NetworkAttachmentDefinitions int `json:"networkAttachmentDefinitions,omitempty"`
120+
121+
// Issuers is the number of cert-manager Issuers labeled for backup
122+
// +kubebuilder:validation:Optional
123+
Issuers int `json:"issuers,omitempty"`
124+
}
125+
126+
// +kubebuilder:object:root=true
127+
// +kubebuilder:subresource:status
128+
// +kubebuilder:resource:shortName=osbkpcfg
129+
// +kubebuilder:printcolumn:name="Secrets",type="integer",JSONPath=".status.labeledResources.secrets",description="Labeled Secrets"
130+
// +kubebuilder:printcolumn:name="ConfigMaps",type="integer",JSONPath=".status.labeledResources.configMaps",description="Labeled ConfigMaps"
131+
// +kubebuilder:printcolumn:name="NADs",type="integer",JSONPath=".status.labeledResources.networkAttachmentDefinitions",description="Labeled NADs"
132+
// +kubebuilder:printcolumn:name="Custom Issuers",type="integer",JSONPath=".status.labeledResources.issuers",description="Labeled custom cert-manager Issuers (without ownerReferences)"
133+
// +kubebuilder:metadata:labels=backup.openstack.org/restore=true
134+
// +kubebuilder:metadata:labels=backup.openstack.org/category=controlplane
135+
// +kubebuilder:metadata:labels=backup.openstack.org/restore-order=20
136+
137+
// OpenStackBackupConfig is the Schema for the openstackbackupconfigs API.
138+
// It configures automatic backup labeling for user-provided resources (without ownerReferences).
139+
type OpenStackBackupConfig struct {
140+
metav1.TypeMeta `json:",inline"`
141+
metav1.ObjectMeta `json:"metadata,omitempty"`
142+
143+
Spec OpenStackBackupConfigSpec `json:"spec,omitempty"`
144+
Status OpenStackBackupConfigStatus `json:"status,omitempty"`
145+
}
146+
147+
// +kubebuilder:object:root=true
148+
149+
// OpenStackBackupConfigList contains a list of OpenStackBackupConfig.
150+
type OpenStackBackupConfigList struct {
151+
metav1.TypeMeta `json:",inline"`
152+
metav1.ListMeta `json:"metadata,omitempty"`
153+
Items []OpenStackBackupConfig `json:"items"`
154+
}
155+
156+
func init() {
157+
SchemeBuilder.Register(&OpenStackBackupConfig{}, &OpenStackBackupConfigList{})
158+
}

0 commit comments

Comments
 (0)