Skip to content

Commit ae58bdd

Browse files
Eneman DonatienDonatien26
Eneman Donatien
authored and
Donatien26
committed
[ENH] ✨ implement s3instanceref and default and add
allowedNamespaces
1 parent 34b85b3 commit ae58bdd

28 files changed

+983
-869
lines changed

‎README.md‎

Lines changed: 18 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -74,25 +74,16 @@ The operator exposes a few parameters, meant to be set as arguments, though it's
7474

7575
The parameters are summarized in the table below :
7676

77-
| Flag name | Default | Environment variable | Multiple values allowed | Description |
78-
| ------------------------------- | ---------------- | -------------------- | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
79-
| `health-probe-bind-address` | `:8081` | - | no | The address the probe endpoint binds to. Comes from Operator SDK. |
80-
| `leader-elect` | `false` | - | no | Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager. Comes from Operator SDK. |
81-
| `metrics-bind-address` | `:8080` | - | no | The address the metric endpoint binds to. Comes from Operator SDK. |
82-
| `region` | `us-east-1` | - | no | The region to configure for the S3 client. |
83-
| `s3-access-key` | - | `S3_ACCESS_KEY` | no | The access key used to interact with the S3 server. |
84-
| `s3-ca-certificate-base64` | - | - | yes | (Optional) Base64 encoded, PEM format CA certificate, for https requests to the S3 server. |
85-
| `s3-ca-certificate-bundle-path` | - | - | no | (Optional) Path to a CA certificates bundle file, for https requests to the S3 server. |
86-
| `s3-endpoint-url` | `localhost:9000` | - | no | Hostname (or hostname:port) of the S3 server. |
87-
| `s3-provider` | `minio` | - | no | S3 provider (possible values : `minio`, `mockedS3Provider`) |
88-
| `s3-secret-key` | - | `S3_SECRET_KEY` | no | The secret key used to interact with the S3 server. |
89-
| `useSsl` | true | - | no | Use of SSL/TLS to connect to the S3 server |
90-
| `bucket-deletion` | false | - | no | Trigger bucket deletion on the S3 backend upon CR deletion. Will fail if bucket is not empty. |
91-
| `policy-deletion` | false | - | no | Trigger policy deletion on the S3 backend upon CR deletion |
92-
| `path-deletion` | false | - | no | Trigger path deletion on the S3 backend upon CR deletion. Limited to deleting the `.keep` files used by the operator. |
93-
| `s3User-deletion` | false | - | no | Trigger S3User deletion on the S3 backend upon CR deletion. |
94-
| `override-existing-secret` | false | - | no | Update secret linked to s3User if already exist, else noop |
95-
| `s3LabelSelector` | "" | - | no | Filter resource that this instance will manage. If Empty all resource in the cluster will be manage |
77+
| Flag name | Default | Environment variable | Multiple values allowed | Description |
78+
| --------------------------- | ------- | -------------------- | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
79+
| `health-probe-bind-address` | `:8081` | - | no | The address the probe endpoint binds to. Comes from Operator SDK. |
80+
| `leader-elect` | `false` | - | no | Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager. Comes from Operator SDK. |
81+
| `metrics-bind-address` | `:8080` | - | no | The address the metric endpoint binds to. Comes from Operator SDK. | |
82+
| `bucket-deletion` | false | - | no | Trigger bucket deletion on the S3 backend upon CR deletion. Will fail if bucket is not empty. |
83+
| `policy-deletion` | false | - | no | Trigger policy deletion on the S3 backend upon CR deletion |
84+
| `path-deletion` | false | - | no | Trigger path deletion on the S3 backend upon CR deletion. Limited to deleting the `.keep` files used by the operator. |
85+
| `s3User-deletion` | false | - | no | Trigger S3User deletion on the S3 backend upon CR deletion. |
86+
| `override-existing-secret` | false | - | no | Update secret linked to s3User if already exist, else noop |
9687
## Minimal rights needed to work
9788

9889
The Operator need at least this rights:
@@ -170,6 +161,7 @@ spec:
170161
secretName: minio-credentials # Name of the secret containing 2 Keys S3_ACCESS_KEY and S3_SECRET_KEY
171162
region: us-east-1 # Region of the Provider
172163
useSSL: true # useSSL to query the Provider
164+
allowedNamespaces: [] # namespaces allowed to have buckets, policies, ... Wildcard prefix/suffix allowed. If empty only the same namespace as s3instance is allowed
173165
```
174166
175167
### Bucket example
@@ -307,6 +299,13 @@ spec:
307299

308300
Each S3user is linked to a kubernetes secret which have the same name that the S3User. The secret contains 2 keys: `accessKey` and `secretKey`.
309301

302+
### :info: How works s3InstanceRef
303+
304+
S3InstanceRef can get the following values:
305+
- empty: In this case the s3instance use will be the default one configured at startup if the namespace is in the namespace allowed for this s3Instance
306+
- `s3InstanceName`: In this case the s3Instance use will be the s3Instance with the name `s3InstanceName` in the current namespace (if the current namespace is allowed)
307+
- `namespace/s3InstanceName`: In this case the s3Instance use will be the s3Instance with the name `s3InstanceName` in the namespace `namespace` (if the current namespace is allowed to use this s3Instance)
308+
310309
## Operator SDK generated guidelines
311310

312311
<details>

‎api/v1alpha1/bucket_types.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,8 +37,9 @@ type BucketSpec struct {
3737
Paths []string `json:"paths,omitempty"`
3838

3939
// s3InstanceRef where create the bucket
40-
// +kubebuilder:validation:Optional
41-
S3InstanceRef string `json:"s3InstanceRef,omitempty"`
40+
// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="s3InstanceRef is immutable"
41+
// +kubebuilder:default=s3-operator/default
42+
S3InstanceRef string `json:"s3InstanceRef"`
4243

4344
// Quota to apply to the bucket
4445
// +kubebuilder:validation:Required

‎api/v1alpha1/path_types.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,8 @@ type PathSpec struct {
3737
Paths []string `json:"paths,omitempty"`
3838

3939
// s3InstanceRef where create the Paths
40-
// +kubebuilder:validation:Optional
40+
// +kubebuilder:default=s3-operator/default
41+
// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="s3InstanceRef is immutable"
4142
S3InstanceRef string `json:"s3InstanceRef,omitempty"`
4243
}
4344

‎api/v1alpha1/policy_types.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,8 @@ type PolicySpec struct {
3737
PolicyContent string `json:"policyContent"`
3838

3939
// s3InstanceRef where create the Policy
40-
// +kubebuilder:validation:Optional
40+
// +kubebuilder:default=s3-operator/default
41+
// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="s3InstanceRef is immutable"
4142
S3InstanceRef string `json:"s3InstanceRef,omitempty"`
4243
}
4344

‎api/v1alpha1/s3instance_types.go‎

Lines changed: 27 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -28,27 +28,46 @@ type S3InstanceSpec struct {
2828

2929
// type of the S3Instance
3030
// +kubebuilder:validation:Required
31+
// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="S3Provider is immutable"
32+
// +kubebuilder:default=minio
33+
// +kubebuilder:validation:Enum=minio;mockedS3Provider
3134
S3Provider string `json:"s3Provider"`
3235

3336
// url of the S3Instance
3437
// +kubebuilder:validation:Required
35-
UrlEndpoint string `json:"urlEndpoint"`
38+
Url string `json:"url"`
3639

37-
// SecretName associated to the S3Instance containing accessKey and secretKey
40+
// Ref to Secret associated to the S3Instance containing accessKey and secretKey
3841
// +kubebuilder:validation:Required
39-
SecretName string `json:"secretName"`
42+
SecretRef string `json:"secretRef"`
4043

4144
// region associated to the S3Instance
42-
// +kubebuilder:validation:Required
45+
// +kubebuilder:validation:Optional
4346
Region string `json:"region"`
4447

45-
// useSSL when connecting to the S3Instance
48+
// Secret containing key ca.crt with the certificate associated to the S3InstanceUrl
4649
// +kubebuilder:validation:Optional
47-
UseSSL bool `json:"useSSL,omitempty"`
50+
CaCertSecretRef string `json:"caCertSecretRef,omitempty"`
4851

49-
// CaCertificatesBase64 associated to the S3InstanceUrl
52+
// AllowedNamespaces to use this S3InstanceUrl if empty only the namespace of this instance url is allowed to use it
5053
// +kubebuilder:validation:Optional
51-
CaCertificatesBase64 []string `json:"caCertificateBase64,omitempty"`
54+
AllowedNamespaces []string `json:"allowedNamespaces,omitempty"`
55+
56+
// BucketDeletionEnabled Trigger bucket deletion on the S3 backend upon CR deletion. Will fail if bucket is not empty.
57+
// +kubebuilder:default=false
58+
BucketDeletionEnabled bool `json:"bucketDeletionEnabled"`
59+
60+
// PolicyDeletionEnabled Trigger policy deletion on the S3 backend upon CR deletion.
61+
// +kubebuilder:default=false
62+
PolicyDeletionEnabled bool `json:"policyDeletionEnabled"`
63+
64+
// PathDeletionEnabled Trigger path deletion on the S3 backend upon CR deletion. Limited to deleting the `.keep` files used by the operator.
65+
// +kubebuilder:default=false
66+
PathDeletionEnabled bool `json:"pathDeletionEnabled"`
67+
68+
// S3UserDeletionEnabled Trigger S3 deletion on the S3 backend upon CR deletion.
69+
// +kubebuilder:default=false
70+
S3UserDeletionEnabled bool `json:"s3UserDeletionEnabled"`
5271
}
5372

5473
// S3InstanceStatus defines the observed state of S3Instance

‎api/v1alpha1/s3user_types.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,8 @@ type S3UserSpec struct {
3939
SecretName string `json:"secretName"`
4040

4141
// s3InstanceRef where create the user
42-
// +kubebuilder:validation:Optional
42+
// +kubebuilder:default=s3-operator/default
43+
// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="s3InstanceRef is immutable"
4344
S3InstanceRef string `json:"s3InstanceRef,omitempty"`
4445
}
4546

‎api/v1alpha1/types.go‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
package v1alpha1
2+
3+
// Definitions to manage status condition types
4+
const (
5+
// ConditionReconciled represents the status of the resource reconciliation
6+
ConditionReconciled = "Reconciled"
7+
)
8+
9+
// Definitions to manage status condition reasons
10+
const (
11+
Reconciling = "Reconciling"
12+
Unreachable = "Unreachable"
13+
CreationFailure = "CreationFailure"
14+
Reconciled = "Reconciled"
15+
DeletionFailure = "DeletionFailure"
16+
)

‎api/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/s3.onyxia.sh_buckets.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,11 +58,16 @@ spec:
5858
- default
5959
type: object
6060
s3InstanceRef:
61+
default: s3-operator/default
6162
description: s3InstanceRef where create the bucket
6263
type: string
64+
x-kubernetes-validations:
65+
- message: s3InstanceRef is immutable
66+
rule: self == oldSelf
6367
required:
6468
- name
6569
- quota
70+
- s3InstanceRef
6671
type: object
6772
status:
6873
description: BucketStatus defines the observed state of Bucket

‎config/crd/bases/s3.onyxia.sh_paths.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,8 +44,12 @@ spec:
4444
type: string
4545
type: array
4646
s3InstanceRef:
47+
default: s3-operator/default
4748
description: s3InstanceRef where create the Paths
4849
type: string
50+
x-kubernetes-validations:
51+
- message: s3InstanceRef is immutable
52+
rule: self == oldSelf
4953
required:
5054
- bucketName
5155
type: object

0 commit comments

Comments
 (0)