Deprecate OpenStackDataPlaneService CertsFrom and EDPMRoleServiceName fields

The CertsFrom and EDPMRoleServiceName were both added to solve slightly
different use cases related to ansible content and expected mount paths
in the AEE pod. Later, EDPMServiceType was also added to more broadly
solve all the related issues.

This patch deprecates CertsFrom and EDPMRoleServiceName in favor of
using EDPMServiceType exclusively. The deprecated fields can still be
used with the same functionality until they are officially removed. The
existing usage of EDPMServiceType has also been expanded to cover all
use cases of the previous fields, of which there were 2 cases:

The first was in the deployment controller where certs are issued.
EDPMServiceType is now considered and used to issue certs when it's set
differently than the service name.

The second instance addresses the usage of CertsFrom for creating cert
mounts for the install-certs service. EDPMServiceType is now considered
there as well if it's set differently from the service name.

Signed-off-by: James Slagle <[email protected]>

Author: slagle

apis/dataplane/v1beta1/openstackdataplaneservice_types.go

@@ -53,6 +53,7 @@ type OpenstackDataPlaneServiceCert struct {
 	// not set, OpenStackDataPlaneService.Spec.EDPMServiceType is used. If
 	// OpenStackDataPlaneService.Spec.EDPMServiceType is not set, then
 	// OpenStackDataPlaneService.Name is used.
+	// DEPRECATED: Will be removed in a future release. Use EDPMServiceType instead.
 	EDPMRoleServiceName string `json:"edpmRoleServiceName,omitempty"`
 }
 
@@ -88,6 +89,7 @@ type OpenStackDataPlaneServiceSpec struct {
 	// CertsFrom - Service name used to obtain TLSCert and CACerts data. If both
 	// CertsFrom and either TLSCert or CACerts is set, then those fields take
 	// precedence.
+	// DEPRECATED: Will be removed in a future release. Use EDPMServiceType instead.
 	// +kubebuilder:validation:Optional
 	CertsFrom string `json:"certsFrom,omitempty" yaml:"certsFrom,omitempty"`
 

apis/operator/v1beta1/conditions.go

@@ -42,5 +42,4 @@ const (
 
 	// OpenStackOperatorReadyMessage
 	OpenStackOperatorReadyMessage = "OpenStackOperator completed"
-
 )

controllers/dataplane/openstackdataplanedeployment_controller.go

@@ -209,22 +209,21 @@ func (r *OpenStackDataPlaneDeploymentReconciler) Reconcile(ctx context.Context,
 			nsConditions := instance.Status.NodeSetConditions[nodeSet.Name]
 
 			for _, serviceName := range services {
-				service, err := deployment.GetService(ctx, helper, serviceName)
+				service, err := r.GetService(ctx, helper, instance, nsConditions, serviceName)
 				if err != nil {
-					instance.Status.Conditions.MarkFalse(
-						condition.InputReadyCondition,
-						condition.ErrorReason,
-						condition.SeverityError,
-						dataplanev1.ServiceErrorMessage,
-						err.Error())
-					nsConditions.MarkFalse(
-						dataplanev1.NodeSetDeploymentReadyCondition,
-						condition.ErrorReason,
-						condition.SeverityError,
-						dataplanev1.ServiceErrorMessage,
-						err.Error())
 					return ctrl.Result{}, err
 				}
+
+				// If there is a different EDPMServiceType set and TLSCerts is
+				// not also set, get the service referenced by EDPMServiceType
+				// instead and use its cert data.
+				if serviceName != service.Spec.EDPMServiceType && service.Spec.TLSCerts == nil {
+					service, err = r.GetService(ctx, helper, instance, nsConditions, service.Spec.EDPMServiceType)
+					if err != nil {
+						return ctrl.Result{}, err
+					}
+				}
+
 				if service.Spec.TLSCerts != nil {
 					for certKey := range service.Spec.TLSCerts {
 						result, err := deployment.EnsureTLSCerts(ctx, helper, &nodeSet,
@@ -397,6 +396,32 @@ func (r *OpenStackDataPlaneDeploymentReconciler) Reconcile(ctx context.Context,
 	return ctrl.Result{}, nil
 }
 
+// GetService
+func (r *OpenStackDataPlaneDeploymentReconciler) GetService(
+	ctx context.Context,
+	helper *helper.Helper,
+	instance *dataplanev1.OpenStackDataPlaneDeployment,
+	nsConditions condition.Conditions,
+	serviceName string,
+) (dataplanev1.OpenStackDataPlaneService, error) {
+	service, err := deployment.GetService(ctx, helper, serviceName)
+	if err != nil {
+		instance.Status.Conditions.MarkFalse(
+			condition.InputReadyCondition,
+			condition.ErrorReason,
+			condition.SeverityError,
+			dataplanev1.ServiceErrorMessage,
+			err.Error())
+		nsConditions.MarkFalse(
+			dataplanev1.NodeSetDeploymentReadyCondition,
+			condition.ErrorReason,
+			condition.SeverityError,
+			dataplanev1.ServiceErrorMessage,
+			err.Error())
+	}
+	return service, err
+}
+
 func (r *OpenStackDataPlaneDeploymentReconciler) setHashes(
 	ctx context.Context,
 	helper *helper.Helper,

pkg/dataplane/deployment.go

@@ -273,6 +273,16 @@ func (d *Deployer) addCertMounts(
 			}
 		}
 
+		if service.Spec.EDPMServiceType != service.Name && service.Spec.TLSCerts == nil {
+			if slices.Contains(services, service.Spec.EDPMServiceType) {
+				continue
+			}
+			service, err = GetService(d.Ctx, d.Helper, service.Spec.EDPMServiceType)
+			if err != nil {
+				return nil, err
+			}
+		}
+
 		if service.Spec.TLSCerts != nil && d.NodeSet.Spec.TLSEnabled {
 			// sort cert list to ensure mount list is consistent
 			certKeyList := make([]string, 0, len(service.Spec.TLSCerts))