From 33b4c09bb995ffed678a72cd17644466aa31d665 Mon Sep 17 00:00:00 2001 From: Doug Goldstein Date: Tue, 13 Oct 2026 09:55:02 -0500 Subject: [PATCH] site-workflows: trigger automation users on an account label Trigger the keystone automation user upsert and delete on the presence of the keystone.understack.rackspace.com/account label, so that the keystone-user label can be dropped in the future. Rename the roles annotation to keystone-roles to make it clear that it is a list. Update the ExternalSecrets in components/openstack and the docs to match. --- .../templates/eventsource-k8s-secrets.yaml | 4 ++-- .../sensor-keystone-automation-user-delete.yaml | 2 +- .../sensor-keystone-automation-user-upsert.yaml | 2 +- .../automation-baremetal-manage.yaml.tpl | 4 +++- .../automation-infrasetup-system.yaml.tpl | 4 +++- .../templates/automation-infrasetup.yaml.tpl | 4 +++- .../openstack-resource-controller.yaml.tpl | 4 +++- docs/deploy-guide/openstack-automation-users.md | 16 +++++++++++----- 8 files changed, 27 insertions(+), 13 deletions(-) diff --git a/charts/site-workflows/templates/eventsource-k8s-secrets.yaml b/charts/site-workflows/templates/eventsource-k8s-secrets.yaml index d44139b75..cb3e9c86a 100644 --- a/charts/site-workflows/templates/eventsource-k8s-secrets.yaml +++ b/charts/site-workflows/templates/eventsource-k8s-secrets.yaml @@ -18,7 +18,7 @@ spec: - UPDATE filter: labels: - - key: understack.rackspace.com/keystone-user + - key: keystone.understack.rackspace.com/account operation: exists keystone-automation-user-delete: namespace: openstack @@ -29,6 +29,6 @@ spec: - DELETE filter: labels: - - key: understack.rackspace.com/keystone-user + - key: keystone.understack.rackspace.com/account operation: exists {{- end }} diff --git a/charts/site-workflows/templates/sensor-keystone-automation-user-delete.yaml b/charts/site-workflows/templates/sensor-keystone-automation-user-delete.yaml index 317034d1f..e6d5a23e2 100644 --- a/charts/site-workflows/templates/sensor-keystone-automation-user-delete.yaml +++ b/charts/site-workflows/templates/sensor-keystone-automation-user-delete.yaml @@ -73,7 +73,7 @@ spec: dest: spec.template.spec.containers.0.env.2.value - src: dependencyName: secret-dep - dataKey: body.metadata.annotations.understack\.rackspace\.com/keystone-role + dataKey: body.metadata.annotations.understack\.rackspace\.com/keystone-roles value: "" dest: spec.template.spec.containers.0.env.3.value retryStrategy: diff --git a/charts/site-workflows/templates/sensor-keystone-automation-user-upsert.yaml b/charts/site-workflows/templates/sensor-keystone-automation-user-upsert.yaml index 8af1760e9..c38fe3171 100644 --- a/charts/site-workflows/templates/sensor-keystone-automation-user-upsert.yaml +++ b/charts/site-workflows/templates/sensor-keystone-automation-user-upsert.yaml @@ -73,7 +73,7 @@ spec: # last-applied-configuration) may contain secret data - src: dependencyName: secret-dep - dataKey: body.metadata.annotations.understack\.rackspace\.com/keystone-role + dataKey: body.metadata.annotations.understack\.rackspace\.com/keystone-roles value: "" dest: spec.template.spec.containers.0.env.3.value - src: diff --git a/components/openstack/templates/automation-baremetal-manage.yaml.tpl b/components/openstack/templates/automation-baremetal-manage.yaml.tpl index 6558ef920..5f35a5861 100644 --- a/components/openstack/templates/automation-baremetal-manage.yaml.tpl +++ b/components/openstack/templates/automation-baremetal-manage.yaml.tpl @@ -21,8 +21,10 @@ spec: engineVersion: v2 type: Opaque metadata: + annotations: + understack.rackspace.com/keystone-roles: infra-readwrite labels: - understack.rackspace.com/keystone-role: infra-readwrite + keystone.understack.rackspace.com/account: "true" understack.rackspace.com/keystone-user: "baremetal-manage-{{ .Values.regionName }}" data: password: "{{ `{{ .password }}` }}" diff --git a/components/openstack/templates/automation-infrasetup-system.yaml.tpl b/components/openstack/templates/automation-infrasetup-system.yaml.tpl index 086216ab9..ef9714428 100644 --- a/components/openstack/templates/automation-infrasetup-system.yaml.tpl +++ b/components/openstack/templates/automation-infrasetup-system.yaml.tpl @@ -21,8 +21,10 @@ spec: engineVersion: v2 type: Opaque metadata: + annotations: + understack.rackspace.com/keystone-roles: system-readwrite labels: - understack.rackspace.com/keystone-role: system-readwrite + keystone.understack.rackspace.com/account: "true" understack.rackspace.com/keystone-user: "infrasetup-system-{{ .Values.regionName }}" data: password: "{{ `{{ .password }}` }}" diff --git a/components/openstack/templates/automation-infrasetup.yaml.tpl b/components/openstack/templates/automation-infrasetup.yaml.tpl index 9662a1c62..95296b916 100644 --- a/components/openstack/templates/automation-infrasetup.yaml.tpl +++ b/components/openstack/templates/automation-infrasetup.yaml.tpl @@ -21,8 +21,10 @@ spec: engineVersion: v2 type: Opaque metadata: + annotations: + understack.rackspace.com/keystone-roles: infra-readwrite labels: - understack.rackspace.com/keystone-role: infra-readwrite + keystone.understack.rackspace.com/account: "true" understack.rackspace.com/keystone-user: "infrasetup-{{ .Values.regionName }}" data: password: "{{ `{{ .password }}` }}" diff --git a/components/openstack/templates/openstack-resource-controller.yaml.tpl b/components/openstack/templates/openstack-resource-controller.yaml.tpl index f7ced6770..bfa416435 100644 --- a/components/openstack/templates/openstack-resource-controller.yaml.tpl +++ b/components/openstack/templates/openstack-resource-controller.yaml.tpl @@ -21,8 +21,10 @@ spec: engineVersion: v2 type: Opaque metadata: + annotations: + understack.rackspace.com/keystone-roles: infra-readwrite labels: - understack.rackspace.com/keystone-role: infra-readwrite + keystone.understack.rackspace.com/account: "true" understack.rackspace.com/keystone-user: "openstack-resource-controller-{{ .Values.regionName }}" data: password: "{{ `{{ .password }}` }}" diff --git a/docs/deploy-guide/openstack-automation-users.md b/docs/deploy-guide/openstack-automation-users.md index 2e8a42e57..50ece3a9b 100644 --- a/docs/deploy-guide/openstack-automation-users.md +++ b/docs/deploy-guide/openstack-automation-users.md @@ -4,11 +4,15 @@ Should you need to an account in OpenStack for automation, you can do so by creating a Kubernetes Secret in the `openstack` namespace with the following metadata: +`keystone.understack.rackspace.com/account` (label): + Triggers the creation of the account. Only its presence is checked, not + its value, so set it to `"true"`. + `understack.rackspace.com/keystone-user` (label): - Defines the username in OpenStack Keystone in the `service` domain - which will be created. + Defines the username in OpenStack Keystone which will be created. When + absent, the name of the Secret is used. -`understack.rackspace.com/keystone-role` (annotation): +`understack.rackspace.com/keystone-roles` (annotation): Defines what this account will have access to do. This is an annotation rather than a label so that it can hold a comma separated list of roles, which label values do not allow. @@ -37,7 +41,8 @@ skipped. !!! note Reading the roles from a `understack.rackspace.com/keystone-role` label is - deprecated but still supported when the annotation is absent. A single + deprecated but still supported when the annotation is absent. The Secret + still needs the `keystone.understack.rackspace.com/account` label. A single role can still be given that way, but new Secrets should use the annotation. @@ -49,8 +54,9 @@ kind: Secret metadata: name: mysvc annotations: - understack.rackspace.com/keystone-role: tenant-read,infra-read + understack.rackspace.com/keystone-roles: tenant-read,infra-read labels: + keystone.understack.rackspace.com/account: "true" understack.rackspace.com/keystone-user: mysvc type: Opaque dataString: