feat(site-workflows): trigger automation users on an account label

charts/site-workflows/templates/eventsource-k8s-secrets.yaml

@@ -18,7 +18,7 @@ spec:
         - UPDATE
       filter:
         labels:
-          - key: understack.rackspace.com/keystone-user
+          - key: keystone.understack.rackspace.com/account
             operation: exists
     keystone-automation-user-delete:
       namespace: openstack
@@ -29,6 +29,6 @@ spec:
         - DELETE
       filter:
         labels:
-          - key: understack.rackspace.com/keystone-user
+          - key: keystone.understack.rackspace.com/account
             operation: exists
 {{- end }}

charts/site-workflows/templates/sensor-keystone-automation-user-delete.yaml

@@ -73,7 +73,7 @@ spec:
               dest: spec.template.spec.containers.0.env.2.value
             - src:
                 dependencyName: secret-dep
-                dataKey: body.metadata.annotations.understack\.rackspace\.com/keystone-role
+                dataKey: body.metadata.annotations.understack\.rackspace\.com/keystone-roles
                 value: ""
               dest: spec.template.spec.containers.0.env.3.value
       retryStrategy:

charts/site-workflows/templates/sensor-keystone-automation-user-upsert.yaml

@@ -73,7 +73,7 @@ spec:
             # last-applied-configuration) may contain secret data
             - src:
                 dependencyName: secret-dep
-                dataKey: body.metadata.annotations.understack\.rackspace\.com/keystone-role
+                dataKey: body.metadata.annotations.understack\.rackspace\.com/keystone-roles
                 value: ""
               dest: spec.template.spec.containers.0.env.3.value
             - src:

components/openstack/templates/automation-baremetal-manage.yaml.tpl

@@ -21,8 +21,10 @@ spec:
       engineVersion: v2
       type: Opaque
       metadata:
+        annotations:
+          understack.rackspace.com/keystone-roles: infra-readwrite
         labels:
-          understack.rackspace.com/keystone-role: infra-readwrite
+          keystone.understack.rackspace.com/account: "true"
           understack.rackspace.com/keystone-user: "baremetal-manage-{{ .Values.regionName }}"
       data:
         password: "{{ `{{ .password }}` }}"

components/openstack/templates/automation-infrasetup-system.yaml.tpl

@@ -21,8 +21,10 @@ spec:
       engineVersion: v2
       type: Opaque
       metadata:
+        annotations:
+          understack.rackspace.com/keystone-roles: system-readwrite
         labels:
-          understack.rackspace.com/keystone-role: system-readwrite
+          keystone.understack.rackspace.com/account: "true"
           understack.rackspace.com/keystone-user: "infrasetup-system-{{ .Values.regionName }}"
       data:
         password: "{{ `{{ .password }}` }}"

components/openstack/templates/automation-infrasetup.yaml.tpl

@@ -21,8 +21,10 @@ spec:
       engineVersion: v2
       type: Opaque
       metadata:
+        annotations:
+          understack.rackspace.com/keystone-roles: infra-readwrite
         labels:
-          understack.rackspace.com/keystone-role: infra-readwrite
+          keystone.understack.rackspace.com/account: "true"
           understack.rackspace.com/keystone-user: "infrasetup-{{ .Values.regionName }}"
       data:
         password: "{{ `{{ .password }}` }}"

components/openstack/templates/openstack-resource-controller.yaml.tpl

@@ -21,8 +21,10 @@ spec:
       engineVersion: v2
       type: Opaque
       metadata:
+        annotations:
+          understack.rackspace.com/keystone-roles: infra-readwrite
         labels:
-          understack.rackspace.com/keystone-role: infra-readwrite
+          keystone.understack.rackspace.com/account: "true"
           understack.rackspace.com/keystone-user: "openstack-resource-controller-{{ .Values.regionName }}"
       data:
         password: "{{ `{{ .password }}` }}"

docs/deploy-guide/openstack-automation-users.md

@@ -4,11 +4,15 @@ Should you need to an account in OpenStack for automation, you can do so
 by creating a Kubernetes Secret in the `openstack` namespace with
 the following metadata:
 
+`keystone.understack.rackspace.com/account` (label):
+  Triggers the creation of the account. Only its presence is checked, not
+  its value, so set it to `"true"`.
+
 `understack.rackspace.com/keystone-user` (label):
-  Defines the username in OpenStack Keystone in the `service` domain
-  which will be created.
+  Defines the username in OpenStack Keystone which will be created. When
+  absent, the name of the Secret is used.
 
-`understack.rackspace.com/keystone-role` (annotation):
+`understack.rackspace.com/keystone-roles` (annotation):
   Defines what this account will have access to do. This is an annotation
   rather than a label so that it can hold a comma separated list of roles,
   which label values do not allow.
@@ -37,7 +41,8 @@ skipped.
 
 !!! note
     Reading the roles from a `understack.rackspace.com/keystone-role` label is
-    deprecated but still supported when the annotation is absent. A single
+    deprecated but still supported when the annotation is absent. The Secret
+    still needs the `keystone.understack.rackspace.com/account` label. A single
     role can still be given that way, but new Secrets should use the
     annotation.
 
@@ -49,8 +54,9 @@ kind: Secret
 metadata:
   name: mysvc
   annotations:
-    understack.rackspace.com/keystone-role: tenant-read,infra-read
+    understack.rackspace.com/keystone-roles: tenant-read,infra-read
   labels:
+    keystone.understack.rackspace.com/account: "true"
     understack.rackspace.com/keystone-user: mysvc
 type: Opaque
 dataString: