From 1dc03191ed3f4c90c09e7b6b5bdef681886d7b06 Mon Sep 17 00:00:00 2001 From: melanie witt Date: Thu, 5 Nov 2026 02:54:48 +0200 Subject: [PATCH 1/4] Add Cyborg service containers to OpenStackVersion Add the three related containers to the OpenStackVersion container images list and add default values. Jira: OSPRH-2767 Signed-off-by: melanie witt --- ....openstack.org_openstackcontrolplanes.yaml | 6 +++++ .../core.openstack.org_openstackversions.yaml | 24 +++++++++++++++++++ api/core/v1beta1/openstackversion_types.go | 3 +++ api/core/v1beta1/zz_generated.deepcopy.go | 15 ++++++++++++ ....openstack.org_openstackcontrolplanes.yaml | 6 +++++ .../core.openstack.org_openstackversions.yaml | 24 +++++++++++++++++++ config/operator/default_images.yaml | 4 ++++ hack/export_related_images.sh | 2 ++ internal/openstack/version.go | 13 ++++++++++ .../openstackversion_controller_test.go | 3 +++ 10 files changed, 100 insertions(+) diff --git a/api/bases/core.openstack.org_openstackcontrolplanes.yaml b/api/bases/core.openstack.org_openstackcontrolplanes.yaml index 4050fe423..d1cd593fc 100644 --- a/api/bases/core.openstack.org_openstackcontrolplanes.yaml +++ b/api/bases/core.openstack.org_openstackcontrolplanes.yaml @@ -19879,6 +19879,12 @@ spec: type: string cloudkittyProcImage: type: string + cyborgAPIImage: + type: string + cyborgAgentImage: + type: string + cyborgConductorImage: + type: string designateAPIImage: type: string designateBackendbind9Image: diff --git a/api/bases/core.openstack.org_openstackversions.yaml b/api/bases/core.openstack.org_openstackversions.yaml index 78d77d755..89aeb20af 100644 --- a/api/bases/core.openstack.org_openstackversions.yaml +++ b/api/bases/core.openstack.org_openstackversions.yaml @@ -91,6 +91,12 @@ spec: type: string cloudkittyProcImage: type: string + cyborgAPIImage: + type: string + cyborgAgentImage: + type: string + cyborgConductorImage: + type: string designateAPIImage: type: string designateBackendbind9Image: @@ -345,6 +351,12 @@ spec: type: string cloudkittyProcImage: type: string + cyborgAPIImage: + type: string + cyborgAgentImage: + type: string + cyborgConductorImage: + type: string designateAPIImage: type: string designateBackendbind9Image: @@ -549,6 +561,12 @@ spec: type: string cloudkittyProcImage: type: string + cyborgAPIImage: + type: string + cyborgAgentImage: + type: string + cyborgConductorImage: + type: string designateAPIImage: type: string designateBackendbind9Image: @@ -779,6 +797,12 @@ spec: type: string cloudkittyProcImage: type: string + cyborgAPIImage: + type: string + cyborgAgentImage: + type: string + cyborgConductorImage: + type: string designateAPIImage: type: string designateBackendbind9Image: diff --git a/api/core/v1beta1/openstackversion_types.go b/api/core/v1beta1/openstackversion_types.go index 12c05f746..9ced0f83d 100644 --- a/api/core/v1beta1/openstackversion_types.go +++ b/api/core/v1beta1/openstackversion_types.go @@ -218,6 +218,9 @@ type ContainerTemplate struct { CinderSchedulerImage *string `json:"cinderSchedulerImage,omitempty"` CloudKittyAPIImage *string `json:"cloudkittyAPIImage,omitempty"` CloudKittyProcImage *string `json:"cloudkittyProcImage,omitempty"` + CyborgAPIImage *string `json:"cyborgAPIImage,omitempty"` + CyborgAgentImage *string `json:"cyborgAgentImage,omitempty"` + CyborgConductorImage *string `json:"cyborgConductorImage,omitempty"` DesignateAPIImage *string `json:"designateAPIImage,omitempty"` DesignateBackendbind9Image *string `json:"designateBackendbind9Image,omitempty"` DesignateCentralImage *string `json:"designateCentralImage,omitempty"` diff --git a/api/core/v1beta1/zz_generated.deepcopy.go b/api/core/v1beta1/zz_generated.deepcopy.go index 93572bd61..399cea918 100644 --- a/api/core/v1beta1/zz_generated.deepcopy.go +++ b/api/core/v1beta1/zz_generated.deepcopy.go @@ -422,6 +422,21 @@ func (in *ContainerTemplate) DeepCopyInto(out *ContainerTemplate) { *out = new(string) **out = **in } + if in.CyborgAPIImage != nil { + in, out := &in.CyborgAPIImage, &out.CyborgAPIImage + *out = new(string) + **out = **in + } + if in.CyborgAgentImage != nil { + in, out := &in.CyborgAgentImage, &out.CyborgAgentImage + *out = new(string) + **out = **in + } + if in.CyborgConductorImage != nil { + in, out := &in.CyborgConductorImage, &out.CyborgConductorImage + *out = new(string) + **out = **in + } if in.DesignateAPIImage != nil { in, out := &in.DesignateAPIImage, &out.DesignateAPIImage *out = new(string) diff --git a/config/crd/bases/core.openstack.org_openstackcontrolplanes.yaml b/config/crd/bases/core.openstack.org_openstackcontrolplanes.yaml index 4050fe423..d1cd593fc 100644 --- a/config/crd/bases/core.openstack.org_openstackcontrolplanes.yaml +++ b/config/crd/bases/core.openstack.org_openstackcontrolplanes.yaml @@ -19879,6 +19879,12 @@ spec: type: string cloudkittyProcImage: type: string + cyborgAPIImage: + type: string + cyborgAgentImage: + type: string + cyborgConductorImage: + type: string designateAPIImage: type: string designateBackendbind9Image: diff --git a/config/crd/bases/core.openstack.org_openstackversions.yaml b/config/crd/bases/core.openstack.org_openstackversions.yaml index 78d77d755..89aeb20af 100644 --- a/config/crd/bases/core.openstack.org_openstackversions.yaml +++ b/config/crd/bases/core.openstack.org_openstackversions.yaml @@ -91,6 +91,12 @@ spec: type: string cloudkittyProcImage: type: string + cyborgAPIImage: + type: string + cyborgAgentImage: + type: string + cyborgConductorImage: + type: string designateAPIImage: type: string designateBackendbind9Image: @@ -345,6 +351,12 @@ spec: type: string cloudkittyProcImage: type: string + cyborgAPIImage: + type: string + cyborgAgentImage: + type: string + cyborgConductorImage: + type: string designateAPIImage: type: string designateBackendbind9Image: @@ -549,6 +561,12 @@ spec: type: string cloudkittyProcImage: type: string + cyborgAPIImage: + type: string + cyborgAgentImage: + type: string + cyborgConductorImage: + type: string designateAPIImage: type: string designateBackendbind9Image: @@ -779,6 +797,12 @@ spec: type: string cloudkittyProcImage: type: string + cyborgAPIImage: + type: string + cyborgAgentImage: + type: string + cyborgConductorImage: + type: string designateAPIImage: type: string designateBackendbind9Image: diff --git a/config/operator/default_images.yaml b/config/operator/default_images.yaml index 544992eec..d26be1553 100644 --- a/config/operator/default_images.yaml +++ b/config/operator/default_images.yaml @@ -41,6 +41,10 @@ spec: value: quay.io/openstack-s2i-containers/openstack-cinder-volume:master-latest - name: RELATED_IMAGE_CLOUDKITTY_IMAGE_URL_DEFAULT value: quay.io/openstack-s2i-containers/openstack-cloudkitty-api:master-latest + - name: RELATED_IMAGE_CYBORG_IMAGE_URL_DEFAULT + value: quay.io/openstack-s2i-containers/openstack-cyborg:master-latest + - name: RELATED_IMAGE_CYBORG_AGENT_IMAGE_URL_DEFAULT + value: quay.io/openstack-s2i-containers/openstack-cyborg-agent:master-latest - name: RELATED_IMAGE_DESIGNATE_API_IMAGE_URL_DEFAULT value: quay.io/openstack-s2i-containers/openstack-designate-api:master-latest - name: RELATED_IMAGE_DESIGNATE_BACKENDBIND9_IMAGE_URL_DEFAULT diff --git a/hack/export_related_images.sh b/hack/export_related_images.sh index 62140a894..7a05813ff 100755 --- a/hack/export_related_images.sh +++ b/hack/export_related_images.sh @@ -78,3 +78,5 @@ export TEST_TOBIKO_IMAGE_URL_DEFAULT=quay.io/openstack-s2i-containers/openstack- export TEST_ANSIBLETEST_IMAGE_URL_DEFAULT=quay.io/openstack-s2i-containers/openstack-ansible-test:master-latest export TEST_HORIZONTEST_IMAGE_URL_DEFAULT=quay.io/openstack-s2i-containers/openstack-horizontest:master-latest export RELATED_IMAGE_OPENSTACK_MUST_GATHER_DEFAULT=quay.io/openstack-k8s-operators/openstack-must-gather:latest +export RELATED_IMAGE_CYBORG_IMAGE_URL_DEFAULT=quay.io/openstack-s2i-containers/openstack-cyborg:master-latest +export RELATED_IMAGE_CYBORG_AGENT_IMAGE_URL_DEFAULT=quay.io/openstack-s2i-containers/openstack-cyborg-agent:master-latest diff --git a/internal/openstack/version.go b/internal/openstack/version.go index c0d98bd5b..d4e26e831 100644 --- a/internal/openstack/version.go +++ b/internal/openstack/version.go @@ -111,6 +111,13 @@ func InitializeOpenStackVersionImageDefaults(ctx context.Context, envImages map[ defaults.WatcherApplierImage = envImages["RELATED_IMAGE_WATCHER_BASE_IMAGE_URL_DEFAULT"] defaults.WatcherDecisionEngineImage = envImages["RELATED_IMAGE_WATCHER_BASE_IMAGE_URL_DEFAULT"] } + if envImages["RELATED_IMAGE_CYBORG_IMAGE_URL_DEFAULT"] != nil { + defaults.CyborgAPIImage = envImages["RELATED_IMAGE_CYBORG_IMAGE_URL_DEFAULT"] + defaults.CyborgConductorImage = envImages["RELATED_IMAGE_CYBORG_IMAGE_URL_DEFAULT"] + } + if envImages["RELATED_IMAGE_CYBORG_AGENT_IMAGE_URL_DEFAULT"] != nil { + defaults.CyborgAgentImage = envImages["RELATED_IMAGE_CYBORG_AGENT_IMAGE_URL_DEFAULT"] + } // custom TEST_ images which aren't released downstream if envImages["TEST_TOBIKO_IMAGE_URL_DEFAULT"] != nil { defaults.TestTobikoImage = envImages["TEST_TOBIKO_IMAGE_URL_DEFAULT"] @@ -179,6 +186,9 @@ func GetContainerImages(defaults *corev1beta1.ContainerDefaults, instance corev1 CinderSchedulerImage: getImg(instance.Spec.CustomContainerImages.CinderSchedulerImage, defaults.CinderSchedulerImage), CloudKittyAPIImage: getImg(instance.Spec.CustomContainerImages.CloudKittyAPIImage, defaults.CloudKittyAPIImage), CloudKittyProcImage: getImg(instance.Spec.CustomContainerImages.CloudKittyProcImage, defaults.CloudKittyProcImage), + CyborgAPIImage: getImg(instance.Spec.CustomContainerImages.CyborgAPIImage, defaults.CyborgAPIImage), + CyborgAgentImage: getImg(instance.Spec.CustomContainerImages.CyborgAgentImage, defaults.CyborgAgentImage), + CyborgConductorImage: getImg(instance.Spec.CustomContainerImages.CyborgConductorImage, defaults.CyborgConductorImage), DesignateAPIImage: getImg(instance.Spec.CustomContainerImages.DesignateAPIImage, defaults.DesignateAPIImage), DesignateBackendbind9Image: getImg(instance.Spec.CustomContainerImages.DesignateBackendbind9Image, defaults.DesignateBackendbind9Image), DesignateCentralImage: getImg(instance.Spec.CustomContainerImages.DesignateCentralImage, defaults.DesignateCentralImage), @@ -374,6 +384,9 @@ func ControlplaneContainerImageMatch(ctx context.Context, controlPlane *corev1be if !CinderImageMatch(ctx, controlPlane, version) { failedMatches = append(failedMatches, "Cinder") } + if !CyborgImageMatch(ctx, controlPlane, version) { + failedMatches = append(failedMatches, "Cyborg") + } if !DesignateImageMatch(ctx, controlPlane, version) { failedMatches = append(failedMatches, "Designate") } diff --git a/test/functional/ctlplane/openstackversion_controller_test.go b/test/functional/ctlplane/openstackversion_controller_test.go index 01d3cb050..cc845ed0d 100644 --- a/test/functional/ctlplane/openstackversion_controller_test.go +++ b/test/functional/ctlplane/openstackversion_controller_test.go @@ -179,6 +179,9 @@ var _ = Describe("OpenStackVersion controller", func() { g.Expect(version.Status.ContainerImages.CinderAPIImage).ShouldNot(BeNil()) g.Expect(version.Status.ContainerImages.CinderBackupImage).ShouldNot(BeNil()) g.Expect(version.Status.ContainerImages.CinderSchedulerImage).ShouldNot(BeNil()) + g.Expect(version.Status.ContainerImages.CyborgAPIImage).ShouldNot(BeNil()) + g.Expect(version.Status.ContainerImages.CyborgAgentImage).ShouldNot(BeNil()) + g.Expect(version.Status.ContainerImages.CyborgConductorImage).ShouldNot(BeNil()) g.Expect(version.Status.ContainerImages.DesignateAPIImage).ShouldNot(BeNil()) g.Expect(version.Status.ContainerImages.DesignateBackendbind9Image).ShouldNot(BeNil()) g.Expect(version.Status.ContainerImages.DesignateCentralImage).ShouldNot(BeNil()) From d29beb4fad5634bc26b94b2627bb0d45878a835e Mon Sep 17 00:00:00 2001 From: melanie witt Date: Thu, 5 Nov 2026 02:56:38 +0200 Subject: [PATCH 2/4] Add Cyborg deployment to OpenStackControlPlane This includes: - CRD modification to OpenStackControlPlane - New conditions - pkg/cyborg.go to implement the reconcile loop for Cyborg - functional tests - Cyborg deployment is added to one of the existing kuttl tests Jira: OSPRH-27675 Signed-off-by: melanie witt --- ....openstack.org_openstackcontrolplanes.yaml | 684 ++++++++++++++++++ api/core/v1beta1/conditions.go | 18 + .../v1beta1/openstackcontrolplane_types.go | 35 + .../v1beta1/openstackcontrolplane_webhook.go | 47 ++ api/core/v1beta1/zz_generated.deepcopy.go | 28 + cmd/main.go | 7 + ....openstack.org_openstackcontrolplanes.yaml | 684 ++++++++++++++++++ config/rbac/role.yaml | 12 + .../core/openstackcontrolplane_controller.go | 11 + internal/openstack/cyborg.go | 264 +++++++ test/functional/ctlplane/base_test.go | 30 + .../openstackoperator_controller_test.go | 186 +++++ test/functional/ctlplane/suite_test.go | 6 + .../01-assert-collapsed-cell.yaml | 17 + 14 files changed, 2029 insertions(+) create mode 100644 internal/openstack/cyborg.go diff --git a/api/bases/core.openstack.org_openstackcontrolplanes.yaml b/api/bases/core.openstack.org_openstackcontrolplanes.yaml index d1cd593fc..dc65a9bc5 100644 --- a/api/bases/core.openstack.org_openstackcontrolplanes.yaml +++ b/api/bases/core.openstack.org_openstackcontrolplanes.yaml @@ -2631,6 +2631,690 @@ spec: default: false type: boolean type: object + cyborg: + properties: + apiOverride: + properties: + route: + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + spec: + properties: + alternateBackends: + items: + properties: + kind: + enum: + - Service + - "" + type: string + name: + type: string + weight: + format: int32 + maximum: 256 + minimum: 0 + type: integer + type: object + maxItems: 3 + type: array + host: + maxLength: 253 + pattern: ^([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])(\.([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]{0,61}[a-zA-Z0-9]))*$ + type: string + path: + pattern: ^/ + type: string + port: + properties: + targetPort: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - targetPort + type: object + subdomain: + maxLength: 253 + pattern: ^([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])(\.([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]{0,61}[a-zA-Z0-9]))*$ + type: string + tls: + properties: + caCertificate: + type: string + certificate: + type: string + destinationCACertificate: + type: string + externalCertificate: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + insecureEdgeTerminationPolicy: + enum: + - Allow + - None + - Redirect + - "" + type: string + key: + type: string + termination: + enum: + - edge + - reencrypt + - passthrough + type: string + required: + - termination + type: object + x-kubernetes-validations: + - message: 'cannot have both spec.tls.termination: + passthrough and spec.tls.insecureEdgeTerminationPolicy: + Allow' + rule: 'has(self.termination) && has(self.insecureEdgeTerminationPolicy) + ? !((self.termination==''passthrough'') && (self.insecureEdgeTerminationPolicy==''Allow'')) + : true' + to: + properties: + kind: + enum: + - Service + - "" + type: string + name: + type: string + weight: + format: int32 + maximum: 256 + minimum: 0 + type: integer + type: object + wildcardPolicy: + enum: + - None + - Subdomain + - "" + type: string + type: object + type: object + tls: + properties: + secretName: + type: string + type: object + type: object + applicationCredential: + default: + enabled: false + nullable: true + properties: + accessRules: + items: + properties: + method: + minLength: 1 + type: string + path: + minLength: 1 + type: string + service: + minLength: 1 + type: string + required: + - method + - path + - service + type: object + type: array + x-kubernetes-list-type: atomic + enabled: + default: false + type: boolean + expirationDays: + minimum: 2 + type: integer + gracePeriodDays: + minimum: 1 + type: integer + roles: + items: + type: string + type: array + unrestricted: + type: boolean + type: object + x-kubernetes-validations: + - message: gracePeriodDays must be smaller than expirationDays + rule: '!(has(self.expirationDays) && has(self.gracePeriodDays)) + || self.gracePeriodDays < self.expirationDays' + enabled: + default: false + type: boolean + template: + properties: + apiServiceTemplate: + default: + replicas: 1 + properties: + customServiceConfig: + type: string + nodeSelector: + additionalProperties: + type: string + type: object + override: + properties: + probes: + properties: + livenessProbes: + properties: + command: + items: + type: string + type: array + x-kubernetes-list-type: atomic + failureThreshold: + format: int32 + minimum: 1 + type: integer + initialDelaySeconds: + format: int32 + minimum: 0 + type: integer + path: + pattern: ^(/.*)?$ + type: string + periodSeconds: + format: int32 + minimum: 1 + type: integer + port: + format: int32 + maximum: 65535 + minimum: 1 + type: integer + scheme: + type: string + timeoutSeconds: + format: int32 + minimum: 1 + type: integer + type: + enum: + - HTTP + - Exec + - "" + type: string + type: object + readinessProbes: + properties: + command: + items: + type: string + type: array + x-kubernetes-list-type: atomic + failureThreshold: + format: int32 + minimum: 1 + type: integer + initialDelaySeconds: + format: int32 + minimum: 0 + type: integer + path: + pattern: ^(/.*)?$ + type: string + periodSeconds: + format: int32 + minimum: 1 + type: integer + port: + format: int32 + maximum: 65535 + minimum: 1 + type: integer + scheme: + type: string + timeoutSeconds: + format: int32 + minimum: 1 + type: integer + type: + enum: + - HTTP + - Exec + - "" + type: string + type: object + startupProbes: + properties: + command: + items: + type: string + type: array + x-kubernetes-list-type: atomic + failureThreshold: + format: int32 + minimum: 1 + type: integer + initialDelaySeconds: + format: int32 + minimum: 0 + type: integer + path: + pattern: ^(/.*)?$ + type: string + periodSeconds: + format: int32 + minimum: 1 + type: integer + port: + format: int32 + maximum: 65535 + minimum: 1 + type: integer + scheme: + type: string + timeoutSeconds: + format: int32 + minimum: 1 + type: integer + type: + enum: + - HTTP + - Exec + - "" + type: string + type: object + type: object + service: + additionalProperties: + properties: + endpointURL: + type: string + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + spec: + properties: + externalName: + type: string + externalTrafficPolicy: + type: string + internalTrafficPolicy: + type: string + ipFamilyPolicy: + type: string + loadBalancerClass: + type: string + loadBalancerSourceRanges: + items: + type: string + type: array + x-kubernetes-list-type: atomic + ports: + items: + properties: + name: + type: string + port: + format: int32 + maximum: 65535 + minimum: 1 + type: integer + required: + - name + - port + type: object + type: array + x-kubernetes-list-type: atomic + sessionAffinity: + type: string + sessionAffinityConfig: + properties: + clientIP: + properties: + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: + type: string + type: object + type: object + type: object + type: object + replicas: + default: 1 + format: int32 + maximum: 32 + minimum: 0 + type: integer + resources: + properties: + claims: + items: + properties: + name: + type: string + request: + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + tls: + properties: + api: + properties: + internal: + properties: + secretName: + type: string + type: object + public: + properties: + secretName: + type: string + type: object + type: object + caBundleSecretName: + type: string + type: object + topologyRef: + properties: + name: + type: string + namespace: + type: string + type: object + type: object + apiTimeout: + default: 60 + minimum: 10 + type: integer + auth: + properties: + applicationCredentialSecret: + type: string + type: object + conductorServiceTemplate: + default: + replicas: 1 + properties: + customServiceConfig: + type: string + nodeSelector: + additionalProperties: + type: string + type: object + override: + properties: + probes: + properties: + livenessProbes: + properties: + command: + items: + type: string + type: array + x-kubernetes-list-type: atomic + failureThreshold: + format: int32 + minimum: 1 + type: integer + initialDelaySeconds: + format: int32 + minimum: 0 + type: integer + path: + pattern: ^(/.*)?$ + type: string + periodSeconds: + format: int32 + minimum: 1 + type: integer + port: + format: int32 + maximum: 65535 + minimum: 1 + type: integer + scheme: + type: string + timeoutSeconds: + format: int32 + minimum: 1 + type: integer + type: + enum: + - HTTP + - Exec + - "" + type: string + type: object + readinessProbes: + properties: + command: + items: + type: string + type: array + x-kubernetes-list-type: atomic + failureThreshold: + format: int32 + minimum: 1 + type: integer + initialDelaySeconds: + format: int32 + minimum: 0 + type: integer + path: + pattern: ^(/.*)?$ + type: string + periodSeconds: + format: int32 + minimum: 1 + type: integer + port: + format: int32 + maximum: 65535 + minimum: 1 + type: integer + scheme: + type: string + timeoutSeconds: + format: int32 + minimum: 1 + type: integer + type: + enum: + - HTTP + - Exec + - "" + type: string + type: object + startupProbes: + properties: + command: + items: + type: string + type: array + x-kubernetes-list-type: atomic + failureThreshold: + format: int32 + minimum: 1 + type: integer + initialDelaySeconds: + format: int32 + minimum: 0 + type: integer + path: + pattern: ^(/.*)?$ + type: string + periodSeconds: + format: int32 + minimum: 1 + type: integer + port: + format: int32 + maximum: 65535 + minimum: 1 + type: integer + scheme: + type: string + timeoutSeconds: + format: int32 + minimum: 1 + type: integer + type: + enum: + - HTTP + - Exec + - "" + type: string + type: object + type: object + type: object + replicas: + default: 1 + format: int32 + maximum: 32 + minimum: 0 + type: integer + resources: + properties: + claims: + items: + properties: + name: + type: string + request: + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + topologyRef: + properties: + name: + type: string + namespace: + type: string + type: object + type: object + databaseAccount: + default: cyborg + type: string + databaseInstance: + default: openstack + type: string + keystoneInstance: + default: keystone + type: string + messagingBus: + properties: + cluster: + minLength: 1 + type: string + user: + type: string + vhost: + type: string + required: + - cluster + type: object + nodeSelector: + additionalProperties: + type: string + type: object + passwordSelectors: + default: + service: CyborgPassword + properties: + service: + default: CyborgPassword + type: string + type: object + preserveJobs: + default: false + type: boolean + secret: + default: osp-secret + type: string + serviceUser: + default: cyborg + type: string + topologyRef: + properties: + name: + type: string + namespace: + type: string + type: object + type: object + type: object designate: properties: apiOverride: diff --git a/api/core/v1beta1/conditions.go b/api/core/v1beta1/conditions.go index 6f8a3b257..08d73d884 100644 --- a/api/core/v1beta1/conditions.go +++ b/api/core/v1beta1/conditions.go @@ -172,6 +172,12 @@ const ( // OpenStackControlPlaneBackupConfigReadyCondition Status=True condition which indicates if OpenStackBackupConfig is reconciled OpenStackControlPlaneBackupConfigReadyCondition condition.Type = "OpenStackControlPlaneBackupConfigReady" + + // OpenStackControlPlaneCyborgReadyCondition Status=True condition which indicates if Cyborg is configured and operational + OpenStackControlPlaneCyborgReadyCondition condition.Type = "OpenStackControlPlaneCyborgReady" + + // OpenStackControlPlaneExposeCyborgReadyCondition Status=True condition which indicates if Cyborg is exposed via a route + OpenStackControlPlaneExposeCyborgReadyCondition condition.Type = "OpenStackControlPlaneExposeCyborgReady" ) // Common Messages used by API objects. @@ -551,6 +557,18 @@ const ( // OpenStackControlPlaneInfrastructureReadyErrorMessage OpenStackControlPlaneInfrastructureReadyErrorMessage = "OpenStackControlPlane Infrastructure error occured %s" + + // OpenStackControlPlaneCyborgReadyInitMessage + OpenStackControlPlaneCyborgReadyInitMessage = "OpenStackControlPlane Cyborg not started" + + // OpenStackControlPlaneCyborgReadyMessage + OpenStackControlPlaneCyborgReadyMessage = "OpenStackControlPlane Cyborg completed" + + // OpenStackControlPlaneCyborgReadyRunningMessage + OpenStackControlPlaneCyborgReadyRunningMessage = "OpenStackControlPlane Cyborg in progress" + + // OpenStackControlPlaneCyborgReadyErrorMessage + OpenStackControlPlaneCyborgReadyErrorMessage = "OpenStackControlPlane Cyborg error occured %s" ) // Version Conditions used by to drive minor updates diff --git a/api/core/v1beta1/openstackcontrolplane_types.go b/api/core/v1beta1/openstackcontrolplane_types.go index 14ebb4c63..c4cc07b87 100644 --- a/api/core/v1beta1/openstackcontrolplane_types.go +++ b/api/core/v1beta1/openstackcontrolplane_types.go @@ -21,6 +21,7 @@ import ( barbicanv1 "github.com/openstack-k8s-operators/barbican-operator/api/v1beta1" cinderv1 "github.com/openstack-k8s-operators/cinder-operator/api/v1beta1" + cyborgv1 "github.com/openstack-k8s-operators/nova-operator/api/cyborg/v1beta1" designatev1 "github.com/openstack-k8s-operators/designate-operator/api/v1beta1" glancev1 "github.com/openstack-k8s-operators/glance-operator/api/v1beta1" heatv1 "github.com/openstack-k8s-operators/heat-operator/api/v1beta1" @@ -252,6 +253,11 @@ type OpenStackControlPlaneSpec struct { // must be enabled for a service to use ApplicationCredentials. // If omitted, defaults to enabled=false with standard expiration/grace periods. ApplicationCredential ApplicationCredentialSection `json:"applicationCredential,omitempty"` + + // +kubebuilder:validation:Optional + // +operator-sdk:csv:customresourcedefinitions:type=spec + // Cyborg - Parameters related to the Cyborg service + Cyborg CyborgSection `json:"cyborg,omitempty"` } // TLSSection defines the desired state of TLS configuration @@ -986,6 +992,32 @@ type WatcherSection struct { ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"` } +// CyborgSection defines the desired state of Cyborg service +type CyborgSection struct { + // +kubebuilder:validation:Optional + // +kubebuilder:default=false + // +operator-sdk:csv:customresourcedefinitions:type=spec,xDescriptors={"urn:alm:descriptor:com.tectonic.ui:booleanSwitch"} + // Enabled - Whether Cyborg service should be deployed and managed + Enabled bool `json:"enabled"` + + // +kubebuilder:validation:Optional + // +operator-sdk:csv:customresourcedefinitions:type=spec + // Template - Overrides to use when creating the Cyborg service + Template *cyborgv1.CyborgSpecCore `json:"template,omitempty"` + + // +kubebuilder:validation:Optional + // +operator-sdk:csv:customresourcedefinitions:type=spec + // APIOverride, provides the ability to override the generated manifest of several child resources. + APIOverride Override `json:"apiOverride,omitempty"` + + // ApplicationCredential allows service-specific overrides of the global AC configuration. + // +operator-sdk:csv:customresourcedefinitions:type=spec + // +kubebuilder:validation:Optional + // +nullable + // +kubebuilder:default={enabled:false} + ApplicationCredential *ServiceAppCredSection `json:"applicationCredential"` +} + // +kubebuilder:validation:XValidation:rule="self.gracePeriodDays < self.expirationDays",message="gracePeriodDays must be smaller than expirationDays" // ApplicationCredentialSection defines the desired configuration for ApplicationCredentials type ApplicationCredentialSection struct { @@ -1243,6 +1275,9 @@ func (instance *OpenStackControlPlane) InitConditions() { if instance.Spec.Watcher.Enabled { cl.Set(condition.UnknownCondition(OpenStackControlPlaneWatcherReadyCondition, condition.InitReason, OpenStackControlPlaneWatcherReadyInitMessage)) } + if instance.Spec.Cyborg.Enabled { + cl.Set(condition.UnknownCondition(OpenStackControlPlaneCyborgReadyCondition, condition.InitReason, OpenStackControlPlaneCyborgReadyInitMessage)) + } // Init Topology condition if there's a reference if instance.Spec.TopologyRef != nil { diff --git a/api/core/v1beta1/openstackcontrolplane_webhook.go b/api/core/v1beta1/openstackcontrolplane_webhook.go index ab575cff6..8819b2934 100644 --- a/api/core/v1beta1/openstackcontrolplane_webhook.go +++ b/api/core/v1beta1/openstackcontrolplane_webhook.go @@ -45,6 +45,7 @@ import ( barbicanv1 "github.com/openstack-k8s-operators/barbican-operator/api/v1beta1" cinderv1 "github.com/openstack-k8s-operators/cinder-operator/api/v1beta1" + cyborgv1 "github.com/openstack-k8s-operators/nova-operator/api/cyborg/v1beta1" designatev1 "github.com/openstack-k8s-operators/designate-operator/api/v1beta1" glancev1 "github.com/openstack-k8s-operators/glance-operator/api/v1beta1" heatv1 "github.com/openstack-k8s-operators/heat-operator/api/v1beta1" @@ -360,6 +361,10 @@ func (r *OpenStackControlPlane) checkDepsEnabled(name string) string { *r.Spec.Telemetry.Template.MetricStorage.Enabled) { reqs = "Galera, Memcached, RabbitMQ, Keystone, Telemetry, Telemetry.Ceilometer, Telemetry.MetricStorage" } + case "Cyborg": + if !(r.Spec.Galera.Enabled && r.Spec.Rabbitmq.Enabled && r.Spec.Keystone.Enabled) { + reqs = "Galera, RabbitMQ, Keystone" + } } // If "reqs" is not the empty string, we have missing requirements @@ -490,6 +495,13 @@ func (r *OpenStackControlPlane) ValidateCreateServices(basePath *field.Path) (ad errors = append(errors, validateTLSOverrideSpec(&r.Spec.Watcher.APIOverride.Route, basePath.Child("watcher").Child("apiOverride").Child("route"))...) } + if r.Spec.Cyborg.Enabled { + warns, errs := r.Spec.Cyborg.Template.ValidateCreate(basePath.Child("cyborg").Child("template"), r.Namespace) + errors = append(errors, errs...) + warnings = append(warnings, warns...) + errors = append(errors, validateTLSOverrideSpec(&r.Spec.Cyborg.APIOverride.Route, basePath.Child("cyborg").Child("apiOverride").Child("route"))...) + } + if r.Spec.Telemetry.Enabled { warns, errs := r.Spec.Telemetry.Template.ValidateCreate(basePath.Child("telemetry").Child("template"), r.Namespace) errors = append(errors, errs...) @@ -718,6 +730,17 @@ func (r *OpenStackControlPlane) ValidateUpdateServices(old OpenStackControlPlane warnings = append(warnings, warns...) errors = append(errors, validateTLSOverrideSpec(&r.Spec.Watcher.APIOverride.Route, basePath.Child("watcher").Child("apiOverride").Child("route"))...) } + + if r.Spec.Cyborg.Enabled { + if old.Cyborg.Template == nil { + old.Cyborg.Template = &cyborgv1.CyborgSpecCore{} + } + warns, errs := r.Spec.Cyborg.Template.ValidateUpdate(*old.Cyborg.Template, basePath.Child("cyborg").Child("template"), r.Namespace) + errors = append(errors, errs...) + warnings = append(warnings, warns...) + errors = append(errors, validateTLSOverrideSpec(&r.Spec.Cyborg.APIOverride.Route, basePath.Child("cyborg").Child("apiOverride").Child("route"))...) + } + if r.Spec.Telemetry.Enabled { if old.Telemetry.Template == nil { old.Telemetry.Template = &telemetryv1.TelemetrySpecCore{} @@ -883,6 +906,12 @@ func (r *OpenStackControlPlane) ValidateServiceDependencies(basePath *field.Path allErrs = append(allErrs, err) } } + if r.Spec.Cyborg.Enabled { + if depErrorMsg := r.checkDepsEnabled("Cyborg"); depErrorMsg != "" { + err := field.Invalid(basePath.Child("cyborg").Child("enabled"), r.Spec.Cyborg.Enabled, depErrorMsg) + allErrs = append(allErrs, err) + } + } return allErrs } @@ -1247,6 +1276,24 @@ func (r *OpenStackControlPlane) DefaultServices() { } } + // Cyborg + if r.Spec.Cyborg.Enabled || r.Spec.Cyborg.Template != nil { + if r.Spec.Cyborg.Template == nil { + r.Spec.Cyborg.Template = &cyborgv1.CyborgSpecCore{} + } + r.Spec.Cyborg.Template.Default() + + if r.Spec.Cyborg.Enabled { + initializeOverrideSpec(&r.Spec.Cyborg.APIOverride.Route, true) + r.Spec.Cyborg.Template.SetDefaultRouteAnnotations(r.Spec.Cyborg.APIOverride.Route.Annotations) + } + + // Default DatabaseInstance + if r.Spec.Cyborg.Template.DatabaseInstance == nil || *r.Spec.Cyborg.Template.DatabaseInstance == "" { + r.Spec.Cyborg.Template.DatabaseInstance = ptr.To("openstack") + } + } + } // DefaultLabel - adding default label to the OpenStackControlPlane diff --git a/api/core/v1beta1/zz_generated.deepcopy.go b/api/core/v1beta1/zz_generated.deepcopy.go index 399cea918..faedbf9a0 100644 --- a/api/core/v1beta1/zz_generated.deepcopy.go +++ b/api/core/v1beta1/zz_generated.deepcopy.go @@ -40,6 +40,7 @@ import ( manila_operatorapiv1beta1 "github.com/openstack-k8s-operators/manila-operator/api/v1beta1" mariadb_operatorapiv1beta1 "github.com/openstack-k8s-operators/mariadb-operator/api/v1beta1" neutron_operatorapiv1beta1 "github.com/openstack-k8s-operators/neutron-operator/api/v1beta1" + cyborgv1beta1 "github.com/openstack-k8s-operators/nova-operator/api/cyborg/v1beta1" novav1beta1 "github.com/openstack-k8s-operators/nova-operator/api/nova/v1beta1" placementv1beta1 "github.com/openstack-k8s-operators/nova-operator/api/placement/v1beta1" octavia_operatorapiv1beta1 "github.com/openstack-k8s-operators/octavia-operator/api/v1beta1" @@ -872,6 +873,32 @@ func (in *CustomContainerImages) DeepCopy() *CustomContainerImages { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *CyborgSection) DeepCopyInto(out *CyborgSection) { + *out = *in + if in.Template != nil { + in, out := &in.Template, &out.Template + *out = new(cyborgv1beta1.CyborgSpecCore) + (*in).DeepCopyInto(*out) + } + in.APIOverride.DeepCopyInto(&out.APIOverride) + if in.ApplicationCredential != nil { + in, out := &in.ApplicationCredential, &out.ApplicationCredential + *out = new(ServiceAppCredSection) + (*in).DeepCopyInto(*out) + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CyborgSection. +func (in *CyborgSection) DeepCopy() *CyborgSection { + if in == nil { + return nil + } + out := new(CyborgSection) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *DNSMasqSection) DeepCopyInto(out *DNSMasqSection) { *out = *in @@ -1362,6 +1389,7 @@ func (in *OpenStackControlPlaneSpec) DeepCopyInto(out *OpenStackControlPlaneSpec } in.Watcher.DeepCopyInto(&out.Watcher) in.ApplicationCredential.DeepCopyInto(&out.ApplicationCredential) + in.Cyborg.DeepCopyInto(&out.Cyborg) } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OpenStackControlPlaneSpec. diff --git a/cmd/main.go b/cmd/main.go index 98339d284..085992aab 100644 --- a/cmd/main.go +++ b/cmd/main.go @@ -79,6 +79,7 @@ import ( manilav1 "github.com/openstack-k8s-operators/manila-operator/api/v1beta1" mariadbv1 "github.com/openstack-k8s-operators/mariadb-operator/api/v1beta1" neutronv1 "github.com/openstack-k8s-operators/neutron-operator/api/v1beta1" + cyborgv1 "github.com/openstack-k8s-operators/nova-operator/api/cyborg/v1beta1" novav1 "github.com/openstack-k8s-operators/nova-operator/api/nova/v1beta1" placementv1 "github.com/openstack-k8s-operators/nova-operator/api/placement/v1beta1" octaviav1 "github.com/openstack-k8s-operators/octavia-operator/api/v1beta1" @@ -139,6 +140,7 @@ func init() { utilruntime.Must(operatorv1beta1.AddToScheme(scheme)) utilruntime.Must(topologyv1.AddToScheme(scheme)) utilruntime.Must(watcherv1.AddToScheme(scheme)) + utilruntime.Must(cyborgv1.AddToScheme(scheme)) utilruntime.Must(backupv1beta1.AddToScheme(scheme)) utilruntime.Must(assistantv1beta1.AddToScheme(scheme)) // +kubebuilder:scaffold:scheme @@ -413,6 +415,11 @@ func main() { // Defaults for anything else that was not covered by OpenStackClient nor service operator defaults corev1.SetupVersionDefaults() + // Cyborg's Default() reads from a package-level cyborgDefaults var + // (e.g. APITimeout) that is zero-valued until SetupDefaults() is called. + // Other services hardcode their defaults directly in Default(). + cyborgv1.SetupDefaults() + // nolint:goconst checker := healthz.Ping if os.Getenv("ENABLE_WEBHOOKS") != "false" { diff --git a/config/crd/bases/core.openstack.org_openstackcontrolplanes.yaml b/config/crd/bases/core.openstack.org_openstackcontrolplanes.yaml index d1cd593fc..dc65a9bc5 100644 --- a/config/crd/bases/core.openstack.org_openstackcontrolplanes.yaml +++ b/config/crd/bases/core.openstack.org_openstackcontrolplanes.yaml @@ -2631,6 +2631,690 @@ spec: default: false type: boolean type: object + cyborg: + properties: + apiOverride: + properties: + route: + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + spec: + properties: + alternateBackends: + items: + properties: + kind: + enum: + - Service + - "" + type: string + name: + type: string + weight: + format: int32 + maximum: 256 + minimum: 0 + type: integer + type: object + maxItems: 3 + type: array + host: + maxLength: 253 + pattern: ^([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])(\.([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]{0,61}[a-zA-Z0-9]))*$ + type: string + path: + pattern: ^/ + type: string + port: + properties: + targetPort: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - targetPort + type: object + subdomain: + maxLength: 253 + pattern: ^([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])(\.([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]{0,61}[a-zA-Z0-9]))*$ + type: string + tls: + properties: + caCertificate: + type: string + certificate: + type: string + destinationCACertificate: + type: string + externalCertificate: + properties: + name: + type: string + type: object + x-kubernetes-map-type: atomic + insecureEdgeTerminationPolicy: + enum: + - Allow + - None + - Redirect + - "" + type: string + key: + type: string + termination: + enum: + - edge + - reencrypt + - passthrough + type: string + required: + - termination + type: object + x-kubernetes-validations: + - message: 'cannot have both spec.tls.termination: + passthrough and spec.tls.insecureEdgeTerminationPolicy: + Allow' + rule: 'has(self.termination) && has(self.insecureEdgeTerminationPolicy) + ? !((self.termination==''passthrough'') && (self.insecureEdgeTerminationPolicy==''Allow'')) + : true' + to: + properties: + kind: + enum: + - Service + - "" + type: string + name: + type: string + weight: + format: int32 + maximum: 256 + minimum: 0 + type: integer + type: object + wildcardPolicy: + enum: + - None + - Subdomain + - "" + type: string + type: object + type: object + tls: + properties: + secretName: + type: string + type: object + type: object + applicationCredential: + default: + enabled: false + nullable: true + properties: + accessRules: + items: + properties: + method: + minLength: 1 + type: string + path: + minLength: 1 + type: string + service: + minLength: 1 + type: string + required: + - method + - path + - service + type: object + type: array + x-kubernetes-list-type: atomic + enabled: + default: false + type: boolean + expirationDays: + minimum: 2 + type: integer + gracePeriodDays: + minimum: 1 + type: integer + roles: + items: + type: string + type: array + unrestricted: + type: boolean + type: object + x-kubernetes-validations: + - message: gracePeriodDays must be smaller than expirationDays + rule: '!(has(self.expirationDays) && has(self.gracePeriodDays)) + || self.gracePeriodDays < self.expirationDays' + enabled: + default: false + type: boolean + template: + properties: + apiServiceTemplate: + default: + replicas: 1 + properties: + customServiceConfig: + type: string + nodeSelector: + additionalProperties: + type: string + type: object + override: + properties: + probes: + properties: + livenessProbes: + properties: + command: + items: + type: string + type: array + x-kubernetes-list-type: atomic + failureThreshold: + format: int32 + minimum: 1 + type: integer + initialDelaySeconds: + format: int32 + minimum: 0 + type: integer + path: + pattern: ^(/.*)?$ + type: string + periodSeconds: + format: int32 + minimum: 1 + type: integer + port: + format: int32 + maximum: 65535 + minimum: 1 + type: integer + scheme: + type: string + timeoutSeconds: + format: int32 + minimum: 1 + type: integer + type: + enum: + - HTTP + - Exec + - "" + type: string + type: object + readinessProbes: + properties: + command: + items: + type: string + type: array + x-kubernetes-list-type: atomic + failureThreshold: + format: int32 + minimum: 1 + type: integer + initialDelaySeconds: + format: int32 + minimum: 0 + type: integer + path: + pattern: ^(/.*)?$ + type: string + periodSeconds: + format: int32 + minimum: 1 + type: integer + port: + format: int32 + maximum: 65535 + minimum: 1 + type: integer + scheme: + type: string + timeoutSeconds: + format: int32 + minimum: 1 + type: integer + type: + enum: + - HTTP + - Exec + - "" + type: string + type: object + startupProbes: + properties: + command: + items: + type: string + type: array + x-kubernetes-list-type: atomic + failureThreshold: + format: int32 + minimum: 1 + type: integer + initialDelaySeconds: + format: int32 + minimum: 0 + type: integer + path: + pattern: ^(/.*)?$ + type: string + periodSeconds: + format: int32 + minimum: 1 + type: integer + port: + format: int32 + maximum: 65535 + minimum: 1 + type: integer + scheme: + type: string + timeoutSeconds: + format: int32 + minimum: 1 + type: integer + type: + enum: + - HTTP + - Exec + - "" + type: string + type: object + type: object + service: + additionalProperties: + properties: + endpointURL: + type: string + metadata: + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + spec: + properties: + externalName: + type: string + externalTrafficPolicy: + type: string + internalTrafficPolicy: + type: string + ipFamilyPolicy: + type: string + loadBalancerClass: + type: string + loadBalancerSourceRanges: + items: + type: string + type: array + x-kubernetes-list-type: atomic + ports: + items: + properties: + name: + type: string + port: + format: int32 + maximum: 65535 + minimum: 1 + type: integer + required: + - name + - port + type: object + type: array + x-kubernetes-list-type: atomic + sessionAffinity: + type: string + sessionAffinityConfig: + properties: + clientIP: + properties: + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: + type: string + type: object + type: object + type: object + type: object + replicas: + default: 1 + format: int32 + maximum: 32 + minimum: 0 + type: integer + resources: + properties: + claims: + items: + properties: + name: + type: string + request: + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + tls: + properties: + api: + properties: + internal: + properties: + secretName: + type: string + type: object + public: + properties: + secretName: + type: string + type: object + type: object + caBundleSecretName: + type: string + type: object + topologyRef: + properties: + name: + type: string + namespace: + type: string + type: object + type: object + apiTimeout: + default: 60 + minimum: 10 + type: integer + auth: + properties: + applicationCredentialSecret: + type: string + type: object + conductorServiceTemplate: + default: + replicas: 1 + properties: + customServiceConfig: + type: string + nodeSelector: + additionalProperties: + type: string + type: object + override: + properties: + probes: + properties: + livenessProbes: + properties: + command: + items: + type: string + type: array + x-kubernetes-list-type: atomic + failureThreshold: + format: int32 + minimum: 1 + type: integer + initialDelaySeconds: + format: int32 + minimum: 0 + type: integer + path: + pattern: ^(/.*)?$ + type: string + periodSeconds: + format: int32 + minimum: 1 + type: integer + port: + format: int32 + maximum: 65535 + minimum: 1 + type: integer + scheme: + type: string + timeoutSeconds: + format: int32 + minimum: 1 + type: integer + type: + enum: + - HTTP + - Exec + - "" + type: string + type: object + readinessProbes: + properties: + command: + items: + type: string + type: array + x-kubernetes-list-type: atomic + failureThreshold: + format: int32 + minimum: 1 + type: integer + initialDelaySeconds: + format: int32 + minimum: 0 + type: integer + path: + pattern: ^(/.*)?$ + type: string + periodSeconds: + format: int32 + minimum: 1 + type: integer + port: + format: int32 + maximum: 65535 + minimum: 1 + type: integer + scheme: + type: string + timeoutSeconds: + format: int32 + minimum: 1 + type: integer + type: + enum: + - HTTP + - Exec + - "" + type: string + type: object + startupProbes: + properties: + command: + items: + type: string + type: array + x-kubernetes-list-type: atomic + failureThreshold: + format: int32 + minimum: 1 + type: integer + initialDelaySeconds: + format: int32 + minimum: 0 + type: integer + path: + pattern: ^(/.*)?$ + type: string + periodSeconds: + format: int32 + minimum: 1 + type: integer + port: + format: int32 + maximum: 65535 + minimum: 1 + type: integer + scheme: + type: string + timeoutSeconds: + format: int32 + minimum: 1 + type: integer + type: + enum: + - HTTP + - Exec + - "" + type: string + type: object + type: object + type: object + replicas: + default: 1 + format: int32 + maximum: 32 + minimum: 0 + type: integer + resources: + properties: + claims: + items: + properties: + name: + type: string + request: + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: object + topologyRef: + properties: + name: + type: string + namespace: + type: string + type: object + type: object + databaseAccount: + default: cyborg + type: string + databaseInstance: + default: openstack + type: string + keystoneInstance: + default: keystone + type: string + messagingBus: + properties: + cluster: + minLength: 1 + type: string + user: + type: string + vhost: + type: string + required: + - cluster + type: object + nodeSelector: + additionalProperties: + type: string + type: object + passwordSelectors: + default: + service: CyborgPassword + properties: + service: + default: CyborgPassword + type: string + type: object + preserveJobs: + default: false + type: boolean + secret: + default: osp-secret + type: string + serviceUser: + default: cyborg + type: string + topologyRef: + properties: + name: + type: string + namespace: + type: string + type: object + type: object + type: object designate: properties: apiOverride: diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml index c60e05863..1ff5c5fee 100644 --- a/config/rbac/role.yaml +++ b/config/rbac/role.yaml @@ -358,6 +358,18 @@ rules: - get - patch - update +- apiGroups: + - cyborg.openstack.org + resources: + - cyborgs + verbs: + - create + - delete + - get + - list + - patch + - update + - watch - apiGroups: - dataplane.openstack.org resources: diff --git a/internal/controller/core/openstackcontrolplane_controller.go b/internal/controller/core/openstackcontrolplane_controller.go index 919f40ea8..6b8075355 100644 --- a/internal/controller/core/openstackcontrolplane_controller.go +++ b/internal/controller/core/openstackcontrolplane_controller.go @@ -42,6 +42,7 @@ import ( condition "github.com/openstack-k8s-operators/lib-common/modules/common/condition" common_helper "github.com/openstack-k8s-operators/lib-common/modules/common/helper" "github.com/openstack-k8s-operators/lib-common/modules/common/webhook" + cyborgv1 "github.com/openstack-k8s-operators/nova-operator/api/cyborg/v1beta1" corev1 "k8s.io/api/core/v1" designatev1 "github.com/openstack-k8s-operators/designate-operator/api/v1beta1" @@ -132,6 +133,7 @@ func (r *OpenStackControlPlaneReconciler) GetLogger(ctx context.Context) logr.Lo // +kubebuilder:rbac:groups=config.openshift.io,resources=networks,verbs=get;list;watch; // +kubebuilder:rbac:groups=topology.openstack.org,resources=topologies,verbs=get;list;watch;update // +kubebuilder:rbac:groups=watcher.openstack.org,resources=watchers,verbs=get;list;watch;create;update;patch;delete +// +kubebuilder:rbac:groups=cyborg.openstack.org,resources=cyborgs,verbs=get;list;watch;create;update;patch;delete // Reconcile is part of the main kubernetes reconciliation loop which aims to // move the current state of the cluster closer to the desired state. @@ -752,6 +754,13 @@ func (r *OpenStackControlPlaneReconciler) reconcileNormal(ctx context.Context, i return ctrlResult, nil } + ctrlResult, err = openstack.ReconcileCyborg(ctx, instance, version, helper) + if err != nil { + return ctrl.Result{}, err + } else if (ctrlResult != ctrl.Result{}) { + return ctrlResult, nil + } + ctrlResult, errs := openstack.DeleteCertsAndRoutes(ctx, instance, helper) if errs != nil { instance.Status.Conditions.Set(condition.FalseCondition( @@ -879,6 +888,7 @@ func (r *OpenStackControlPlaneReconciler) SetupWithManager( Owns(&certmgrv1.Certificate{}). Owns(&barbicanv1.Barbican{}). Owns(&watcherv1.Watcher{}). + Owns(&cyborgv1.Cyborg{}). Owns(&corev1beta1.OpenStackVersion{}). Watches( &corev1.Secret{}, @@ -933,6 +943,7 @@ func apiOverrideTLSSecretNames(spec *corev1beta1.OpenStackControlPlaneSpec) []st spec.Designate.APIOverride, spec.Barbican.APIOverride, spec.Watcher.APIOverride, + spec.Cyborg.APIOverride, } overrides = slices.AppendSeq(overrides, maps.Values(spec.Glance.APIOverride)) for _, c := range spec.Nova.CellOverride { diff --git a/internal/openstack/cyborg.go b/internal/openstack/cyborg.go new file mode 100644 index 000000000..83f1341eb --- /dev/null +++ b/internal/openstack/cyborg.go @@ -0,0 +1,264 @@ +package openstack + +import ( + "context" + "fmt" + + "github.com/openstack-k8s-operators/lib-common/modules/common/condition" + "github.com/openstack-k8s-operators/lib-common/modules/common/helper" + "github.com/openstack-k8s-operators/lib-common/modules/common/service" + + "sigs.k8s.io/controller-runtime/pkg/controller/controllerutil" + + cyborgv1 "github.com/openstack-k8s-operators/nova-operator/api/cyborg/v1beta1" + corev1beta1 "github.com/openstack-k8s-operators/openstack-operator/api/core/v1beta1" + k8s_errors "k8s.io/apimachinery/pkg/api/errors" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/types" + ctrl "sigs.k8s.io/controller-runtime" +) + +// ReconcileCyborg - +func ReconcileCyborg(ctx context.Context, instance *corev1beta1.OpenStackControlPlane, version *corev1beta1.OpenStackVersion, helper *helper.Helper) (ctrl.Result, error) { + cyborg := &cyborgv1.Cyborg{ + ObjectMeta: metav1.ObjectMeta{ + Name: "cyborg", + Namespace: instance.Namespace, + }, + } + + if !instance.Spec.Cyborg.Enabled { + if res, err := EnsureDeleted(ctx, helper, cyborg); err != nil { + return res, err + } + instance.Status.Conditions.Remove(corev1beta1.OpenStackControlPlaneCyborgReadyCondition) + instance.Status.Conditions.Remove(corev1beta1.OpenStackControlPlaneExposeCyborgReadyCondition) + instance.Status.ContainerImages.CyborgAPIImage = nil + instance.Status.ContainerImages.CyborgAgentImage = nil + instance.Status.ContainerImages.CyborgConductorImage = nil + // Clean up AC CRs when service is disabled + if err := CleanupApplicationCredentialForService(ctx, helper, instance, cyborg.Name); err != nil { + return ctrl.Result{}, err + } + return ctrl.Result{}, nil + } + + if instance.Spec.Cyborg.Template == nil { + instance.Spec.Cyborg.Template = &cyborgv1.CyborgSpecCore{} + } + + // add selector to service overrides + for _, endpointType := range []service.Endpoint{service.EndpointPublic, service.EndpointInternal} { + if instance.Spec.Cyborg.Template.APIServiceTemplate.Override.Service == nil { + instance.Spec.Cyborg.Template.APIServiceTemplate.Override.Service = map[service.Endpoint]service.RoutedOverrideSpec{} + } + instance.Spec.Cyborg.Template.APIServiceTemplate.Override.Service[endpointType] = AddServiceOpenStackOperatorLabel( + instance.Spec.Cyborg.Template.APIServiceTemplate.Override.Service[endpointType], + cyborg.Name) + } + + // When component services got created check if there is the need to create a route + if err := helper.GetClient().Get(ctx, types.NamespacedName{Name: "cyborg", Namespace: instance.Namespace}, cyborg); err != nil { + if !k8s_errors.IsNotFound(err) { + return ctrl.Result{}, err + } + } + + // Application Credential Management (Day-2 operation) + // Cyborg uses pointer fields, safely extract values + cyborgReady := cyborg.Status.Conditions != nil && cyborg.Status.ObservedGeneration == cyborg.Generation && cyborg.IsReady() + + // Helper to get Cyborg values (which are pointers) with fallback logic + getCyborgSecret := func() string { + if instance.Spec.Cyborg.Template.Secret != nil && *instance.Spec.Cyborg.Template.Secret != "" { + return *instance.Spec.Cyborg.Template.Secret + } + // Apply same fallback as in CreateOrPatch + return instance.Spec.Secret + } + getCyborgServiceUser := func() string { + if instance.Spec.Cyborg.Template.ServiceUser != nil { + return *instance.Spec.Cyborg.Template.ServiceUser + } + return "" + } + getCyborgPasswordSelector := func() string { + if instance.Spec.Cyborg.Template.PasswordSelectors != nil { + return instance.Spec.Cyborg.Template.PasswordSelectors.Service + } + return "" + } + + // Always reconcile AC - EnsureApplicationCredentialForService checks cluster state and handles the full AC lifecycle. + if instance.Spec.Cyborg.ApplicationCredential != nil || + instance.Spec.Cyborg.Template.Auth.ApplicationCredentialSecret != "" { + + acSecretName, acResult, err := EnsureApplicationCredentialForService( + ctx, + helper, + instance, + cyborg.Name, + cyborgReady, + getCyborgSecret(), + getCyborgPasswordSelector(), + getCyborgServiceUser(), + instance.Spec.Cyborg.ApplicationCredential, + false, + ) + if err != nil { + return ctrl.Result{}, err + } + + // If AC is not ready, return immediately without updating the service CR + if (acResult != ctrl.Result{}) { + return acResult, nil + } + + // Set ApplicationCredentialSecret based on what the helper returned: + // - If AC disabled: returns "" + // - If AC enabled and ready: returns the AC secret name + instance.Spec.Cyborg.Template.Auth.ApplicationCredentialSecret = acSecretName + } + + // preserve any previously set TLS certs, set CA cert + if instance.Spec.TLS.PodLevel.Enabled { + instance.Spec.Cyborg.Template.APIServiceTemplate.TLS = cyborg.Spec.APIServiceTemplate.TLS + } + instance.Spec.Cyborg.Template.APIServiceTemplate.TLS.CaBundleSecretName = instance.Status.TLS.CaBundleSecretName + + svcs, err := service.GetServicesListWithLabel( + ctx, + helper, + instance.Namespace, + GetServiceOpenStackOperatorLabel(cyborg.Name), + ) + if err != nil { + return ctrl.Result{}, err + } + + // make sure to get to EndpointConfig when all service got created + if len(svcs.Items) == len(instance.Spec.Cyborg.Template.APIServiceTemplate.Override.Service) { + endpointDetails, ctrlResult, err := EnsureEndpointConfig( + ctx, + instance, + helper, + cyborg, + svcs, + instance.Spec.Cyborg.Template.APIServiceTemplate.Override.Service, + instance.Spec.Cyborg.APIOverride, + corev1beta1.OpenStackControlPlaneExposeCyborgReadyCondition, + false, // TODO: (mschuppert) could be removed when all integrated service support TLS + instance.Spec.Cyborg.Template.APIServiceTemplate.TLS, + ) + if err != nil { + return ctrlResult, err + } else if (ctrlResult != ctrl.Result{}) { + return ctrlResult, nil + } + // set service overrides + instance.Spec.Cyborg.Template.APIServiceTemplate.Override.Service = endpointDetails.GetEndpointServiceOverrides() + // update TLS settings with cert secret + instance.Spec.Cyborg.Template.APIServiceTemplate.TLS.API.Public.SecretName = endpointDetails.GetEndptCertSecret(service.EndpointPublic) + instance.Spec.Cyborg.Template.APIServiceTemplate.TLS.API.Internal.SecretName = endpointDetails.GetEndptCertSecret(service.EndpointInternal) + } + + if instance.Spec.Cyborg.Template.NodeSelector == nil { + instance.Spec.Cyborg.Template.NodeSelector = &instance.Spec.NodeSelector + } + + // When there's no Topology referenced in the Service Template, inject the + // top-level one + // NOTE: This does not check the Service subCRs: by default the generated + // subCRs inherit the top-level TopologyRef unless an override is present + if instance.Spec.Cyborg.Template.TopologyRef == nil { + instance.Spec.Cyborg.Template.TopologyRef = instance.Spec.TopologyRef + } + + // Propagate MessagingBus from top-level to template if not set + // Template-level takes precedence over top-level + if instance.Spec.MessagingBus != nil && instance.Spec.MessagingBus.Cluster != "" { + if instance.Spec.Cyborg.Template.MessagingBus.Cluster == "" { + instance.Spec.Cyborg.Template.MessagingBus = *instance.Spec.MessagingBus + } + } + + helper.GetLogger().Info("Reconciling Cyborg", "Cyborg.Namespace", instance.Namespace, "Cyborg.Name", "cyborg") + op, err := controllerutil.CreateOrPatch(ctx, helper.GetClient(), cyborg, func() error { + instance.Spec.Cyborg.Template.DeepCopyInto(&cyborg.Spec.CyborgSpecCore) + + if version.Status.ContainerImages.CyborgAPIImage == nil || + version.Status.ContainerImages.CyborgAgentImage == nil || + version.Status.ContainerImages.CyborgConductorImage == nil { + return fmt.Errorf("no Cyborg images found in the OpenStackVersion") + } + cyborg.Spec.APIContainerImageURL = *version.Status.ContainerImages.CyborgAPIImage + cyborg.Spec.AgentContainerImageURL = *version.Status.ContainerImages.CyborgAgentImage + cyborg.Spec.ConductorContainerImageURL = *version.Status.ContainerImages.CyborgConductorImage + + if *cyborg.Spec.Secret == "" { + *cyborg.Spec.Secret = instance.Spec.Secret + } + + err := controllerutil.SetControllerReference(helper.GetBeforeObject(), cyborg, helper.GetScheme()) + if err != nil { + return err + } + return nil + }) + if err != nil { + instance.Status.Conditions.Set(condition.FalseCondition( + corev1beta1.OpenStackControlPlaneCyborgReadyCondition, + condition.ErrorReason, + condition.SeverityWarning, + corev1beta1.OpenStackControlPlaneCyborgReadyErrorMessage, + err.Error())) + return ctrl.Result{}, err + } + if op != controllerutil.OperationResultNone { + helper.GetLogger().Info(fmt.Sprintf("cyborg %s - %s", cyborg.Name, op)) + } + + if cyborg.Status.ObservedGeneration == cyborg.Generation && cyborg.IsReady() { + helper.GetLogger().Info("Cyborg ready condition is true") + instance.Status.ContainerImages.CyborgAPIImage = version.Status.ContainerImages.CyborgAPIImage + instance.Status.ContainerImages.CyborgAgentImage = version.Status.ContainerImages.CyborgAgentImage + instance.Status.ContainerImages.CyborgConductorImage = version.Status.ContainerImages.CyborgConductorImage + instance.Status.Conditions.MarkTrue(corev1beta1.OpenStackControlPlaneCyborgReadyCondition, corev1beta1.OpenStackControlPlaneCyborgReadyMessage) + } else { + // We want to mirror the condition of the highest priority from the Cyborg resource into the instance + // under the condition of type OpenStackControlPlaneCyborgReadyCondition, but only if the sub-resource + // currently has any conditions (which won't be true for the initial creation of the sub-resource, since + // it has not gone through a reconcile loop yet to have any conditions). If this condition ends up being + // the highest priority condition in the OpenStackControlPlane, it will appear in the OpenStackControlPlane's + // "Ready" condition at the end of the reconciliation loop, clearly surfacing the condition to the user in + // the "oc get oscontrolplane -n " output. + if len(cyborg.Status.Conditions) > 0 { + MirrorSubResourceCondition(cyborg.Status.Conditions, corev1beta1.OpenStackControlPlaneCyborgReadyCondition, instance, cyborg.Kind) + } else { + // Default to the associated "running" condition message for the sub-resource if it currently lacks any conditions for mirroring + instance.Status.Conditions.Set(condition.FalseCondition( + corev1beta1.OpenStackControlPlaneCyborgReadyCondition, + condition.RequestedReason, + condition.SeverityInfo, + corev1beta1.OpenStackControlPlaneCyborgReadyRunningMessage)) + } + } + + return ctrl.Result{}, nil +} + +// CyborgImageMatch - return true if the Cyborg images match on the ControlPlane and Version, or if Cyborg is not enabled +func CyborgImageMatch(ctx context.Context, controlPlane *corev1beta1.OpenStackControlPlane, version *corev1beta1.OpenStackVersion) bool { + Log := GetLogger(ctx) + + if controlPlane.Spec.Cyborg.Enabled { + if !stringPointersEqual(controlPlane.Status.ContainerImages.CyborgAPIImage, version.Status.ContainerImages.CyborgAPIImage) || + !stringPointersEqual(controlPlane.Status.ContainerImages.CyborgAgentImage, version.Status.ContainerImages.CyborgAgentImage) || + !stringPointersEqual(controlPlane.Status.ContainerImages.CyborgConductorImage, version.Status.ContainerImages.CyborgConductorImage) { + Log.Info("Cyborg images do not match") + return false + } + } + + return true +} diff --git a/test/functional/ctlplane/base_test.go b/test/functional/ctlplane/base_test.go index 232565efb..cf369146f 100644 --- a/test/functional/ctlplane/base_test.go +++ b/test/functional/ctlplane/base_test.go @@ -38,6 +38,7 @@ import ( manilav1 "github.com/openstack-k8s-operators/manila-operator/api/v1beta1" mariadbv1 "github.com/openstack-k8s-operators/mariadb-operator/api/v1beta1" neutronv1 "github.com/openstack-k8s-operators/neutron-operator/api/v1beta1" + cyborgv1 "github.com/openstack-k8s-operators/nova-operator/api/cyborg/v1beta1" novav1 "github.com/openstack-k8s-operators/nova-operator/api/nova/v1beta1" octaviav1 "github.com/openstack-k8s-operators/octavia-operator/api/v1beta1" backupv1 "github.com/openstack-k8s-operators/openstack-operator/api/backup/v1beta1" @@ -58,6 +59,7 @@ type Names struct { MemcachedName types.NamespacedName MemcachedCertName types.NamespacedName CinderName types.NamespacedName + CyborgName types.NamespacedName ManilaName types.NamespacedName GlanceName types.NamespacedName NeutronName types.NamespacedName @@ -105,6 +107,9 @@ type Names struct { WatcherCertPublicRouteName types.NamespacedName WatcherCertPublicSvcName types.NamespacedName WatcherCertInternalName types.NamespacedName + CyborgCertPublicRouteName types.NamespacedName + CyborgCertPublicSvcName types.NamespacedName + CyborgCertInternalName types.NamespacedName } func CreateNames(openstackControlplaneName types.NamespacedName) Names { @@ -172,6 +177,10 @@ func CreateNames(openstackControlplaneName types.NamespacedName) Names { Namespace: openstackControlplaneName.Namespace, Name: "cinder", }, + CyborgName: types.NamespacedName{ + Namespace: openstackControlplaneName.Namespace, + Name: "cyborg", + }, GlanceName: types.NamespacedName{ Namespace: openstackControlplaneName.Namespace, Name: "glance", @@ -322,6 +331,18 @@ func CreateNames(openstackControlplaneName types.NamespacedName) Names { Name: "cert-watcher-internal-svc", Namespace: openstackControlplaneName.Namespace, }, + CyborgCertPublicRouteName: types.NamespacedName{ + Name: "cert-cyborg-public-route", + Namespace: openstackControlplaneName.Namespace, + }, + CyborgCertPublicSvcName: types.NamespacedName{ + Name: "cert-cyborg-public-svc", + Namespace: openstackControlplaneName.Namespace, + }, + CyborgCertInternalName: types.NamespacedName{ + Name: "cert-cyborg-internal-svc", + Namespace: openstackControlplaneName.Namespace, + }, } } @@ -992,3 +1013,12 @@ func GetKeystone(name types.NamespacedName) *keystonev1.KeystoneAPI { }, timeout, interval).Should(Succeed()) return instance } + +// GetCyborg +func GetCyborg(name types.NamespacedName) *cyborgv1.Cyborg { + instance := &cyborgv1.Cyborg{} + Eventually(func(g Gomega) { + g.Expect(k8sClient.Get(ctx, name, instance)).Should(Succeed()) + }, timeout, interval).Should(Succeed()) + return instance +} diff --git a/test/functional/ctlplane/openstackoperator_controller_test.go b/test/functional/ctlplane/openstackoperator_controller_test.go index 60b2b9db3..bd2f55aaa 100644 --- a/test/functional/ctlplane/openstackoperator_controller_test.go +++ b/test/functional/ctlplane/openstackoperator_controller_test.go @@ -52,6 +52,7 @@ import ( "github.com/openstack-k8s-operators/lib-common/modules/common/tls" "github.com/openstack-k8s-operators/lib-common/modules/users" manilav1 "github.com/openstack-k8s-operators/manila-operator/api/v1beta1" + cyborgv1 "github.com/openstack-k8s-operators/nova-operator/api/cyborg/v1beta1" novav1 "github.com/openstack-k8s-operators/nova-operator/api/nova/v1beta1" placementv1 "github.com/openstack-k8s-operators/nova-operator/api/placement/v1beta1" clientv1 "github.com/openstack-k8s-operators/openstack-operator/api/client/v1beta1" @@ -155,6 +156,12 @@ var _ = Describe("OpenStackOperator controller", func() { tp := svc.Spec.TopologyRef return svc, tp }) + cyborgTopologyService = Entry("the cyborg service", func() ( + client.Object, *topologyv1.TopoRef) { + svc := GetCyborg(names.CyborgName) + tp := svc.Spec.TopologyRef + return svc, tp + }) glanceNotifSvc = Entry("the Glance service", func() ( client.Object, *string) { @@ -2464,6 +2471,178 @@ var _ = Describe("OpenStackOperator controller", func() { }) }) + When("A cyborg OpenStackControlplane instance is created with default values", func() { + BeforeEach(func() { + spec := GetDefaultOpenStackControlPlaneSpec() + spec["cyborg"] = map[string]interface{}{ + "enabled": true, + } + + // create cert secrets for rabbitmq instances + DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.RabbitMQCertName)) + DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.RabbitMQCell1CertName)) + DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.RabbitMQNotificationsCertName)) + // create cert secrets for memcached instance + DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.MemcachedCertName)) + // create cert secrets for ovn instance + DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.OVNNorthdCertName)) + DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.OVNControllerCertName)) + DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.OVNMetricsCertName)) + DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.InstanceHAMetricsCertName)) + DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.NeutronOVNCertName)) + + DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.CyborgCertPublicRouteName)) + DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.CyborgCertPublicSvcName)) + DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.CyborgCertInternalName)) + + DeferCleanup( + th.DeleteInstance, + CreateOpenStackControlPlane(names.OpenStackControlplaneName, spec), + ) + + }) + + It("should have cyborg enabled and default values", func() { + OSCtlplane := GetOpenStackControlPlane(names.OpenStackControlplaneName) + Expect(OSCtlplane.Spec.Cyborg.Enabled).Should(BeTrue()) + + Expect(OSCtlplane.Spec.TLS.Ingress.Enabled).Should(BeTrue()) + Expect(OSCtlplane.Spec.TLS.PodLevel.Enabled).Should(BeTrue()) + + Expect(OSCtlplane.Spec.Cyborg.APIOverride.Route).Should(Not(BeNil())) + Expect(OSCtlplane.Spec.Cyborg.APIOverride.Route.Annotations).Should(HaveKeyWithValue("haproxy.router.openshift.io/timeout", "60s")) + Expect(OSCtlplane.Spec.Cyborg.APIOverride.Route.Annotations).Should(HaveKeyWithValue("api.cyborg.openstack.org/timeout", "60s")) + + cyborg := GetCyborg(names.CyborgName) + // cyborg services exist + Eventually(func(g Gomega) { + cyborg := GetCyborg(names.CyborgName) + g.Expect(cyborg).Should(Not(BeNil())) + }, timeout, interval).Should(Succeed()) + + // default databaseInstance is openstack + Expect(cyborg.Spec.DatabaseInstance).Should(Equal(ptr.To("openstack"))) + Expect(cyborg.Spec.DatabaseAccount).Should(Equal(ptr.To("cyborg"))) + // default Cyborg container images are set + Expect(cyborg.Spec.APIContainerImageURL).Should(Not(BeNil())) + Expect(cyborg.Spec.APIContainerImageURL).Should(Equal("quay.io/openstack-s2i-containers/openstack-cyborg:master-latest")) + Expect(cyborg.Spec.AgentContainerImageURL).Should(Not(BeNil())) + Expect(cyborg.Spec.AgentContainerImageURL).Should(Equal("quay.io/openstack-s2i-containers/openstack-cyborg-agent:master-latest")) + Expect(cyborg.Spec.ConductorContainerImageURL).Should(Not(BeNil())) + Expect(cyborg.Spec.ConductorContainerImageURL).Should(Equal("quay.io/openstack-s2i-containers/openstack-cyborg:master-latest")) + + Expect(cyborg.Spec.APIServiceTemplate.TLS.Ca.CaBundleSecretName).Should(Equal("combined-ca-bundle")) + + }) + + It("should create cyborg route and populate TLS secrets", func() { + cyborgPublicSvcName := types.NamespacedName{Name: "cyborg-public", Namespace: namespace} + cyborgInternalSvcName := types.NamespacedName{Name: "cyborg-internal", Namespace: namespace} + + th.CreateService( + cyborgPublicSvcName, + map[string]string{ + "osctlplane-service": "cyborg", + "osctlplane": "", + }, + k8s_corev1.ServiceSpec{ + Ports: []k8s_corev1.ServicePort{ + { + Name: "cyborg-public", + Port: int32(9322), + Protocol: k8s_corev1.ProtocolTCP, + }, + }, + }) + cyborgSvc := th.GetService(cyborgPublicSvcName) + if cyborgSvc.Annotations == nil { + cyborgSvc.Annotations = map[string]string{} + } + cyborgSvc.Annotations[service.AnnotationIngressCreateKey] = "true" + cyborgSvc.Annotations[service.AnnotationEndpointKey] = "public" + Expect(th.K8sClient.Status().Update(th.Ctx, cyborgSvc)).To(Succeed()) + th.CreateService( + cyborgInternalSvcName, + map[string]string{ + "osctlplane-service": "cyborg", + "osctlplane": "", + }, + k8s_corev1.ServiceSpec{ + Ports: []k8s_corev1.ServicePort{ + { + Name: "cyborg-internal", + Port: int32(9322), + Protocol: k8s_corev1.ProtocolTCP, + }, + }, + }) + cyborgIntSvc := th.GetService(cyborgInternalSvcName) + if cyborgIntSvc.Annotations == nil { + cyborgIntSvc.Annotations = map[string]string{} + } + cyborgIntSvc.Annotations[service.AnnotationIngressCreateKey] = "false" + cyborgIntSvc.Annotations[service.AnnotationEndpointKey] = "internal" + Expect(th.K8sClient.Status().Update(th.Ctx, cyborgIntSvc)).To(Succeed()) + + Eventually(func(g Gomega) { + cyborgRouteName := types.NamespacedName{Name: "cyborg-public", Namespace: namespace} + cyborgRoute := &routev1.Route{} + + g.Expect(th.K8sClient.Get(th.Ctx, cyborgRouteName, cyborgRoute)).Should(Succeed()) + g.Expect(cyborgRoute.Spec.TLS).Should(Not(BeNil())) + g.Expect(cyborgRoute.Spec.TLS.Certificate).Should(Not(BeEmpty())) + g.Expect(cyborgRoute.Spec.TLS.Key).Should(Not(BeEmpty())) + g.Expect(cyborgRoute.Spec.TLS.CACertificate).Should(Not(BeEmpty())) + }, timeout, interval).Should(Succeed()) + + cyborg := GetCyborg(names.CyborgName) + Expect(cyborg.Spec.APIServiceTemplate.TLS.API.Internal.SecretName).Should(Equal(ptr.To("cert-cyborg-internal-svc"))) + Expect(cyborg.Spec.APIServiceTemplate.TLS.API.Public.SecretName).Should(Equal(ptr.To("cert-cyborg-public-svc"))) + Expect(cyborg.Spec.APIServiceTemplate.Override.Service["public"].EndpointURL).Should(Not(BeNil())) + + }) + + It("should have ControlPlaneCyborgReadyCondition false when cyborg is not ready", func() { + + // expect the ready status to propagate to control plane object + Eventually(func(_ Gomega) { + th.ExpectCondition( + names.OpenStackControlplaneName, + ConditionGetterFunc(OpenStackControlPlaneConditionGetter), + corev1.OpenStackControlPlaneCyborgReadyCondition, + k8s_corev1.ConditionFalse, + ) + }, timeout, interval).Should(Succeed()) + }) + + It("should have ControlPlaneCyborgReadyCondition true when cyborg is ready", func() { + // simulate cyborg ready state + Eventually(func(g Gomega) { + cyborg := &cyborgv1.Cyborg{} + g.Expect(th.K8sClient.Get(th.Ctx, names.CyborgName, cyborg)).Should(Succeed()) + cyborg.Status.ObservedGeneration = cyborg.Generation + cyborg.Status.Conditions.MarkTrue(condition.ReadyCondition, "Ready") + g.Expect(th.K8sClient.Status().Update(th.Ctx, cyborg)).To(Succeed()) + th.Logger.Info("Simulated Cyborg ready", "on", names.CyborgName) + }, timeout, interval).Should(Succeed()) + + // expect the ready status to propagate to control plane object + Eventually(func(_ Gomega) { + th.ExpectCondition( + names.OpenStackControlplaneName, + ConditionGetterFunc(OpenStackControlPlaneConditionGetter), + corev1.OpenStackControlPlaneCyborgReadyCondition, + k8s_corev1.ConditionTrue, + ) + }, timeout, interval).Should(Succeed()) + + OSCtlplane := GetOpenStackControlPlane(names.OpenStackControlplaneName) + Expect(OSCtlplane.Status.ContainerImages.CyborgAPIImage).Should(Equal(ptr.To("quay.io/openstack-s2i-containers/openstack-cyborg:master-latest"))) + Expect(OSCtlplane.Status.ContainerImages.CyborgAgentImage).Should(Equal(ptr.To("quay.io/openstack-s2i-containers/openstack-cyborg-agent:master-latest"))) + Expect(OSCtlplane.Status.ContainerImages.CyborgConductorImage).Should(Equal(ptr.To("quay.io/openstack-s2i-containers/openstack-cyborg:master-latest"))) + }) + }) + When("OpenStackControlplane instance is deleted", func() { BeforeEach(func() { DeferCleanup( @@ -2823,6 +3002,9 @@ var _ = Describe("OpenStackOperator controller", func() { spec["watcher"] = map[string]interface{}{ "enabled": true, } + spec["cyborg"] = map[string]interface{}{ + "enabled": true, + } // Build the topology Spec topologySpec := GetSampleTopologySpec() // Create Test Topologies @@ -2914,6 +3096,7 @@ var _ = Describe("OpenStackOperator controller", func() { horizonTopologyService, heatTopologyService, watcherTopologyService, + cyborgTopologyService, ) DescribeTable("An OpenStackControlplane updates the topology reference", func(serviceNameFunc func() (client.Object, *topologyv1.TopoRef)) { @@ -2946,6 +3129,7 @@ var _ = Describe("OpenStackOperator controller", func() { horizonTopologyService, heatTopologyService, watcherTopologyService, + cyborgTopologyService, ) DescribeTable("An OpenStackControlplane Service (Glance) overrides the topology reference", func(serviceNameFunc func() (client.Object, *topologyv1.TopoRef)) { @@ -2994,6 +3178,7 @@ var _ = Describe("OpenStackOperator controller", func() { horizonTopologyService, heatTopologyService, watcherTopologyService, + cyborgTopologyService, ) DescribeTable("An OpenStackControlplane removes the topology reference", func(serviceNameFunc func() (client.Object, *topologyv1.TopoRef)) { @@ -3022,6 +3207,7 @@ var _ = Describe("OpenStackOperator controller", func() { horizonTopologyService, heatTopologyService, watcherTopologyService, + cyborgTopologyService, ) }) diff --git a/test/functional/ctlplane/suite_test.go b/test/functional/ctlplane/suite_test.go index 0d2e48c07..4e12e4e93 100644 --- a/test/functional/ctlplane/suite_test.go +++ b/test/functional/ctlplane/suite_test.go @@ -46,6 +46,7 @@ import ( manilav1 "github.com/openstack-k8s-operators/manila-operator/api/v1beta1" mariadbv1 "github.com/openstack-k8s-operators/mariadb-operator/api/v1beta1" neutronv1 "github.com/openstack-k8s-operators/neutron-operator/api/v1beta1" + cyborgv1 "github.com/openstack-k8s-operators/nova-operator/api/cyborg/v1beta1" novav1 "github.com/openstack-k8s-operators/nova-operator/api/nova/v1beta1" placementv1 "github.com/openstack-k8s-operators/nova-operator/api/placement/v1beta1" octaviav1 "github.com/openstack-k8s-operators/octavia-operator/api/v1beta1" @@ -156,6 +157,7 @@ var _ = BeforeSuite(func() { neutronv1CRDs, err := test.GetCRDDirFromModule( "github.com/openstack-k8s-operators/neutron-operator/api", gomod, "bases") Expect(err).ShouldNot(HaveOccurred()) + // Cyborg CRDs are included with Nova CRDs novav1CRDs, err := test.GetCRDDirFromModule( "github.com/openstack-k8s-operators/nova-operator/api", gomod, "bases") Expect(err).ShouldNot(HaveOccurred()) @@ -321,6 +323,8 @@ var _ = BeforeSuite(func() { Expect(err).NotTo(HaveOccurred()) err = k8s_networkingv1.AddToScheme(scheme.Scheme) Expect(err).NotTo(HaveOccurred()) + err = cyborgv1.AddToScheme(scheme.Scheme) + Expect(err).NotTo(HaveOccurred()) // +kubebuilder:scaffold:scheme @@ -378,6 +382,8 @@ var _ = BeforeSuite(func() { openstack.SetupServiceOperatorDefaults() openstackclientv1.SetupDefaults() corev1.SetupVersionDefaults() + // Cyborg's Default() depends on package-level defaults initialized here. + cyborgv1.SetupDefaults() err = (&client_ctrl.OpenStackClientReconciler{ Client: k8sManager.GetClient(), diff --git a/test/kuttl/tests/ctlplane-collapsed/01-assert-collapsed-cell.yaml b/test/kuttl/tests/ctlplane-collapsed/01-assert-collapsed-cell.yaml index f40629c1d..0829f3a50 100644 --- a/test/kuttl/tests/ctlplane-collapsed/01-assert-collapsed-cell.yaml +++ b/test/kuttl/tests/ctlplane-collapsed/01-assert-collapsed-cell.yaml @@ -170,6 +170,15 @@ spec: replicas: 1 decisionengineServiceTemplate: replicas: 1 + cyborg: + enabled: true + template: + databaseInstance: openstack + databaseAccount: cyborg + apiServiceTemplate: + replicas: 1 + conductorServiceTemplate: + replicas: 1 status: conditions: - message: Setup complete @@ -232,6 +241,10 @@ status: reason: Ready status: "True" type: OpenStackControlPlaneExposeWatcherReady + - message: OpenStackControlPlane cyborg service exposed + reason: Ready + status: "True" + type: OpenStackControlPlaneExposeCyborgReady - message: OpenStackControlPlane Glance completed reason: Ready status: "True" @@ -300,3 +313,7 @@ status: reason: Ready status: "True" type: OpenStackControlPlaneWatcherReady + - message: OpenStackControlPlane Cyborg completed + reason: Ready + status: "True" + type: OpenStackControlPlaneCyborgReady From e25cd15982d4426cc777d619766cd6574c9e0cdd Mon Sep 17 00:00:00 2001 From: melanie witt Date: Fri, 6 Nov 2026 21:56:48 +0200 Subject: [PATCH 3/4] Add default OpenStackDataPlaneService for Cyborg Cyborg has an agent that runs on compute nodes to manage accelerator devices. Add a default dataplane service definition so that cyborg can be included in the dataplane nodeset services list without users having to create the service manually. Jira: OSPRH-2767 Signed-off-by: melanie witt --- ...beta1_openstackdataplaneservice_cyborg.yaml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 config/services/dataplane_v1beta1_openstackdataplaneservice_cyborg.yaml diff --git a/config/services/dataplane_v1beta1_openstackdataplaneservice_cyborg.yaml b/config/services/dataplane_v1beta1_openstackdataplaneservice_cyborg.yaml new file mode 100644 index 000000000..846c54580 --- /dev/null +++ b/config/services/dataplane_v1beta1_openstackdataplaneservice_cyborg.yaml @@ -0,0 +1,18 @@ +apiVersion: dataplane.openstack.org/v1beta1 +kind: OpenStackDataPlaneService +metadata: + name: cyborg +spec: + dependsOn: + - nova + dataSources: + - secretRef: + name: cyborg-agent-config + - configMapRef: + name: cyborg-extra-config + optional: true + playbook: osp.edpm.cyborg + caCerts: combined-ca-bundle + edpmServiceType: cyborg + containerImageFields: + - CyborgAgentImage From af31a475a4a6e38262fe0edf9ffed74bdb956ca8 Mon Sep 17 00:00:00 2001 From: melanie witt Date: Fri, 6 Nov 2026 22:16:35 +0200 Subject: [PATCH 4/4] Update auto-generated documentation Update the auto-generated documentation using `make docs`. Note this includes more changes that the watcher addition which had not been synced. Jira: OSPRH-2767 Signed-off-by: melanie witt --- docs/assemblies/ctlplane_resources.adoc | 21450 ++++++++++------ docs/assemblies/dataplane_resources.adoc | 89 +- ...aPlaneNodeSet-CR-for-bare-metal-nodes.adoc | 7 + ...neNodeSet-CR-for-preprovisioned-nodes.adoc | 7 + 4 files changed, 13193 insertions(+), 8360 deletions(-) diff --git a/docs/assemblies/ctlplane_resources.adoc b/docs/assemblies/ctlplane_resources.adoc index e5073630b..863d16259 100644 --- a/docs/assemblies/ctlplane_resources.adoc +++ b/docs/assemblies/ctlplane_resources.adoc @@ -8,15 +8,19 @@ [#sub-resources] === Sub Resources +* <> * <> * <> * <> * <> +* <> +* <> * <> * <> * <> * <> * <> +* <> * <> * <> * <> @@ -42,6 +46,7 @@ * <> * <> * <> +* <> * <> * <> * <> @@ -59,6 +64,12 @@ * <> * <> * <> +* <> +* <> +* <> +* <> +* <> +* <> * <> * <> * <> @@ -71,28 +82,35 @@ * <> * <> * <> -* <> -* <> -* <> -* <> -* <> -* <> * <> * <> * <> * <> * <> +* <> * <> +* <> * <> * <> +* <> * <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> * <> +* <> * <> * <> * <> * <> * <> * <> +* <> * <> * <> * <> @@ -105,20 +123,14 @@ * <> * <> * <> -* <> -* <> -* <> -* <> -* <> -* <> -* <> -* <> +* <> * <> * <> * <> * <> * <> * <> +* <> * <> * <> * <> @@ -126,7 +138,16 @@ * <> * <> * <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> * <> +* <> * <> * <> * <> @@ -149,14 +170,6 @@ * <> * <> * <> -* <> -* <> -* <> -* <> -* <> -* <> -* <> -* <> * <> * <> * <> @@ -168,13 +181,10 @@ * <> * <> * <> +* <> * <> * <> * <> -* <> -* <> -* <> -* <> * <> * <> * <> @@ -184,11 +194,23 @@ * <> * <> * <> +* <> +* <> +* <> +* <> * <> +* <> +* <> * <> * <> * <> * <> +* <> +* <> +* <> +* <> +* <> +* <> * <> * <> * <> @@ -206,12 +228,6 @@ * <> * <> * <> -* <> -* <> -* <> -* <> -* <> -* <> * <> * <> * <> @@ -219,9 +235,17 @@ * <> * <> * <> +* <> * <> * <> * <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> * <> * <> * <> @@ -233,6 +257,9 @@ * <> * <> * <> +* <> +* <> +* <> * <> * <> * <> @@ -245,13 +272,6 @@ * <> * <> * <> -* <> -* <> -* <> -* <> -* <> -* <> -* <> * <> * <> * <> @@ -261,6 +281,11 @@ * <> * <> * <> +* <> +* <> +* <> +* <> +* <> * <> * <> * <> @@ -273,7 +298,17 @@ * <> * <> * <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> * <> +* <> * <> * <> * <> @@ -286,32 +321,30 @@ * <> * <> * <> +* <> * <> * <> * <> * <> * <> * <> -* <> -* <> -* <> -* <> -* <> -* <> -* <> -* <> -* <> -* <> -* <> -* <> -* <> -* <> +* <> * <> * <> * <> +* <> * <> * <> * <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> * <> * <> * <> @@ -321,6 +354,7 @@ * <> * <> * <> +* <> * <> * <> * <> @@ -329,10 +363,34 @@ * <> * <> * <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> * <> * <> * <> * <> +* <> +* <> +* <> +* <> * <> * <> * <> @@ -345,12 +403,14 @@ * <> * <> * <> +* <> * <> * <> * <> * <> * <> * <> +* <> * <> * <> * <> @@ -374,16 +434,31 @@ * <> * <> * <> -* <> -* <> -* <> -* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> * <> * <> * <> * <> * <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> * <> +* <> * <> * <> * <> @@ -396,15 +471,6 @@ * <> * <> * <> -* <> -* <> -* <> -* <> -* <> -* <> -* <> -* <> -* <> * <> * <> * <> @@ -446,13 +512,13 @@ * <> * <> * <> -* <> -* <> -* <> -* <> -* <> -* <> -* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> * <> * <> * <> @@ -471,13 +537,6 @@ * <> * <> * <> -* <> -* <> -* <> -* <> -* <> -* <> -* <> * <> * <> * <> @@ -492,6 +551,30 @@ * <> * <> * <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> * <> * <> * <> @@ -503,10 +586,14 @@ * <> * <> * <> +* <> +* <> * <> * <> * <> * <> +* <> +* <> * <> * <> * <> @@ -516,12 +603,17 @@ * <> * <> * <> +* <> * <> * <> * <> * <> * <> * <> +* <> +* <> +* <> +* <> * <> * <> * <> @@ -538,10 +630,6 @@ * <> * <> * <> -* <> -* <> -* <> -* <> * <> * <> * <> @@ -583,16 +671,64 @@ * <> * <> * <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> * <> * <> * <> * <> * <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> * <> * <> * <> * <> +[#mcpconfig] +==== MCPConfig + +MCPConfig defines optional MCP server sidecar configuration + +|=== +| Field | Description | Scheme | Required + +| enabled +| Enabled controls whether the MCP server sidecar is added to the pod. +| bool +| false +|=== + +<> + [#openstackclient] ==== OpenStackClient @@ -652,6 +788,16 @@ OpenStackClientSpec defines the desired state of OpenStackClient | ContainerImage for the OpenstackClient container (will be set to environmental default if empty) | string | true + +| mcpContainerImage +| MCPContainerImage for the MCP server sidecar container (set via OpenStackVersion) +| string +| false + +| mcpCertSecretName +| MCPCertSecretName is the name of the TLS certificate Secret for the MCP server sidecar. It is populated by the OpenStackControlPlane, which owns the cert lifecycle; the OpenStackClient controller only consumes it. +| string +| false |=== <> @@ -683,6 +829,11 @@ OpenStackClientSpecCore defines the desired state of OpenStackClient | List of environment variables to set in the container. | []corev1.EnvVar | false + +| mcp +| MCP is the optional MCP server sidecar configuration. When enabled, the rhos-mcps server runs alongside the openstackclient container and is exposed via a k8s Service. Typically used by OpenStackAssistant. +| *<> +| false |=== <> @@ -714,6 +865,78 @@ OpenStackClientStatus defines the observed state of OpenStackClient | Map of hashes to track e.g. pod spec | map[string]string | false + +| mcpEndpoint +| MCPEndpoint is the URL of the MCP server when the sidecar is enabled. +| string +| false +|=== + +<> + +[#acrule] +==== ACRule + +ACRule describes a single access rule for an ApplicationCredential + +|=== +| Field | Description | Scheme | Required + +| service +| Service is the name of the service to target (e.g. "identity"). +| string +| true + +| path +| Path is the HTTP path (e.g. "/v3/auth/tokens"). +| string +| true + +| method +| Method is the HTTP method to allow (e.g. "POST"). +| string +| true +|=== + +<> + +[#applicationcredentialsection] +==== ApplicationCredentialSection + +ApplicationCredentialSection defines the desired configuration for ApplicationCredentials + +|=== +| Field | Description | Scheme | Required + +| enabled +| Enabled indicates whether an ApplicationCredential should be created +| bool +| true + +| expirationDays +| ExpirationDays sets the lifetime in days for the AC +| *int +| true + +| gracePeriodDays +| GracePeriodDays sets how many days before expiration the AC should be rotated +| *int +| true + +| roles +| Roles to assign to the ApplicationCredential +| []string +| true + +| unrestricted +| Whether the AC should be unrestricted +| *bool +| true + +| accessRules +| AccessRules lets supply a custom list of rules If unset, no accessRules field is emitted +| []<> +| false |=== <> @@ -740,6 +963,11 @@ BarbicanSection defines the desired state of Barbican service | APIOverride, provides the ability to override the generated manifest of several child resources. | <> | false + +| applicationCredential +| ApplicationCredential allows service-specific overrides of the global AC configuration. +| *<> +| true |=== <> @@ -839,30 +1067,71 @@ CinderSection defines the desired state of Cinder service | UniquePodNames - Use a unique prefix for cinder CRs to have unique pod names. Convenient to avoid podname (and thus hostname) collision between different deployments. Useful for CI jobs as well as preproduction and production environments that use the same storage backend, etc. | bool | true + +| serviceName +| ServiceName - Cached service name for Cinder CR. Set automatically when UniquePodNames is enabled. This field preserves the service name (with UID suffix) across reconciliations and restores, ensuring consistent resource naming even when the CR is recreated. Should not be manually set. +| string +| false + +| applicationCredential +| ApplicationCredential allows service-specific overrides of the global AC configuration. +| *<> +| true |=== <> -[#dnsmasqsection] -==== DNSMasqSection +[#cyborgsection] +==== CyborgSection -DNSMasqSection defines the desired state of DNSMasq service +CyborgSection defines the desired state of Cyborg service |=== | Field | Description | Scheme | Required | enabled -| Enabled - Whether DNSMasq service should be deployed and managed +| Enabled - Whether Cyborg service should be deployed and managed | bool | true | template -| Template - Overrides to use when creating the DNSMasq service -| *networkv1.DNSMasqSpecCore +| Template - Overrides to use when creating the Cyborg service +| *cyborgv1.CyborgSpecCore | false -|=== - -<> + +| apiOverride +| APIOverride, provides the ability to override the generated manifest of several child resources. +| <> +| false + +| applicationCredential +| ApplicationCredential allows service-specific overrides of the global AC configuration. +| *<> +| true +|=== + +<> + +[#dnsmasqsection] +==== DNSMasqSection + +DNSMasqSection defines the desired state of DNSMasq service + +|=== +| Field | Description | Scheme | Required + +| enabled +| Enabled - Whether DNSMasq service should be deployed and managed +| bool +| true + +| template +| Template - Overrides to use when creating the DNSMasq service +| *networkv1.DNSMasqSpecCore +| false +|=== + +<> [#designatesection] ==== DesignateSection @@ -886,6 +1155,11 @@ DesignateSection defines the desired state of the Designate service | APIOverride, provides the ability to override the generated manifest of several child resources. | <> | false + +| applicationCredential +| ApplicationCredential allows service-specific overrides of the global AC configuration. +| *<> +| true |=== <> @@ -938,6 +1212,16 @@ GlanceSection defines the desired state of Glance service | UniquePodNames - Use a unique prefix for glance CRs to have unique pod names. Convenient to avoid podname (and thus hostname) collision between different deployments. Useful for CI jobs as well as preproduction and production environments that use the same storage backend, etc. | bool | true + +| serviceName +| ServiceName - Cached service name for Glance CR. Set automatically when UniquePodNames is enabled. This field preserves the service name (with UID suffix) across reconciliations and restores, ensuring consistent resource naming even when the CR is recreated. Should not be manually set. +| string +| false + +| applicationCredential +| ApplicationCredential allows service-specific overrides of the global AC configuration. +| *<> +| true |=== <> @@ -969,6 +1253,11 @@ HeatSection defines the desired state of Heat services | CnfAPIOverride, provides the ability to override the generated manifest of several child resources. | <> | false + +| applicationCredential +| ApplicationCredential allows service-specific overrides of the global AC configuration. +| *<> +| true |=== <> @@ -1026,6 +1315,11 @@ IronicSection defines the desired state of Ironic services | InspectorOverride, provides the ability to override the generated manifest of several child resources. | <> | false + +| applicationCredential +| ApplicationCredential allows service-specific overrides of the global AC configuration. +| *<> +| true |=== <> @@ -1078,6 +1372,11 @@ ManilaSection defines the desired state of Manila service | APIOverride, provides the ability to override the generated manifest of several child resources. | <> | false + +| applicationCredential +| ApplicationCredential allows service-specific overrides of the global AC configuration. +| *<> +| true |=== <> @@ -1125,6 +1424,11 @@ NeutronSection defines the desired state of Neutron service | APIOverride, provides the ability to override the generated manifest of several child resources. | <> | false + +| applicationCredential +| ApplicationCredential allows service-specific overrides of the global AC configuration. +| *<> +| true |=== <> @@ -1172,6 +1476,11 @@ NovaSection defines the desired state of Nova services | CellOverride, provides the ability to override the generated manifest of several child resources for a nova cell. cell0 never have compute nodes and therefore it won't have a noVNCProxy deployed. Providing an override for cell0 noVNCProxy does not have an effect. | map[string]<> | false + +| applicationCredential +| ApplicationCredential allows service-specific overrides of the global AC configuration. +| *<> +| true |=== <> @@ -1198,6 +1507,11 @@ OctaviaSection defines the desired state of the Octavia service | APIOverride, provides the ability to override the generated manifest of several child resources. | <> | false + +| applicationCredential +| ApplicationCredential allows service-specific overrides of the global AC configuration. +| *<> +| true |=== <> @@ -1328,11 +1642,21 @@ OpenStackControlPlaneSpec defines the desired state of OpenStackControlPlane | <> | false +| messagingBus +| MessagingBus configuration (username, vhost, and cluster) for RPC communication. This is the default configuration for all services. Individual services can override by setting their own Template.MessagingBus. +| *rabbitmqv1.RabbitMqConfig +| false + | notificationsBusInstance -| NotificationsBusInstance - the name of RabbitMQ Cluster CR to select a Messaging Bus Service instance used by all services that produce or consume notifications. Avoid colocating it with RabbitMQ services used for PRC. That instance will be pushed down for services, unless overriden in templates. +| NotificationsBusInstance - the name of RabbitMQ Cluster CR to select a Messaging Bus Service instance used by all services that produce or consume notifications. Avoid colocating it with RabbitMQ services used for PRC. That instance will be pushed down for services, unless overriden in templates. Deprecated: Use NotificationsBus.Cluster instead | *string | false +| notificationsBus +| NotificationsBus configuration (username, vhost, and cluster) for notifications. This is the default configuration for all services. Individual services can override by setting their own Template.NotificationsBus. Avoid colocating with MessagingBus used for RPC. +| *rabbitmqv1.RabbitMqConfig +| false + | memcached | Memcached - Parameters related to the Memcached service | <> @@ -1422,6 +1746,16 @@ OpenStackControlPlaneSpec defines the desired state of OpenStackControlPlane | Watcher - Parameters related to the Watcher service | <> | false + +| applicationCredential +| ApplicationCredential - Global configuration for ApplicationCredentials. Both this global section AND the per-service applicationCredential section must be enabled for a service to use ApplicationCredentials. If omitted, defaults to enabled=false with standard expiration/grace periods. +| <> +| false + +| cyborg +| Cyborg - Parameters related to the Cyborg service +| <> +| false |=== <> @@ -1583,6 +1917,11 @@ PlacementSection defines the desired state of Placement service | APIOverride, provides the ability to override the generated manifest of several child resources. | <> | false + +| applicationCredential +| ApplicationCredential allows service-specific overrides of the global AC configuration. +| *<> +| true |=== <> @@ -1629,6 +1968,47 @@ RedisSection defines the desired state of the Redis service <> +[#serviceappcredsection] +==== ServiceAppCredSection + +ServiceAppCredSection allows service-specific overrides of the global AC configuration + +|=== +| Field | Description | Scheme | Required + +| enabled +| +| bool +| true + +| expirationDays +| +| *int +| false + +| gracePeriodDays +| +| *int +| false + +| roles +| Roles to assign to the ApplicationCredential +| []string +| false + +| unrestricted +| Whether the AC should be unrestricted +| *bool +| false + +| accessRules +| AccessRules lets the service override the global AccessRules if specified +| []<> +| false +|=== + +<> + [#swiftsection] ==== SwiftSection @@ -1651,6 +2031,11 @@ SwiftSection defines the desired state of Swift service | ProxyOverride, provides the ability to override the generated manifest of several child resources. | <> | false + +| applicationCredential +| ApplicationCredential allows service-specific overrides of the global AC configuration. +| *<> +| true |=== <> @@ -1799,6 +2184,11 @@ TelemetrySection defines the desired state of OpenStack Telemetry services | <> | false +| cloudKittyApiOverride +| CloudKittyAPIOverride, provides the ability to override the generated manifest of several child resources. +| <> +| false + | prometheusOverride | PrometheusOverride, provides the ability to override the generated manifest of several child resources. | <> @@ -1808,6 +2198,21 @@ TelemetrySection defines the desired state of OpenStack Telemetry services | AlertmanagerOverride, provides the ability to override the generated manifest of several child resources. | <> | false + +| applicationCredentialCeilometer +| ApplicationCredentialCeilometer allows service-specific overrides of the global AC configuration for Ceilometer. +| *<> +| true + +| applicationCredentialAodh +| ApplicationCredentialAodh allows service-specific overrides of the global AC configuration for Aodh. +| *<> +| true + +| applicationCredentialCloudKitty +| ApplicationCredentialCloudKitty allows service-specific overrides of the global AC configuration for CloudKitty. +| *<> +| true |=== <> @@ -1834,6 +2239,11 @@ WatcherSection defines the desired state of Watcher service | APIOverride, provides the ability to override the generated manifest of several child resources. | <> | false + +| applicationCredential +| ApplicationCredential allows service-specific overrides of the global AC configuration. +| *<> +| true |=== <> @@ -1993,6 +2403,31 @@ ContainerTemplate - struct that contains container image URLs for each service i | *string | false +| cloudkittyAPIImage +| +| *string +| false + +| cloudkittyProcImage +| +| *string +| false + +| cyborgAPIImage +| +| *string +| false + +| cyborgAgentImage +| +| *string +| false + +| cyborgConductorImage +| +| *string +| false + | designateAPIImage | | *string @@ -2033,8 +2468,18 @@ ContainerTemplate - struct that contains container image URLs for each service i | *string | false +| edpmIscsidImage +| Deprecated: EdpmIscsidImage is no longer used. iscsid now runs on the host instead of in a container. +| *string +| false + | edpmLogrotateCrondImage -| +| Deprecated: EdpmLogrotateCrondImage is no longer used. logrotate-crond has been removed. +| *string +| false + +| edpmMultipathdImage +| Deprecated: EdpmMultipathdImage is no longer used. multipathd now runs on the host instead of in a container. | *string | false @@ -2068,6 +2513,11 @@ ContainerTemplate - struct that contains container image URLs for each service i | *string | false +| edpmKeplerImage +| Deprecated: EdpmKeplerImage is no longer used. Kepler has been removed from the telemetry stack. +| *string +| false + | edpmPodmanExporterImage | | *string @@ -2243,11 +2693,21 @@ ContainerTemplate - struct that contains container image URLs for each service i | *string | false +| openstackMcpImage +| +| *string +| false + | osContainerImage | | *string | false +| osBootcContainerImage +| +| *string +| false + | ovnControllerImage | | *string @@ -2370,7 +2830,7 @@ CustomContainerImages - struct for custom container images [#openstackversion] ==== OpenStackVersion -OpenStackVersion is the Schema for the openstackversionupdates API +OpenStackVersion defines the Schema for the openstackversionupdates API |=== | Field | Description | Scheme | Required @@ -2503,30 +2963,49 @@ ServiceDefaults - struct that contains defaults for OSP services that can change | | *string | false -|=== -<> +| rabbitmqVersion +| +| *string +| false -[#apioverridespec] -==== APIOverrideSpec +| mariadbVersion +| +| *string +| false -APIOverrideSpec to override the generated manifest of several child resources. +| glanceLocationAPI +| +| *string +| false -|=== -| Field | Description | Scheme | Required +| manilaSharev1 +| +| *string +| false -| service -| Override configuration for the Service created to serve traffic to the cluster. The key must be the endpoint type (public, internal) -| map[service.Endpoint]service.RoutedOverrideSpec +| neutronWsgi +| +| *string +| false + +| ironicInspectInterface +| +| *string +| false + +| ovnHardenedOVSSecurityContext +| +| *string | false |=== <> -[#barbicanapi] -==== BarbicanAPI +[#barbican] +==== Barbican -BarbicanAPI is the Schema for the barbicanapis API +Barbican is the Schema for the barbicans API |=== | Field | Description | Scheme | Required @@ -2538,21 +3017,21 @@ BarbicanAPI is the Schema for the barbicanapis API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#barbicanapilist] -==== BarbicanAPIList +[#barbicanlist] +==== BarbicanList -BarbicanAPIList contains a list of BarbicanAPI +BarbicanList contains a list of Barbican |=== | Field | Description | Scheme | Required @@ -2564,69 +3043,311 @@ BarbicanAPIList contains a list of BarbicanAPI | items | -| []<> +| []<> | true |=== <> -[#barbicanapispec] -==== BarbicanAPISpec +[#barbicanspec] +==== BarbicanSpec -BarbicanAPISpec defines the desired state of BarbicanAPI +BarbicanSpec defines the desired state of Barbican |=== | Field | Description | Scheme | Required -| databaseHostname -| DatabaseHostname - Barbican Database Hostname -| string +| barbicanAPI +| BarbicanAPI - Spec definition for the API services of this Barbican deployment +| <> | true -| transportURLSecret -| TransportURLSecret - Secret containing RabbitMQ transportURL -| string -| false +| barbicanWorker +| BarbicanWorker - Spec definition for the Worker service of this Barbican deployment +| <> +| true + +| barbicanKeystoneListener +| BarbicanKeystoneListener - Spec definition for the KeystoneListener service of this Barbican deployment +| <> +| true |=== <> -[#barbicanapistatus] -==== BarbicanAPIStatus +[#barbicanspecbase] +==== BarbicanSpecBase -BarbicanAPIStatus defines the observed state of BarbicanAPI +BarbicanSpecBase - |=== | Field | Description | Scheme | Required -| readyCount -| ReadyCount of barbican API instances -| int32 +| preserveJobs +| PreserveJobs - do not delete jobs after they finished e.g. to check logs +| bool +| true + +| nodeSelector +| NodeSelector to target subset of worker nodes running this component. Setting here overrides any global NodeSelector settings within the Barbican CR. +| *map[string]string | false -| hash -| Map of hashes to track e.g. job status -| map[string]string +| customServiceConfig +| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ +| string | false -| apiEndpoint -| API endpoint +| defaultConfigOverwrite +| ConfigOverwrite - interface to overwrite default config files like e.g. logging.conf or policy.json. But can also be used to add additional files. Those get added to the service config dir in /etc/++++++.++++++ | map[string]string | false -| conditions -| Conditions -| condition.Conditions -| false +| apiTimeout +| Barbican API timeout +| int +| true -| networkAttachments -| NetworkAttachments status of the deployment pods -| map[string][]string +| auth +| Auth - Parameters related to authentication for all Barbican services +| <> | false -| databaseHostname -| Barbican Database Hostname -| string +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name +| *topologyv1.TopoRef +| false +|=== + +<> + +[#barbicanspeccore] +==== BarbicanSpecCore + +BarbicanSpecCore defines the desired state of Barbican, for use with the OpenStackControlplane CR (no containerImages) + +|=== +| Field | Description | Scheme | Required + +| barbicanAPI +| BarbicanAPI - Spec definition for the API services of this Barbican deployment +| <> +| true + +| barbicanWorker +| BarbicanWorker - Spec definition for the Worker service of this Barbican deployment +| <> +| true + +| barbicanKeystoneListener +| BarbicanKeystoneListener - Spec definition for the KeystoneListener service of this Barbican deployment +| <> +| true +|=== + +<> + +[#barbicanstatus] +==== BarbicanStatus + +BarbicanStatus defines the observed state of Barbican + +|=== +| Field | Description | Scheme | Required + +| hash +| Map of hashes to track e.g. job status +| map[string]string +| false + +| serviceID +| ServiceID +| string +| false + +| conditions +| Conditions +| condition.Conditions +| false + +| barbicanAPIReadyCount +| ReadyCount of Barbican API instances +| int32 +| false + +| barbicanWorkerReadyCount +| ReadyCount of Barbican Worker instances +| int32 +| false + +| barbicanKeystoneListenerReadyCount +| ReadyCount of Barbican KeystoneListener instances +| int32 +| false + +| transportURLSecret +| TransportURLSecret - Secret containing RabbitMQ transportURL +| string +| false + +| notificationsURLSecret +| NotificationsURLSecret - Secret containing RabbitMQ notificationsURL +| *string +| false + +| databaseHostname +| Barbican Database Hostname +| string +| false + +| applicationCredentialSecret +| ApplicationCredentialSecret - the AC secret barbican is currently consuming and protecting with the openstack.org/barbican-ac-consumer finalizer. Tracked so the controller can remove its finalizer from the old secret when the openstack-operator rotates the reference. +| string +| false + +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) +| int64 +| false +|=== + +<> + +[#apioverridespec] +==== APIOverrideSpec + +APIOverrideSpec to override the generated manifest of several child resources. + +|=== +| Field | Description | Scheme | Required + +| service +| Override configuration for the Service created to serve traffic to the cluster. The key must be the endpoint type (public, internal) +| map[service.Endpoint]service.RoutedOverrideSpec +| false +|=== + +<> + +[#barbicanapi] +==== BarbicanAPI + +BarbicanAPI is the Schema for the barbicanapis API + +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ObjectMeta +| false + +| spec +| +| <> +| false + +| status +| +| <> +| false +|=== + +<> + +[#barbicanapilist] +==== BarbicanAPIList + +BarbicanAPIList contains a list of BarbicanAPI + +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ListMeta +| false + +| items +| +| []<> +| true +|=== + +<> + +[#barbicanapispec] +==== BarbicanAPISpec + +BarbicanAPISpec defines the desired state of BarbicanAPI + +|=== +| Field | Description | Scheme | Required + +| databaseHostname +| DatabaseHostname - Barbican Database Hostname +| string +| true + +| transportURLSecret +| TransportURLSecret - Secret containing RabbitMQ transportURL +| string +| false + +| notificationsURLSecret +| NotificationsURLSecret - Secret containing notifications transport URL +| string +| false +|=== + +<> + +[#barbicanapistatus] +==== BarbicanAPIStatus + +BarbicanAPIStatus defines the observed state of BarbicanAPI + +|=== +| Field | Description | Scheme | Required + +| readyCount +| ReadyCount of barbican API instances +| int32 +| false + +| hash +| Map of hashes to track e.g. job status +| map[string]string +| false + +| apiEndpoint +| API endpoint +| map[string]string +| false + +| conditions +| Conditions +| condition.Conditions +| false + +| networkAttachments +| NetworkAttachments status of the deployment pods +| map[string][]string +| false + +| databaseHostname +| Barbican Database Hostname +| string +| false + +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is different than the spec generation, then the controller has not started processing the latest changes, and the status and its conditions are likely stale. +| int64 +| false + +| appliedInputSecretHash +| AppliedInputSecretHash - hash of input secret names last applied +| string | false | lastAppliedTopology @@ -2749,6 +3470,11 @@ BarbicanKeystoneListenerSpec defines the desired state of BarbicanKeystoneListen | string | false +| notificationsURLSecret +| NotificationsURLSecret - Secret containing notifications transport URL +| string +| false + | tls | TLS - Parameters related to the TLS | tls.Ca @@ -2790,6 +3516,16 @@ BarbicanKeystoneListenerStatus defines the observed state of BarbicanKeystoneLis | string | false +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is different than the spec generation, then the controller has not started processing the latest changes, and the status and its conditions are likely stale. +| int64 +| false + +| appliedInputSecretHash +| AppliedInputSecretHash - hash of input secret names last applied +| string +| false + | lastAppliedTopology | LastAppliedTopology - the last applied Topology | *topologyv1.TopoRef @@ -2814,10 +3550,10 @@ BarbicanKeystoneListenerTemplate defines common Spec elements for the KeystoneLi <> -[#barbican] -==== Barbican +[#barbicanworker] +==== BarbicanWorker -Barbican is the Schema for the barbicans API +BarbicanWorker is the Schema for the barbicanworkers API |=== | Field | Description | Scheme | Required @@ -2829,215 +3565,19 @@ Barbican is the Schema for the barbicans API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#barbicanlist] -==== BarbicanList - -BarbicanList contains a list of Barbican - -|=== -| Field | Description | Scheme | Required - -| metadata -| -| metav1.ListMeta -| false - -| items -| -| []<> -| true -|=== - -<> - -[#barbicanspec] -==== BarbicanSpec - -BarbicanSpec defines the desired state of Barbican - -|=== -| Field | Description | Scheme | Required - -| barbicanAPI -| BarbicanAPI - Spec definition for the API services of this Barbican deployment -| <> -| true - -| barbicanWorker -| BarbicanWorker - Spec definition for the Worker service of this Barbican deployment -| <> -| true - -| barbicanKeystoneListener -| BarbicanKeystoneListener - Spec definition for the KeystoneListener service of this Barbican deployment -| <> -| true -|=== - -<> - -[#barbicanspecbase] -==== BarbicanSpecBase - -BarbicanSpecBase - - -|=== -| Field | Description | Scheme | Required - -| preserveJobs -| PreserveJobs - do not delete jobs after they finished e.g. to check logs -| bool -| true - -| nodeSelector -| NodeSelector to target subset of worker nodes running this component. Setting here overrides any global NodeSelector settings within the Barbican CR. -| *map[string]string -| false - -| customServiceConfig -| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ -| string -| false - -| defaultConfigOverwrite -| ConfigOverwrite - interface to overwrite default config files like e.g. logging.conf or policy.json. But can also be used to add additional files. Those get added to the service config dir in /etc/++++++.++++++ -| map[string]string -| false - -| apiTimeout -| Barbican API timeout -| int -| true - -| topologyRef -| TopologyRef to apply the Topology defined by the associated CR referenced by name -| *topologyv1.TopoRef -| false -|=== - -<> - -[#barbicanspeccore] -==== BarbicanSpecCore - -BarbicanSpecCore defines the desired state of Barbican, for use with the OpenStackControlplane CR (no containerImages) - -|=== -| Field | Description | Scheme | Required - -| barbicanAPI -| BarbicanAPI - Spec definition for the API services of this Barbican deployment -| <> -| true - -| barbicanWorker -| BarbicanWorker - Spec definition for the Worker service of this Barbican deployment -| <> -| true - -| barbicanKeystoneListener -| BarbicanKeystoneListener - Spec definition for the KeystoneListener service of this Barbican deployment -| <> -| true -|=== - -<> - -[#barbicanstatus] -==== BarbicanStatus - -BarbicanStatus defines the observed state of Barbican - -|=== -| Field | Description | Scheme | Required - -| hash -| Map of hashes to track e.g. job status -| map[string]string -| false - -| serviceID -| ServiceID -| string -| false - -| conditions -| Conditions -| condition.Conditions -| false - -| barbicanAPIReadyCount -| ReadyCount of Barbican API instances -| int32 -| false - -| barbicanWorkerReadyCount -| ReadyCount of Barbican Worker instances -| int32 -| false - -| barbicanKeystoneListenerReadyCount -| ReadyCount of Barbican KeystoneListener instances -| int32 -| false - -| transportURLSecret -| TransportURLSecret - Secret containing RabbitMQ transportURL -| string -| false - -| databaseHostname -| Barbican Database Hostname -| string -| false - -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) -| int64 -| false -|=== - -<> - -[#barbicanworker] -==== BarbicanWorker - -BarbicanWorker is the Schema for the barbicanworkers API - -|=== -| Field | Description | Scheme | Required - -| metadata -| -| metav1.ObjectMeta -| false - -| spec -| -| <> -| false - -| status -| -| <> -| false -|=== - -<> - -[#barbicanworkerlist] -==== BarbicanWorkerList +[#barbicanworkerlist] +==== BarbicanWorkerList BarbicanWorkerList contains a list of BarbicanWorker @@ -3075,6 +3615,11 @@ BarbicanWorkerSpec defines the desired state of BarbicanWorker | string | false +| notificationsURLSecret +| NotificationsURLSecret - Secret containing notifications transport URL +| string +| false + | tls | TLS - Parameters related to the TLS | tls.Ca @@ -3116,6 +3661,16 @@ BarbicanWorkerStatus defines the observed state of BarbicanWorker | string | false +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is different than the spec generation, then the controller has not started processing the latest changes, and the status and its conditions are likely stale. +| int64 +| false + +| appliedInputSecretHash +| AppliedInputSecretHash - hash of input secret names last applied +| string +| false + | lastAppliedTopology | LastAppliedTopology - the last applied Topology | *topologyv1.TopoRef @@ -3140,6 +3695,22 @@ BarbicanWorkerTemplate defines common Spec elements for the Worker process <> +[#authspec] +==== AuthSpec + +AuthSpec defines authentication parameters + +|=== +| Field | Description | Scheme | Required + +| applicationCredentialSecret +| ApplicationCredentialSecret - Secret containing Application Credential ID and Secret +| string +| false +|=== + +<> + [#barbicancomponenttemplate] ==== BarbicanComponentTemplate @@ -3159,7 +3730,7 @@ BarbicanComponentTemplate - Variables used by every sub-component of Barbican (e | true | customServiceConfig -| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to /etc/++++++/++++++.conf.d directory as a custom config file.++++++++++++ +| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to to /etc/++++++/++++++.conf.d directory as a custom config file.++++++++++++ | string | false @@ -3191,26 +3762,42 @@ BarbicanComponentTemplate - Variables used by every sub-component of Barbican (e <> -[#barbicanpkcs11template] -==== BarbicanPKCS11Template +[#barbicanextravolmounts] +==== BarbicanExtraVolMounts -BarbicanPKCS11Template - Includes common HSM properties +BarbicanExtraVolMounts exposes additional parameters processed by the barbican-operator and defines the common VolMounts structure provided by the main storage module |=== | Field | Description | Scheme | Required -| loginSecret -| OpenShift secret that stores the password to login to the PKCS11 session +| name +| | string -| true +| false -| clientDataSecret -| The OpenShift secret that stores the HSM client data. These will be mounted to /var/lib/config-data/hsm +| region +| | string +| false + +| extraVol +| +| []storage.VolMounts | true +|=== -| clientDataPath -| Location to which kolla will copy the data in ClientDataSecret. +<> + +[#barbicanpkcs11template] +==== BarbicanPKCS11Template + +BarbicanPKCS11Template - Includes common HSM properties + +|=== +| Field | Description | Scheme | Required + +| loginSecret +| OpenShift secret that stores the password to login to the PKCS11 session | string | true |=== @@ -3241,9 +3828,19 @@ BarbicanTemplate defines common Spec elements for all Barbican components includ | true | rabbitMqClusterName -| RabbitMQ instance name Needed to request a transportURL that is created and used in Barbican +| RabbitMQ instance name Needed to request a transportURL that is created and used in Barbican Deprecated: Use MessagingBus.Cluster instead | string -| true +| false + +| messagingBus +| MessagingBus configuration (username, vhost, and cluster) +| rabbitmqv1.RabbitMqConfig +| false + +| notificationsBus +| NotificationsBus configuration (username, vhost, and cluster) for notifications +| *rabbitmqv1.RabbitMqConfig +| false | simpleCryptoBackendSecret | Secret containing the Key Encryption Key (KEK) used for the Simple Crypto backend @@ -3270,7 +3867,12 @@ BarbicanTemplate defines common Spec elements for all Barbican components includ | *<> | false -| enabledSecretStores +| kmip +| +| *<> +| false + +| enabledSecretStores | | []SecretStore | false @@ -3279,6 +3881,32 @@ BarbicanTemplate defines common Spec elements for all Barbican components includ | | SecretStore | true + +| extraMounts +| ExtraMounts containing conf files and credentials +| []<> +| false +|=== + +<> + +[#clientdataspec] +==== ClientDataSpec + +ClientDataSpec - a Secret of client files that a secret store backend needs on the pod filesystem, and the path the backend's client library expects to find them at. Shared by the secret stores that talk to an external backend. + +|=== +| Field | Description | Scheme | Required + +| clientDataSecret +| The OpenShift secret that stores the backend client data. These will be mounted directly at ClientDataPath. Required when the owning secret store is enabled; this is enforced by the Barbican webhook rather than by the schema, because the schema cannot make it conditional on EnabledSecretStores. +| string +| false + +| clientDataPath +| Location at which ClientDataSecret is mounted, i.e. where the backend client library expects to find it. Defaulted per secret store by the Barbican webhook (DefaultPKCS11ClientDataPath, DefaultKMIPClientDataPath). +| string +| false |=== <> @@ -3314,52 +3942,62 @@ PasswordSelector to identify the DB and AdminUser password from the Secret <> -[#apioverridespec-2] -==== APIOverrideSpec +[#cinder] +==== Cinder -APIOverrideSpec to override the generated manifest of several child resources. +Cinder is the Schema for the cinders API |=== | Field | Description | Scheme | Required -| service -| Override configuration for the Service created to serve traffic to the cluster. The key must be the endpoint type (public, internal) -| map[service.Endpoint]service.RoutedOverrideSpec +| metadata +| +| metav1.ObjectMeta +| false + +| spec +| +| <> +| false + +| status +| +| <> | false |=== <> -[#cinderapi] -==== CinderAPI +[#cinderextravolmounts] +==== CinderExtraVolMounts -CinderAPI is the Schema for the cinderapis API +CinderExtraVolMounts exposes additional parameters processed by the cinder-operator and defines the common VolMounts structure provided by the main storage module |=== | Field | Description | Scheme | Required -| metadata +| name | -| metav1.ObjectMeta +| string | false -| spec +| region | -| <> +| string | false -| status +| extraVol | -| <> -| false +| []storage.VolMounts +| true |=== <> -[#cinderapilist] -==== CinderAPIList +[#cinderlist] +==== CinderList -CinderAPIList contains a list of CinderAPI +CinderList contains a list of Cinder |=== | Field | Description | Scheme | Required @@ -3371,176 +4009,332 @@ CinderAPIList contains a list of CinderAPI | items | -| []<> +| []<> | true |=== <> -[#cinderapispec] -==== CinderAPISpec +[#cinderspec] +==== CinderSpec -CinderAPISpec defines the desired state of CinderAPI +CinderSpec defines the desired state of Cinder |=== | Field | Description | Scheme | Required -| databaseHostname -| DatabaseHostname - Cinder Database Hostname -| string +| cinderAPI +| CinderAPI - Spec definition for the API service of this Cinder deployment +| <> | true -| transportURLSecret -| Secret containing RabbitMq transport URL -| string +| cinderScheduler +| CinderScheduler - Spec definition for the Scheduler service of this Cinder deployment +| <> | true -| notificationsURLSecret -| Secret containing Notifications transport URL -| string -| false +| cinderBackup +| CinderBackup - Spec definition for the Backup service of this Cinder deployment +| <> +| true -| extraMounts -| ExtraMounts containing conf files and credentials -| []<> +| cinderBackups +| CinderBackups - Spec definition for the Backup service of this Cinder deployment +| *map[string]<> | false -| serviceAccount -| ServiceAccount - service account name used internally to provide Cinder services the default SA name -| string -| true - -| memcachedInstance -| Memcached instance name. -| *string -| true +| cinderVolumes +| CinderVolumes - Map of chosen names to spec definitions for the Volume(s) service(s) of this Cinder deployment +| map[string]<> +| false |=== <> -[#cinderapistatus] -==== CinderAPIStatus - -CinderAPIStatus defines the observed state of CinderAPI +[#cinderspecbase] +==== CinderSpecBase |=== | Field | Description | Scheme | Required -| hash -| Map of hashes to track e.g. job status -| map[string]string +| databaseInstance +| MariaDB instance name Right now required by the maridb-operator to get the credentials from the instance to create the DB Might not be required in future +| string +| true + +| rabbitMqClusterName +| RabbitMQ instance name Needed to request a transportURL that is created and used in Cinder Deprecated: Use MessagingBus.Cluster instead +| string | false -| apiEndpoints -| API endpoints -| map[string]map[string]string +| messagingBus +| MessagingBus configuration (username, vhost, and cluster) +| rabbitmqv1.RabbitMqConfig | false -| conditions -| Conditions -| condition.Conditions +| notificationsBus +| NotificationsBus configuration (username, vhost, and cluster) for notifications +| *rabbitmqv1.RabbitMqConfig | false -| readyCount -| ReadyCount of Cinder API instances -| int32 +| memcachedInstance +| Memcached instance name. +| string | true -| serviceIDs -| ServiceIDs -| map[string]string -| false +| preserveJobs +| PreserveJobs - do not delete jobs after they finished e.g. to check logs +| bool +| true -| networkAttachments -| NetworkAttachments status of the deployment pods -| map[string][]string +| customServiceConfig +| CustomServiceConfig - customize the service config for all Cinder services using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to to /etc/++++++/++++++.conf.d directory as a custom config file.++++++++++++ +| string | false -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is different than the spec generation, then the controller has not started processing the latest changes, and the status and its conditions are likely stale. -| int64 +| extraMounts +| ExtraMounts containing conf files and credentials +| []<> | false -| lastAppliedTopology -| LastAppliedTopology - the last applied Topology -| *topologyv1.TopoRef +| nodeSelector +| NodeSelector to target subset of worker nodes running this service. Setting NodeSelector here acts as a default value and can be overridden by service specific NodeSelector Settings. +| *map[string]string | false -|=== -<> +| dbPurge +| DBPurge parameters - +| <> +| false -[#cinderapitemplate] -==== CinderAPITemplate +| apiTimeout +| APITimeout for HAProxy, Apache, and rpc_response_timeout +| int +| true -CinderAPITemplate defines the input parameters for the Cinder API service +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name +| *topologyv1.TopoRef +| false -|=== -| Field | Description | Scheme | Required +| notificationsBusInstance +| RabbitMQ instance name used to request a transportURL that is used for notification purposes Deprecated: Use NotificationsBus.Cluster instead +| *string +| false -| containerImage -| ContainerImage - Cinder Container Image URL (will be set to environmental default if empty) -| string -| true +| auth +| Auth - Parameters related to authentication +| <> +| false |=== <> -[#cinderapitemplatecore] -==== CinderAPITemplateCore +[#cinderspeccore] +==== CinderSpecCore -CinderAPITemplate defines the input parameters for the Cinder API service +CinderSpecCore the same as CinderSpec without ContainerImage references |=== | Field | Description | Scheme | Required -| replicas -| Replicas - Cinder API Replicas -| *int32 +| cinderAPI +| CinderAPI - Spec definition for the API service of this Cinder deployment +| <> | true -| override -| Override, provides the ability to override the generated manifest of several child resources. -| <> +| cinderScheduler +| CinderScheduler - Spec definition for the Scheduler service of this Cinder deployment +| <> +| true + +| cinderBackup +| CinderBackup is DEPRECATED and will be removed in a future release. Use the separate CinderBackups resource instead. +| <> +| true + +| cinderBackups +| CinderBackups - Spec definition for the Backup service of this Cinder deployment +| *map[string]<> | false -| tls -| TLS - Parameters related to the TLS -| tls.API +| cinderVolumes +| CinderVolumes - Map of chosen names to spec definitions for the Volume(s) service(s) of this Cinder deployment +| map[string]<> | false |=== <> -[#cinderbackup] -==== CinderBackup +[#cinderstatus] +==== CinderStatus -CinderBackup is the Schema for the cinderbackups API +CinderStatus defines the observed state of Cinder |=== | Field | Description | Scheme | Required -| metadata -| -| metav1.ObjectMeta +| hash +| Map of hashes to track e.g. job status +| map[string]string | false -| spec -| -| <> +| conditions +| Conditions +| condition.Conditions | false -| status -| -| <> +| databaseHostname +| Cinder Database Hostname +| string | false -|=== -<> +| transportURLSecret +| TransportURLSecret - Secret containing RabbitMQ transportURL entries +| string +| false -[#cinderbackuplist] -==== CinderBackupList +| notificationsURLSecret +| NotificationsURLSecret - Secret containing RabbitMQ notificationsURL +| *string +| false -CinderBackupList contains a list of CinderBackup +| apiEndpoints +| API endpoints +| map[string]map[string]string +| false + +| serviceIDs +| ServiceIDs +| map[string]string +| false + +| cinderAPIReadyCount +| ReadyCount of Cinder API instance +| int32 +| true + +| cinderBackupReadyCount +| ReadyCount of Cinder Backup instance +| int32 +| true + +| cinderBackupsReadyCounts +| ReadyCounts of Cinder Backup instances +| map[string]int32 +| false + +| cinderSchedulerReadyCount +| ReadyCount of Cinder Scheduler instance +| int32 +| true + +| cinderVolumesReadyCounts +| ReadyCounts of Cinder Volume instances +| map[string]int32 +| false + +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is different than the spec generation, then the controller has not started processing the latest changes, and the status and its conditions are likely stale. +| int64 +| false + +| applicationCredentialSecret +| ApplicationCredentialSecret - the AC secret cinder is currently consuming +| string +| false +|=== + +<> + +[#dbpurge] +==== DBPurge + +DBPurge struct is used to model the parameters exposed to the Cinder cronJob + +|=== +| Field | Description | Scheme | Required + +| age +| Age is the DBPurgeAge parameter and indicates the number of days of purging DB records +| int +| true + +| schedule +| Schedule defines the crontab format string to schedule the DBPurge cronJob +| string +| true +|=== + +<> + +[#apioverridespec-2] +==== APIOverrideSpec + +APIOverrideSpec to override the generated manifest of several child resources. + +|=== +| Field | Description | Scheme | Required + +| service +| Override configuration for the Service created to serve traffic to the cluster. The key must be the endpoint type (public, internal) +| map[service.Endpoint]service.RoutedOverrideSpec +| false + +| probes +| Override probes and other common fields in the StatefulSet +| probes.OverrideSpec +| false +|=== + +<> + +[#authspec-2] +==== AuthSpec + +AuthSpec defines authentication parameters + +|=== +| Field | Description | Scheme | Required + +| applicationCredentialSecret +| ApplicationCredentialSecret - Secret containing Application Credential ID and Secret +| string +| false +|=== + +<> + +[#cinderapi] +==== CinderAPI + +CinderAPI is the Schema for the cinderapis API + +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ObjectMeta +| false + +| spec +| +| <> +| false + +| status +| +| <> +| false +|=== + +<> + +[#cinderapilist] +==== CinderAPIList + +CinderAPIList contains a list of CinderAPI |=== | Field | Description | Scheme | Required @@ -3552,16 +4346,16 @@ CinderBackupList contains a list of CinderBackup | items | -| []<> +| []<> | true |=== <> -[#cinderbackupspec] -==== CinderBackupSpec +[#cinderapispec] +==== CinderAPISpec -CinderBackupSpec defines the desired state of CinderBackup +CinderAPISpec defines the desired state of CinderAPI |=== | Field | Description | Scheme | Required @@ -3591,23 +4385,23 @@ CinderBackupSpec defines the desired state of CinderBackup | string | true -| tls -| TLS - Parameters related to the TLS -| tls.Ca -| false - | memcachedInstance | Memcached instance name. | *string | true + +| apiTimeout +| APITimeout for HAProxy, Apache, and rpc_response_timeout +| int +| true |=== <> -[#cinderbackupstatus] -==== CinderBackupStatus +[#cinderapistatus] +==== CinderAPIStatus -CinderBackupStatus defines the observed state of CinderBackup +CinderAPIStatus defines the observed state of CinderAPI |=== | Field | Description | Scheme | Required @@ -3617,16 +4411,26 @@ CinderBackupStatus defines the observed state of CinderBackup | map[string]string | false +| apiEndpoints +| API endpoints +| map[string]map[string]string +| false + | conditions | Conditions | condition.Conditions | false | readyCount -| ReadyCount of Cinder Backup instances +| ReadyCount of Cinder API instances | int32 | true +| serviceIDs +| ServiceIDs +| map[string]string +| false + | networkAttachments | NetworkAttachments status of the deployment pods | map[string][]string @@ -3641,14 +4445,19 @@ CinderBackupStatus defines the observed state of CinderBackup | LastAppliedTopology - the last applied Topology | *topologyv1.TopoRef | false + +| appliedInputSecretHash +| AppliedInputSecretHash is the hash of the input Secret consumed by the currently ready workload. +| string +| false |=== <> -[#cinderbackuptemplate] -==== CinderBackupTemplate +[#cinderapitemplate] +==== CinderAPITemplate -CinderBackupTemplate defines the input parameters for the Cinder Backup service +CinderAPITemplate defines the input parameters for the Cinder API service |=== | Field | Description | Scheme | Required @@ -3661,26 +4470,52 @@ CinderBackupTemplate defines the input parameters for the Cinder Backup service <> -[#cinderbackuptemplatecore] -==== CinderBackupTemplateCore +[#cinderapitemplatecore] +==== CinderAPITemplateCore -CinderBackupTemplate defines the input parameters for the Cinder Backup service +CinderAPITemplate defines the input parameters for the Cinder API service |=== | Field | Description | Scheme | Required | replicas -| Replicas - Cinder Backup Replicas +| Replicas - Cinder API Replicas | *int32 | true + +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> +| false + +| tls +| TLS - Parameters related to the TLS +| tls.API +| false |=== <> -[#cinderscheduler] -==== CinderScheduler +[#backupoverridespec] +==== BackupOverrideSpec -CinderScheduler is the Schema for the cinderschedulers API +BackupOverrideSpec to override the generated manifest of several child resources. + +|=== +| Field | Description | Scheme | Required + +| probes +| Override probes and other common fields in the StatefulSet +| probes.OverrideSpec +| false +|=== + +<> + +[#cinderbackup] +==== CinderBackup + +CinderBackup is the Schema for the cinderbackups API |=== | Field | Description | Scheme | Required @@ -3692,21 +4527,21 @@ CinderScheduler is the Schema for the cinderschedulers API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#cinderschedulerlist] -==== CinderSchedulerList +[#cinderbackuplist] +==== CinderBackupList -CinderSchedulerList contains a list of CinderScheduler +CinderBackupList contains a list of CinderBackup |=== | Field | Description | Scheme | Required @@ -3718,16 +4553,16 @@ CinderSchedulerList contains a list of CinderScheduler | items | -| []<> +| []<> | true |=== <> -[#cinderschedulerspec] -==== CinderSchedulerSpec +[#cinderbackupspec] +==== CinderBackupSpec -CinderSchedulerSpec defines the desired state of CinderScheduler +CinderBackupSpec defines the desired state of CinderBackup |=== | Field | Description | Scheme | Required @@ -3770,10 +4605,10 @@ CinderSchedulerSpec defines the desired state of CinderScheduler <> -[#cinderschedulerstatus] -==== CinderSchedulerStatus +[#cinderbackupstatus] +==== CinderBackupStatus -CinderSchedulerStatus defines the observed state of CinderScheduler +CinderBackupStatus defines the observed state of CinderBackup |=== | Field | Description | Scheme | Required @@ -3789,7 +4624,7 @@ CinderSchedulerStatus defines the observed state of CinderScheduler | false | readyCount -| ReadyCount of Cinder Scheduler instances +| ReadyCount of Cinder Backup instances | int32 | true @@ -3807,14 +4642,19 @@ CinderSchedulerStatus defines the observed state of CinderScheduler | LastAppliedTopology - the last applied Topology | *topologyv1.TopoRef | false + +| appliedInputSecretHash +| AppliedInputSecretHash is the hash of the input Secret consumed by the currently ready workload. +| string +| false |=== <> -[#cinderschedulertemplate] -==== CinderSchedulerTemplate +[#cinderbackuptemplate] +==== CinderBackupTemplate -CinderSchedulerTemplate defines the input parameters for the Cinder Scheduler service +CinderBackupTemplate defines the input parameters for the Cinder Backup service |=== | Field | Description | Scheme | Required @@ -3827,78 +4667,57 @@ CinderSchedulerTemplate defines the input parameters for the Cinder Scheduler se <> -[#cinderschedulertemplatecore] -==== CinderSchedulerTemplateCore +[#cinderbackuptemplatecore] +==== CinderBackupTemplateCore -CinderSchedulerTemplate defines the input parameters for the Cinder Scheduler service +CinderBackupTemplate defines the input parameters for the Cinder Backup service |=== | Field | Description | Scheme | Required | replicas -| Replicas - Cinder Scheduler Replicas +| Replicas - Cinder Backup Replicas | *int32 | true -|=== - -<> -[#cinder] -==== Cinder - -Cinder is the Schema for the cinders API - -|=== -| Field | Description | Scheme | Required - -| metadata -| -| metav1.ObjectMeta -| false - -| spec -| -| <> -| false - -| status -| -| <> +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> | false |=== <> -[#cinderextravolmounts] -==== CinderExtraVolMounts +[#cinderscheduler] +==== CinderScheduler -CinderExtraVolMounts exposes additional parameters processed by the cinder-operator and defines the common VolMounts structure provided by the main storage module +CinderScheduler is the Schema for the cinderschedulers API |=== | Field | Description | Scheme | Required -| name +| metadata | -| string +| metav1.ObjectMeta | false -| region +| spec | -| string +| <> | false -| extraVol +| status | -| []storage.VolMounts -| true +| <> +| false |=== <> -[#cinderlist] -==== CinderList +[#cinderschedulerlist] +==== CinderSchedulerList -CinderList contains a list of Cinder +CinderSchedulerList contains a list of CinderScheduler |=== | Field | Description | Scheme | Required @@ -3910,71 +4729,32 @@ CinderList contains a list of Cinder | items | -| []<> +| []<> | true |=== <> -[#cinderspec] -==== CinderSpec - -CinderSpec defines the desired state of Cinder - -|=== -| Field | Description | Scheme | Required - -| cinderAPI -| CinderAPI - Spec definition for the API service of this Cinder deployment -| <> -| true - -| cinderScheduler -| CinderScheduler - Spec definition for the Scheduler service of this Cinder deployment -| <> -| true - -| cinderBackup -| CinderBackup - Spec definition for the Backup service of this Cinder deployment -| <> -| true - -| cinderVolumes -| CinderVolumes - Map of chosen names to spec definitions for the Volume(s) service(s) of this Cinder deployment -| map[string]<> -| false -|=== - -<> +[#cinderschedulerspec] +==== CinderSchedulerSpec -[#cinderspecbase] -==== CinderSpecBase +CinderSchedulerSpec defines the desired state of CinderScheduler |=== | Field | Description | Scheme | Required -| databaseInstance -| MariaDB instance name Right now required by the maridb-operator to get the credentials from the instance to create the DB Might not be required in future -| string -| true - -| rabbitMqClusterName -| RabbitMQ instance name Needed to request a transportURL that is created and used in Cinder +| databaseHostname +| DatabaseHostname - Cinder Database Hostname | string | true -| memcachedInstance -| Memcached instance name. +| transportURLSecret +| Secret containing RabbitMq transport URL | string | true -| preserveJobs -| PreserveJobs - do not delete jobs after they finished e.g. to check logs -| bool -| true - -| customServiceConfig -| CustomServiceConfig - customize the service config for all Cinder services using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to /etc/++++++/++++++.conf.d directory as a custom config file.++++++++++++ +| notificationsURLSecret +| Secret containing Notifications transport URL | string | false @@ -3983,69 +4763,28 @@ CinderSpec defines the desired state of Cinder | []<> | false -| nodeSelector -| NodeSelector to target subset of worker nodes running this service. Setting NodeSelector here acts as a default value and can be overridden by service specific NodeSelector Settings. -| *map[string]string -| false - -| dbPurge -| DBPurge parameters - -| <> -| false - -| apiTimeout -| APITimeout for HAProxy, Apache, and rpc_response_timeout -| int +| serviceAccount +| ServiceAccount - service account name used internally to provide Cinder services the default SA name +| string | true -| topologyRef -| TopologyRef to apply the Topology defined by the associated CR referenced by name -| *topologyv1.TopoRef +| tls +| TLS - Parameters related to the TLS +| tls.Ca | false -| notificationsBusInstance -| RabbitMQ instance name used to request a transportURL that is used for notification purposes +| memcachedInstance +| Memcached instance name. | *string -| false -|=== - -<> - -[#cinderspeccore] -==== CinderSpecCore - -CinderSpecCore the same as CinderSpec without ContainerImage references - -|=== -| Field | Description | Scheme | Required - -| cinderAPI -| CinderAPI - Spec definition for the API service of this Cinder deployment -| <> -| true - -| cinderScheduler -| CinderScheduler - Spec definition for the Scheduler service of this Cinder deployment -| <> | true - -| cinderBackup -| CinderBackup - Spec definition for the Backup service of this Cinder deployment -| <> -| true - -| cinderVolumes -| CinderVolumes - Map of chosen names to spec definitions for the Volume(s) service(s) of this Cinder deployment -| map[string]<> -| false |=== <> -[#cinderstatus] -==== CinderStatus +[#cinderschedulerstatus] +==== CinderSchedulerStatus -CinderStatus defines the observed state of Cinder +CinderSchedulerStatus defines the observed state of CinderScheduler |=== | Field | Description | Scheme | Required @@ -4060,94 +4799,101 @@ CinderStatus defines the observed state of Cinder | condition.Conditions | false -| databaseHostname -| Cinder Database Hostname -| string -| false +| readyCount +| ReadyCount of Cinder Scheduler instances +| int32 +| true -| transportURLSecret -| TransportURLSecret - Secret containing RabbitMQ transportURL entries -| string +| networkAttachments +| NetworkAttachments status of the deployment pods +| map[string][]string | false -| notificationsURLSecret -| NotificationsURLSecret - Secret containing RabbitMQ notificationsURL -| *string +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is different than the spec generation, then the controller has not started processing the latest changes, and the status and its conditions are likely stale. +| int64 | false -| apiEndpoints -| API endpoints -| map[string]map[string]string +| lastAppliedTopology +| LastAppliedTopology - the last applied Topology +| *topologyv1.TopoRef | false -| serviceIDs -| ServiceIDs -| map[string]string +| appliedInputSecretHash +| AppliedInputSecretHash is the hash of the input Secret consumed by the currently ready workload. +| string | false +|=== -| cinderAPIReadyCount -| ReadyCount of Cinder API instance -| int32 -| true +<> -| cinderBackupReadyCount -| ReadyCount of Cinder Backup instance -| int32 -| true +[#cinderschedulertemplate] +==== CinderSchedulerTemplate -| cinderSchedulerReadyCount -| ReadyCount of Cinder Scheduler instance -| int32 -| true +CinderSchedulerTemplate defines the input parameters for the Cinder Scheduler service -| cinderVolumesReadyCounts -| ReadyCounts of Cinder Volume instances -| map[string]int32 -| false +|=== +| Field | Description | Scheme | Required -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is different than the spec generation, then the controller has not started processing the latest changes, and the status and its conditions are likely stale. -| int64 -| false +| containerImage +| ContainerImage - Cinder Container Image URL (will be set to environmental default if empty) +| string +| true |=== <> -[#dbpurge] -==== DBPurge +[#cinderschedulertemplatecore] +==== CinderSchedulerTemplateCore -DBPurge struct is used to model the parameters exposed to the Cinder cronJob +CinderSchedulerTemplate defines the input parameters for the Cinder Scheduler service |=== | Field | Description | Scheme | Required -| age -| Age is the DBPurgeAge parameter and indicates the number of days of purging DB records -| int +| replicas +| Replicas - Cinder Scheduler Replicas +| *int32 | true -| schedule -| Schedule defines the crontab format string to schedule the DBPurge cronJob -| string -| true +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> +| false |=== <> -[#cindervolume] -==== CinderVolume +[#scheduleroverridespec] +==== SchedulerOverrideSpec -CinderVolume is the Schema for the cindervolumes API +SchedulerOverrideSpec to override the generated manifest of several child resources. |=== | Field | Description | Scheme | Required -| metadata -| -| metav1.ObjectMeta +| probes +| Override probes and other common fields in the StatefulSet +| probes.OverrideSpec | false +|=== -| spec +<> + +[#cindervolume] +==== CinderVolume + +CinderVolume is the Schema for the cindervolumes API + +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ObjectMeta +| false + +| spec | | <> | false @@ -4264,6 +5010,11 @@ CinderVolumeStatus defines the observed state of CinderVolume | LastAppliedTopology - the last applied Topology | *topologyv1.TopoRef | false + +| appliedInputSecretHash +| AppliedInputSecretHash is the hash of the input Secret consumed by the currently ready workload. +| string +| false |=== <> @@ -4296,6 +5047,27 @@ CinderVolumeTemplate defines the input parameters for the Cinder Volume service | Replicas - Cinder Volume Replicas | *int32 | true + +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> +| false +|=== + +<> + +[#volumeoverridespec] +==== VolumeOverrideSpec + +VolumeOverrideSpec to override the generated manifest of several child resources. + +|=== +| Field | Description | Scheme | Required + +| probes +| Override probes and other common fields in the StatefulSet +| probes.OverrideSpec +| false |=== <> @@ -4314,7 +5086,7 @@ CinderServiceTemplate defines the input parameters that can be defined for a giv | false | customServiceConfig -| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to /etc/++++++/++++++.conf.d directory as a custom config file.++++++++++++ +| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to the /etc/++++++/++++++.conf.d directory as a custom config file.++++++++++++ | string | false @@ -4418,7 +5190,7 @@ DesignateServiceTemplate defines the input parameters that can be defined for a | false | customServiceConfig -| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to /etc/++++++/++++++.conf.d directory as a custom config file.++++++++++++ +| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to to /etc/++++++/++++++.conf.d directory as a custom config file.++++++++++++ | string | false @@ -4512,52 +5284,62 @@ PasswordSelector to identify the DB and AdminUser password from the Secret <> -[#apioverridespec-2] -==== APIOverrideSpec +[#designate] +==== Designate -APIOverrideSpec to override the generated manifest of several child resources. +Designate is the Schema for the designates API |=== | Field | Description | Scheme | Required -| service -| Override configuration for the Service created to serve traffic to the cluster. The key must be the endpoint type (public, internal) -| map[service.Endpoint]service.RoutedOverrideSpec +| metadata +| +| metav1.ObjectMeta +| false + +| spec +| +| <> +| false + +| status +| +| <> | false |=== <> -[#designateapi] -==== DesignateAPI +[#designateextravolmounts] +==== DesignateExtraVolMounts -DesignateAPI is the Schema for the designateapis API +DesignateExtraVolMounts exposes additional parameters processed by the designate-operator and defines the common VolMounts structure provided by the main storage module |=== | Field | Description | Scheme | Required -| metadata +| name | -| metav1.ObjectMeta +| string | false -| spec +| region | -| <> +| string | false -| status +| extraVol | -| <> -| false +| []storage.VolMounts +| true |=== <> -[#designateapilist] -==== DesignateAPIList +[#designatelist] +==== DesignateList -DesignateAPIList contains a list of DesignateAPI +DesignateList contains a list of Designate |=== | Field | Description | Scheme | Required @@ -4569,252 +5351,322 @@ DesignateAPIList contains a list of DesignateAPI | items | -| []<> +| []<> | true |=== <> -[#designateapispecbase] -==== DesignateAPISpecBase +[#designatensrecord] +==== DesignateNSRecord -DesignateAPISpecBase - +DesignateNSRecord defines a DNS nameserver record |=== | Field | Description | Scheme | Required -| replicas -| Replicas - Designate API Replicas -| *int32 -| true - -| databaseHostname -| DatabaseHostname - Designate Database Hostname -| string -| false - -| transportURLSecret -| Secret containing RabbitMq transport URL -| string -| false - -| serviceAccount -| ServiceAccount - service account name used internally to provide Designate services the default SA name +| hostname +| Hostname of the nameserver | string | true -| override -| Override, provides the ability to override the generated manifest of several child resources. -| <> -| false - -| tls -| TLS - Parameters related to the TLS -| tls.API -| false - -| apiTimeout -| APITimeout for HAProxy and Apache defaults to DesignateSpecCore APITimeout (seconds) +| priority +| Priority of the nameserver | int | true |=== <> -[#designateapistatus] -==== DesignateAPIStatus +[#designatespec] +==== DesignateSpec -DesignateAPIStatus defines the observed state of DesignateAPI +DesignateAPISpec defines the desired state of DesignateAPI |=== | Field | Description | Scheme | Required -| hash -| Map of hashes to track e.g. job status -| map[string]string -| false +| designateAPI +| DesignateAPI - Spec definition for the API service of this Designate deployment +| <> +| true -| apiEndpoints -| API endpoints -| map[string]map[string]string -| false +| designateCentral +| DesignateCentral - Spec definition for the Central service of this Designate deployment +| <> +| true -| conditions -| Conditions -| condition.Conditions -| false +| designateWorker +| DesignateWorker - Spec definition for the Worker service of this Designate deployment +| <> +| true -| readyCount -| ReadyCount of designate API instances -| int32 -| false +| designateMdns +| DesignateMdns - Spec definition for the Mdns service of this Designate deployment +| <> +| true -| networkAttachments -| NetworkAttachments status of the deployment pods -| map[string][]string -| false +| designateProducer +| DesignateProducer - Spec definition for the Producer service of this Designate deployment +| <> +| true -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) -| int64 -| false +| designateBackendbind9 +| DesignateBackendbind9 - Spec definition for the Backendbind9 service of this Designate deployment +| <> +| true -| lastAppliedTopology -| LastAppliedTopology - the last applied Topology -| *topologyv1.TopoRef -| false +| designateUnbound +| DesignateUnbound - Spec definition for the Unbound Resolver service of this Designate deployment +| <> +| true |=== <> -[#bind9overridespec] -==== Bind9OverrideSpec +[#designatespecbase] +==== DesignateSpecBase -|=== -| Field | Description | Scheme | Required +DesignateSpecBase - -| services -| -| []service.OverrideSpec -| false |=== +| Field | Description | Scheme | Required -<> - -[#designatebackendbind9] -==== DesignateBackendbind9 +| serviceUser +| ServiceUser - optional username used for this service to register in designate +| string +| true -DesignateBackendbind9 is the Schema for the designatebackendbind9 +| databaseInstance +| MariaDB instance name Right now required by the maridb-operator to get the credentials from the instance to create the DB Might not be required in future +| string +| true -|=== -| Field | Description | Scheme | Required +| databaseAccount +| DatabaseAccount - name of MariaDBAccount which will be used to connect. +| string +| true -| metadata -| -| metav1.ObjectMeta +| rabbitMqClusterName +| RabbitMQ instance name Needed to request a transportURL that is created and used in Designate Deprecated: Use MessagingBus.Cluster instead +| string | false -| spec -| -| <> +| messagingBus +| MessagingBus configuration (cluster, username, and vhost) +| rabbitmqv1.RabbitMqConfig | false -| status -| -| <> +| notificationsBus +| NotificationsBus configuration (cluster, username, and vhost) for notifications +| *rabbitmqv1.RabbitMqConfig | false -|=== - -<> - -[#designatebackendbind9list] -==== DesignateBackendbind9List -DesignateBackendbind9List contains a list of DesignateBackendbind9 - -|=== -| Field | Description | Scheme | Required +| secret +| Secret containing OpenStack password information for designate AdminPassword +| string +| true -| metadata -| -| metav1.ListMeta -| false +| passwordSelectors +| PasswordSelectors - Selectors to identify the DB and AdminUser password from the Secret +| <> +| true -| items -| -| []<> +| backendType +| BackendType - Defines the backend service/configuration we are using, i.e. bind9, unhbound, PowerDNS, BYO, etc.. Helps maintain a single init container/init.sh to do container setup +| string | true -|=== -<> - -[#designatebackendbind9specbase] -==== DesignateBackendbind9SpecBase - -DesignateBackendbind9SpecBase - - -|=== -| Field | Description | Scheme | Required - -| replicas -| Replicas - Designate Backendbind9 Replicas -| *int32 +| backendWorkerServerProtocol +| BackendTypeProtocol - Defines the backend protocol to be used between the designate-worker & designate_mdns to/from the DNS server. Acceptable values are: "UDP", "TCP" Please Note: this MUST match what is in the /etc/designate.conf ['service:worker'] +| string | true -| databaseHostname -| DatabaseHostname - Designate Database Hostname +| backendMdnsServerProtocol +| BackendTypeProtocol - Defines the backend protocol to be used between the designate-worker & designate_mdns to/from the DNS server. Acceptable values are: "UDP", "TCP" Please Note: this MUST match what is in the /etc/designate.conf ['service:mdns'] | string +| true + +| nodeSelector +| NodeSelector to target subset of worker nodes running this service +| *map[string]string | false -| transportURLSecret -| Secret containing RabbitMq transport URL -| string +| preserveJobs +| PreserveJobs - do not delete jobs after they finished e.g. to check logs +| bool | false -| serviceAccount -| ServiceAccount - service account name used internally to provide Designate services the default SA name +| customServiceConfig +| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ | string -| true +| false -| customBindOptions -| CustomBindOptions - custom bind9 options -| []string +| defaultConfigOverwrite +| ConfigOverwrite - interface to overwrite default config files like e.g. logging.conf or policy.json. But can also be used to add additional files. Those get added to the service config dir in /etc/++++++.++++++ +| map[string]string | false -| controlNetworkName -| ControlNetworkName - specify which network attachment is to be used for control, notifys and zone transfers. +| resources +| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ +| corev1.ResourceRequirements +| false + +| designateNetworkAttachment +| DesignateNetworkAttachment is a NetworkAttachment resource name for the Designate Control Network | string | true -| storageClass -| StorageClass +| redisServiceName +| RedisServiceName is the name of the Redis instance to be used (must be in the same namespace as designate) | string -| false +| true -| storageRequest -| StorageRequest -| string +| apiTimeout +| Designate API timeout +| int | true -| netUtilsImage -| NetUtilsImage - NetUtils container image +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name +| *topologyv1.TopoRef +| false + +| nsRecords +| NSRecords contains the list of nameserver records for the Designate pool +| []<> +| false + +| externalBindsSecret +| ExternalBindsSecret is the name of the secret containing external BIND9 configurations | string -| true +| false -| override -| Allows services to be configured for accessing each designate bind pod. For best results, there should be an override for each replica. -| <> +| azAwareMode +| AZAwareMode - when set to "Enabled", activates AZ-aware multipool mode with BIND views, per-pool TSIG keys, and per-AZ Unbound instances. Requires a valid multipool ConfigMap with view fields defined for each pool. +| DesignateAZMode | false |=== <> -[#designatebackendbind9status] -==== DesignateBackendbind9Status +[#designatespeccore] +==== DesignateSpecCore -DesignateBackendbind9Status defines the observed state of DesignateBackendbind9 +DesignateAPISpecCore - this version has no containerImage for use with the OpenStackControlplane |=== | Field | Description | Scheme | Required -| readyCount -| ReadyCount of designate backendbind9 instances -| int32 -| false +| designateAPI +| DesignateAPI - Spec definition for the API service of this Designate deployment +| <> +| true + +| designateCentral +| DesignateCentral - Spec definition for the Central service of this Designate deployment +| <> +| true + +| designateWorker +| DesignateWorker - Spec definition for the Worker service of this Designate deployment +| <> +| true + +| designateMdns +| DesignateMdns - Spec definition for the Mdns service of this Designate deployment +| <> +| true + +| designateProducer +| DesignateProducer - Spec definition for the Producer service of this Designate deployment +| <> +| true + +| designateBackendbind9 +| DesignateBackendbind9 - Spec definition for the Backendbind9 service of this Designate deployment +| <> +| true + +| designateUnbound +| DesignateUnbound - Spec definition for the Unbound Resolver service of this Designate deployment +| <> +| true +|=== + +<> + +[#designatestatus] +==== DesignateStatus + +DesignateStatus defines the observed state of Designate + +|=== +| Field | Description | Scheme | Required | hash | Map of hashes to track e.g. job status | map[string]string | false +| apiEndpoint +| API endpoint +| map[string]string +| false + | conditions | Conditions | condition.Conditions | false -| networkAttachments -| NetworkAttachments status of the deployment pods -| map[string][]string +| databaseHostname +| DatabaseHostname - Designate Database Hostname +| string +| false + +| transportURLSecret +| TransportURLSecret - Secret containing RabbitMQ transportURL +| string +| false + +| notificationsTransportURLSecret +| NotificationsTransportURLSecret - Secret containing RabbitMQ notifications transportURL +| string +| false + +| designateAPIReadyCount +| ReadyCount of Designate API instance +| int32 +| false + +| designateCentralReadyCount +| ReadyCount of Designate Central instance +| int32 +| false + +| designateWorkerReadyCount +| ReadyCount of Designate Worker instance +| int32 +| false + +| designateMdnsReadyCount +| ReadyCount of Designate Mdns instance +| int32 +| false + +| designateProducerReadyCount +| ReadyCount of Designate Producer instance +| int32 +| false + +| designateBackendbind9ReadyCount +| ReadyCount of Designate Backendbind9 instance +| int32 +| false + +| designateUnboundReadyCount +| ReadyCount of Designate Unbound instance +| int32 | false | observedGeneration @@ -4822,18 +5674,50 @@ DesignateBackendbind9Status defines the observed state of DesignateBackendbind9 | int64 | false -| lastAppliedTopology -| LastAppliedTopology - the last applied Topology -| *topologyv1.TopoRef +| redisHostIPs +| Deprecated: RedisHostIPs is no longer used. Redis connection details are now obtained directly from the Redis status field. +| []string | false |=== <> -[#designatecentral] -==== DesignateCentral +[#apioverridespec-2] +==== APIOverrideSpec -DesignateCentral is the Schema for the designatecentral API +APIOverrideSpec to override the generated manifest of several child resources. + +|=== +| Field | Description | Scheme | Required + +| service +| Override configuration for the Service created to serve traffic to the cluster. The key must be the endpoint type (public, internal) +| map[service.Endpoint]service.RoutedOverrideSpec +| false +|=== + +<> + +[#authspec-2] +==== AuthSpec + +AuthSpec defines authentication parameters + +|=== +| Field | Description | Scheme | Required + +| applicationCredentialSecret +| ApplicationCredentialSecret - Secret containing Application Credential ID and Secret +| string +| false +|=== + +<> + +[#designateapi] +==== DesignateAPI + +DesignateAPI is the Schema for the designateapis API |=== | Field | Description | Scheme | Required @@ -4845,21 +5729,21 @@ DesignateCentral is the Schema for the designatecentral API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#designatecentrallist] -==== DesignateCentralList +[#designateapilist] +==== DesignateAPIList -DesignateCentralList contains a list of DesignateCentral +DesignateAPIList contains a list of DesignateAPI |=== | Field | Description | Scheme | Required @@ -4871,22 +5755,22 @@ DesignateCentralList contains a list of DesignateCentral | items | -| []<> +| []<> | true |=== <> -[#designatecentralspecbase] -==== DesignateCentralSpecBase +[#designateapispecbase] +==== DesignateAPISpecBase -DesignateCentralSpecBase - +DesignateAPISpecBase - |=== | Field | Description | Scheme | Required | replicas -| Replicas - Designate Central Replicas +| Replicas - Designate API Replicas | *int32 | true @@ -4905,47 +5789,72 @@ DesignateCentralSpecBase - | string | true +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> +| false + | tls | TLS - Parameters related to the TLS -| tls.Ca +| tls.API | false -| redisHostIPs -| List of Redis Host IP addresses -| []string +| auth +| Auth - Parameters related to authentication +| <> | false + +| apiTimeout +| APITimeout for HAProxy and Apache defaults to DesignateSpecCore APITimeout (seconds) +| int +| true |=== <> -[#designatecentralstatus] -==== DesignateCentralStatus +[#designateapistatus] +==== DesignateAPIStatus -DesignateCentralStatus defines the observed state of DesignateCentral +DesignateAPIStatus defines the observed state of DesignateAPI |=== | Field | Description | Scheme | Required -| readyCount -| ReadyCount of designate central instances -| int32 -| false - | hash | Map of hashes to track e.g. job status | map[string]string | false +| apiEndpoints +| API endpoints +| map[string]map[string]string +| false + | conditions | Conditions | condition.Conditions | false +| readyCount +| ReadyCount of designate API instances +| int32 +| false + | networkAttachments | NetworkAttachments status of the deployment pods | map[string][]string | false +| applicationCredentialSecret +| ApplicationCredentialSecret - the AC secret DesignateAPI is currently consuming and protecting with the openstack.org/designateapi-ac-consumer finalizer. Tracked so the controller can remove its finalizer from the old secret when the openstack-operator rotates the reference. +| string +| false + +| appliedInputSecretHash +| AppliedInputSecretHash - hash of the input secret names last confirmed as fully rolled out to the workload pods. +| string +| false + | observedGeneration | ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) | int64 @@ -4959,10 +5868,24 @@ DesignateCentralStatus defines the observed state of DesignateCentral <> -[#designatemdns] -==== DesignateMdns +[#bind9overridespec] +==== Bind9OverrideSpec -DesignateMdns is the Schema for the designatemdnses API +|=== +| Field | Description | Scheme | Required + +| services +| +| []service.OverrideSpec +| false +|=== + +<> + +[#designatebackendbind9] +==== DesignateBackendbind9 + +DesignateBackendbind9 is the Schema for the designatebackendbind9 |=== | Field | Description | Scheme | Required @@ -4974,21 +5897,21 @@ DesignateMdns is the Schema for the designatemdnses API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#designatemdnslist] -==== DesignateMdnsList +[#designatebackendbind9list] +==== DesignateBackendbind9List -DesignateMdnsList contains a list of DesignateMdns +DesignateBackendbind9List contains a list of DesignateBackendbind9 |=== | Field | Description | Scheme | Required @@ -5000,22 +5923,22 @@ DesignateMdnsList contains a list of DesignateMdns | items | -| []<> +| []<> | true |=== <> -[#designatemdnsspecbase] -==== DesignateMdnsSpecBase +[#designatebackendbind9specbase] +==== DesignateBackendbind9SpecBase -DesignateMdnsSpecBase - +DesignateBackendbind9SpecBase - |=== | Field | Description | Scheme | Required | replicas -| Replicas - Designate Mdns Replicas +| Replicas - Designate Backendbind9 Replicas | *int32 | true @@ -5034,9 +5957,9 @@ DesignateMdnsSpecBase - | string | true -| tls -| TLS - Parameters related to the TLS -| tls.Ca +| customBindOptions +| CustomBindOptions - custom bind9 options +| []string | false | controlNetworkName @@ -5044,34 +5967,39 @@ DesignateMdnsSpecBase - | string | true +| storageClass +| StorageClass +| string +| false + +| storageRequest +| StorageRequest +| string +| true + | netUtilsImage | NetUtilsImage - NetUtils container image | string | true | override -| Allows services to be configured for accessing each mdns pod. For best results, there should be an override for each replica. -| <> +| Allows services to be configured for accessing each designate bind pod. For best results, there should be an override for each replica. +| <> | false |=== <> -[#designatemdnsstatus] -==== DesignateMdnsStatus +[#designatebackendbind9status] +==== DesignateBackendbind9Status -DesignateMdnsStatus defines the observed state of DesignateMdns +DesignateBackendbind9Status defines the observed state of DesignateBackendbind9 |=== | Field | Description | Scheme | Required | readyCount -| ReadyCount of designate MDNS instances -| int32 -| false - -| desiredNumberScheduled -| DesiredNumberScheduled - total number of the nodes which should be running Daemon +| ReadyCount of designate backendbind9 instances | int32 | false @@ -5103,24 +6031,10 @@ DesignateMdnsStatus defines the observed state of DesignateMdns <> -[#mdnsoverridespec] -==== MdnsOverrideSpec - -|=== -| Field | Description | Scheme | Required - -| services -| -| []service.OverrideSpec -| false -|=== - -<> - -[#designateproducer] -==== DesignateProducer +[#designatecentral] +==== DesignateCentral -DesignateProducer is the Schema for the designateproducer API +DesignateCentral is the Schema for the designatecentral API |=== | Field | Description | Scheme | Required @@ -5132,21 +6046,21 @@ DesignateProducer is the Schema for the designateproducer API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#designateproducerlist] -==== DesignateProducerList +[#designatecentrallist] +==== DesignateCentralList -DesignateProducerList contains a list of DesignateProducer +DesignateCentralList contains a list of DesignateCentral |=== | Field | Description | Scheme | Required @@ -5158,22 +6072,22 @@ DesignateProducerList contains a list of DesignateProducer | items | -| []<> +| []<> | true |=== <> -[#designateproducerspecbase] -==== DesignateProducerSpecBase +[#designatecentralspecbase] +==== DesignateCentralSpecBase -DesignateProducerSpec defines the desired state of DesignateProducer +DesignateCentralSpecBase - |=== | Field | Description | Scheme | Required | replicas -| Replicas - Designate Producer Replicas +| Replicas - Designate Central Replicas | *int32 | true @@ -5198,23 +6112,23 @@ DesignateProducerSpec defines the desired state of DesignateProducer | false | redisHostIPs -| List of Redis Host IP addresses +| Deprecated: RedisHostIPs is no longer used. Redis connection details are now obtained directly from the Redis status field. | []string | false |=== <> -[#designateproducerstatus] -==== DesignateProducerStatus +[#designatecentralstatus] +==== DesignateCentralStatus -DesignateProducerStatus defines the observed state of DesignateProducer +DesignateCentralStatus defines the observed state of DesignateCentral |=== | Field | Description | Scheme | Required | readyCount -| ReadyCount of designate Producer instances +| ReadyCount of designate central instances | int32 | false @@ -5233,6 +6147,11 @@ DesignateProducerStatus defines the observed state of DesignateProducer | map[string][]string | false +| appliedInputSecretHash +| AppliedInputSecretHash - hash of the input secret names last confirmed as fully rolled out to the workload pods. +| string +| false + | observedGeneration | ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) | int64 @@ -5246,10 +6165,10 @@ DesignateProducerStatus defines the observed state of DesignateProducer <> -[#designate] -==== Designate +[#designatemdns] +==== DesignateMdns -Designate is the Schema for the designates API +DesignateMdns is the Schema for the designatemdnses API |=== | Field | Description | Scheme | Required @@ -5261,368 +6180,3384 @@ Designate is the Schema for the designates API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#designateextravolmounts] -==== DesignateExtraVolMounts +[#designatemdnslist] +==== DesignateMdnsList -DesignateExtraVolMounts exposes additional parameters processed by the designate-operator and defines the common VolMounts structure provided by the main storage module +DesignateMdnsList contains a list of DesignateMdns |=== | Field | Description | Scheme | Required -| name -| -| string -| false - -| region +| metadata | -| string +| metav1.ListMeta | false -| extraVol +| items | -| []storage.VolMounts +| []<> | true |=== <> -[#designatelist] -==== DesignateList +[#designatemdnsspecbase] +==== DesignateMdnsSpecBase -DesignateList contains a list of Designate +DesignateMdnsSpecBase - |=== | Field | Description | Scheme | Required -| metadata -| -| metav1.ListMeta -| false - -| items -| -| []<> +| replicas +| Replicas - Designate Mdns Replicas +| *int32 | true -|=== -<> +| databaseHostname +| DatabaseHostname - Designate Database Hostname +| string +| false -[#designatensrecord] -==== DesignateNSRecord +| transportURLSecret +| Secret containing RabbitMq transport URL +| string +| false -DesignateNSRecord defines a DNS nameserver record +| serviceAccount +| ServiceAccount - service account name used internally to provide Designate services the default SA name +| string +| true -|=== -| Field | Description | Scheme | Required +| tls +| TLS - Parameters related to the TLS +| tls.Ca +| false -| hostname -| Hostname of the nameserver +| controlNetworkName +| ControlNetworkName - specify which network attachment is to be used for control, notifys and zone transfers. | string | true -| priority -| Priority of the nameserver -| int +| netUtilsImage +| NetUtilsImage - NetUtils container image +| string | true + +| override +| Allows services to be configured for accessing each mdns pod. For best results, there should be an override for each replica. +| <> +| false |=== <> -[#designatespec] -==== DesignateSpec +[#designatemdnsstatus] +==== DesignateMdnsStatus -DesignateAPISpec defines the desired state of DesignateAPI +DesignateMdnsStatus defines the observed state of DesignateMdns |=== | Field | Description | Scheme | Required -| designateAPI -| DesignateAPI - Spec definition for the API service of this Designate deployment -| <> -| true +| readyCount +| ReadyCount of designate MDNS instances +| int32 +| false -| designateCentral -| DesignateCentral - Spec definition for the Central service of this Designate deployment -| <> +| desiredNumberScheduled +| DesiredNumberScheduled - total number of the nodes which should be running Daemon +| int32 +| false + +| hash +| Map of hashes to track e.g. job status +| map[string]string +| false + +| conditions +| Conditions +| condition.Conditions +| false + +| networkAttachments +| NetworkAttachments status of the deployment pods +| map[string][]string +| false + +| appliedInputSecretHash +| AppliedInputSecretHash - hash of the input secret names last confirmed as fully rolled out to the workload pods. +| string +| false + +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) +| int64 +| false + +| lastAppliedTopology +| LastAppliedTopology - the last applied Topology +| *topologyv1.TopoRef +| false +|=== + +<> + +[#mdnsoverridespec] +==== MdnsOverrideSpec + +|=== +| Field | Description | Scheme | Required + +| services +| +| []service.OverrideSpec +| false +|=== + +<> + +[#designateproducer] +==== DesignateProducer + +DesignateProducer is the Schema for the designateproducer API + +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ObjectMeta +| false + +| spec +| +| <> +| false + +| status +| +| <> +| false +|=== + +<> + +[#designateproducerlist] +==== DesignateProducerList + +DesignateProducerList contains a list of DesignateProducer + +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ListMeta +| false + +| items +| +| []<> +| true +|=== + +<> + +[#designateproducerspecbase] +==== DesignateProducerSpecBase + +DesignateProducerSpec defines the desired state of DesignateProducer + +|=== +| Field | Description | Scheme | Required + +| replicas +| Replicas - Designate Producer Replicas +| *int32 +| true + +| databaseHostname +| DatabaseHostname - Designate Database Hostname +| string +| false + +| transportURLSecret +| Secret containing RabbitMq transport URL +| string +| false + +| serviceAccount +| ServiceAccount - service account name used internally to provide Designate services the default SA name +| string +| true + +| tls +| TLS - Parameters related to the TLS +| tls.Ca +| false + +| redisHostIPs +| Deprecated: RedisHostIPs is no longer used. Redis connection details are now obtained directly from the Redis status field. +| []string +| false +|=== + +<> + +[#designateproducerstatus] +==== DesignateProducerStatus + +DesignateProducerStatus defines the observed state of DesignateProducer + +|=== +| Field | Description | Scheme | Required + +| readyCount +| ReadyCount of designate Producer instances +| int32 +| false + +| hash +| Map of hashes to track e.g. job status +| map[string]string +| false + +| conditions +| Conditions +| condition.Conditions +| false + +| networkAttachments +| NetworkAttachments status of the deployment pods +| map[string][]string +| false + +| appliedInputSecretHash +| AppliedInputSecretHash - hash of the input secret names last confirmed as fully rolled out to the workload pods. +| string +| false + +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) +| int64 +| false + +| lastAppliedTopology +| LastAppliedTopology - the last applied Topology +| *topologyv1.TopoRef +| false +|=== + +<> + +[#designateunbound] +==== DesignateUnbound + +DesignateUnbound is the Schema for the designateworker API + +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ObjectMeta +| false + +| spec +| +| <> +| false + +| status +| +| <> +| false +|=== + +<> + +[#designateunboundlist] +==== DesignateUnboundList + +DesignateUnboundList contains a list of DesignateUnbound + +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ListMeta +| false + +| items +| +| []<> +| true +|=== + +<> + +[#designateunboundspecbase] +==== DesignateUnboundSpecBase + +DesignateUnboundSpecBase - + +|=== +| Field | Description | Scheme | Required + +| serviceAccount +| ServiceAccount - service account name used internally to provide Designate services the default SA name +| string +| true + +| netUtilsImage +| NetUtilsImage - NetUtils container image +| string +| true + +| replicas +| Replicas - Designate Unbound Replicas +| *int32 +| true + +| override +| Allows services to be configured for accessing each Unbound pod. For best results, there should be an override for each replica. +| <> +| false + +| stubZones +| Allows configuring stub zone entries in the managed Unbound servers for the managed nameservers. +| []<> +| false +|=== + +<> + +[#designateunboundstatus] +==== DesignateUnboundStatus + +DesignateUnboundStatus defines the observed state of DesignateUnbound + +|=== +| Field | Description | Scheme | Required + +| readyCount +| ReadyCount of designate central instances +| int32 +| false + +| hash +| Map of hashes to track e.g. job status +| map[string]string +| false + +| conditions +| Conditions +| condition.Conditions +| false + +| networkAttachments +| NetworkAttachments status of the deployment pods +| map[string][]string +| false + +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) +| int64 +| false + +| lastAppliedTopology +| LastAppliedTopology - the last applied Topology +| *topologyv1.TopoRef +| false +|=== + +<> + +[#stubzone] +==== StubZone + +|=== +| Field | Description | Scheme | Required + +| name +| +| string +| true + +| options +| +| map[string]string +| false +|=== + +<> + +[#unboundoverridespec] +==== UnboundOverrideSpec + +|=== +| Field | Description | Scheme | Required + +| services +| +| []service.OverrideSpec +| false +|=== + +<> + +[#designateworker] +==== DesignateWorker + +DesignateWorker is the Schema for the designateworker API + +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ObjectMeta +| false + +| spec +| +| <> +| false + +| status +| +| <> +| false +|=== + +<> + +[#designateworkerlist] +==== DesignateWorkerList + +DesignateWorkerList contains a list of DesignateWorker + +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ListMeta +| false + +| items +| +| []<> +| true +|=== + +<> + +[#designateworkerspecbase] +==== DesignateWorkerSpecBase + +DesignateWorkerSpecBase - + +|=== +| Field | Description | Scheme | Required + +| replicas +| Replicas - Designate Worker Replicas +| *int32 +| true + +| databaseHostname +| DatabaseHostname - Designate Database Hostname +| string +| false + +| transportURLSecret +| Secret containing RabbitMq transport URL +| string +| false + +| serviceAccount +| ServiceAccount - service account name used internally to provide Designate services the default SA name +| string +| true + +| tls +| TLS - Parameters related to the TLS +| tls.Ca +| false +|=== + +<> + +[#designateworkerstatus] +==== DesignateWorkerStatus + +DesignateWorkerStatus defines the observed state of DesignateWorker + +|=== +| Field | Description | Scheme | Required + +| readyCount +| ReadyCount of designate central instances +| int32 +| false + +| hash +| Map of hashes to track e.g. job status +| map[string]string +| false + +| conditions +| Conditions +| condition.Conditions +| false + +| networkAttachments +| NetworkAttachments status of the deployment pods +| map[string][]string +| false + +| appliedInputSecretHash +| AppliedInputSecretHash - hash of the input secret names last confirmed as fully rolled out to the workload pods. +| string +| false + +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) +| int64 +| false + +| lastAppliedTopology +| LastAppliedTopology - the last applied Topology +| *topologyv1.TopoRef +| false +|=== + +<> + +[#apioverridespec-2] +==== APIOverrideSpec + +APIOverrideSpec to override the generated manifest of several child resources. + +|=== +| Field | Description | Scheme | Required + +| service +| Override configuration for the Service created to serve traffic to the cluster. The key must be the endpoint type (public, internal) +| map[service.Endpoint]service.RoutedOverrideSpec +| false + +| probes +| Override probes and other common fields in the StatefulSet +| probes.OverrideSpec +| false +|=== + +<> + +[#authspec-2] +==== AuthSpec + +AuthSpec defines authentication parameters + +|=== +| Field | Description | Scheme | Required + +| applicationCredentialSecret +| ApplicationCredentialSecret - Secret containing Application Credential ID and Secret +| string +| false +|=== + +<> + +[#glanceapitemplate] +==== GlanceAPITemplate + +GlanceAPITemplate defines the desired state of GlanceAPI + +|=== +| Field | Description | Scheme | Required + +| replicas +| Replicas of glance API to run +| *int32 +| true + +| nodeSelector +| NodeSelector to target subset of worker nodes running this service +| *map[string]string +| false + +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name +| *topologyv1.TopoRef +| false + +| customServiceConfig +| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ +| string +| false + +| customServiceConfigSecrets +| CustomServiceConfigSecrets - customize the service config using this parameter to specify Secrets that contain sensitive service config data. The content of each Secret gets added to the /etc/++++++/++++++.conf.d directory as a custom config file.++++++++++++ +| []string +| false + +| resources +| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ +| corev1.ResourceRequirements +| false + +| networkAttachments +| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network +| []string +| false + +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> +| false + +| storage +| Storage - +| <> +| false + +| type +| Type - represents the layout of the glanceAPI deployment. +| string +| false + +| tls +| TLS - Parameters related to the TLS +| tls.API +| false + +| auth +| Auth - Parameters related to authentication +| <> +| false + +| imageCache +| ImageCache - It represents the struct to expose the ImageCache related parameters (size of the PVC and cronJob schedule) +| <> +| false + +| apiTimeout +| APITimeout for HAProxy and Apache defaults to GlanceSpecCore APITimeout +| int +| false +|=== + +<> + +[#imagecache] +==== ImageCache + +ImageCache - struct where the exposed imageCache params are defined + +|=== +| Field | Description | Scheme | Required + +| size +| Size - Local storage request, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024) +| string +| true + +| cleanerScheduler +| Schedule defines the crontab format string to schedule the Cleaner cronJob +| string +| true + +| prunerScheduler +| Schedule defines the crontab format string to schedule the Pruner cronJob +| string +| true +|=== + +<> + +[#storage] +==== Storage + +Storage - + +|=== +| Field | Description | Scheme | Required + +| storageClass +| StorageClass - +| string +| false + +| storageRequest +| StorageRequest - +| string +| false + +| external +| External - +| bool +| false +|=== + +<> + +[#dbpurge-2] +==== DBPurge + +DBPurge struct is used to model the parameters exposed to the Glance API CronJob + +|=== +| Field | Description | Scheme | Required + +| age +| Age is the DBPurgeAge parameter and indicates the number of days of purging DB records +| int +| true + +| schedule +| Schedule defines the crontab format string to schedule the DBPurge cronJob +| string +| true +|=== + +<> + +[#glance] +==== Glance + +Glance is the Schema for the glances API + +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ObjectMeta +| false + +| spec +| +| <> +| false + +| status +| +| <> +| false +|=== + +<> + +[#glanceextravolmounts] +==== GlanceExtraVolMounts + +GlanceExtraVolMounts exposes additional parameters processed by the glance-operator and defines the common VolMounts structure provided by the main storage module + +|=== +| Field | Description | Scheme | Required + +| name +| +| string +| false + +| region +| +| string +| false + +| extraVol +| +| []storage.VolMounts +| true +|=== + +<> + +[#glancelist] +==== GlanceList + +GlanceList contains a list of Glance + +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ListMeta +| false + +| items +| +| []<> +| true +|=== + +<> + +[#glancespec] +==== GlanceSpec + +GlanceSpec defines the desired state of Glance + +|=== +| Field | Description | Scheme | Required + +| containerImage +| Glance Container Image URL (will be set to environmental default if empty) +| string +| true +|=== + +<> + +[#glancespeccore] +==== GlanceSpecCore + +GlanceSpecCore defines the desired state of Glance + +|=== +| Field | Description | Scheme | Required + +| serviceUser +| ServiceUser - optional username used for this service to register in glance +| string +| true + +| databaseInstance +| MariaDB instance name Right now required by the maridb-operator to get the credentials from the instance to create the DB Might not be required in future +| string +| true + +| databaseAccount +| DatabaseAccount - name of MariaDBAccount which will be used to connect. +| string +| true + +| memcachedInstance +| Memcached instance name. +| string +| true + +| secret +| Secret containing OpenStack password information for glance's keystone password; no longer used for database password +| string +| true + +| passwordSelectors +| PasswordSelectors - Selectors to identify the DB and ServiceUser password from the Secret +| <> +| true + +| nodeSelector +| NodeSelector to target subset of worker nodes running this service +| *map[string]string +| false + +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name +| *topologyv1.TopoRef +| false + +| preserveJobs +| PreserveJobs - do not delete jobs after they finished e.g. to check logs +| bool +| true + +| customServiceConfig +| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ +| string +| false + +| customServiceConfigSecrets +| CustomServiceConfigSecrets - customize the service config using this parameter to specify Secrets that contain sensitive service config data. The content of each Secret gets added to the /etc/++++++/++++++.conf.d directory as a custom config file.++++++++++++ +| []string +| false + +| storage +| Storage - +| <> +| false + +| glanceAPIs +| GlanceAPIs - Spec definition for the API service of this Glance deployment +| map[string]<> +| true + +| extraMounts +| ExtraMounts containing conf files and credentials +| []<> +| false + +| quotas +| Quotas is defined, per-tenant quotas are enforced according to the registered keystone limits +| <> +| false + +| imageCache +| ImageCache - +| <> +| true + +| keystoneEndpoint +| KeystoneEndpoint - indicates which glanceAPI should be registered in the keystone catalog, and it acts as a selector for the underlying glanceAPI(s) that can be specified by name +| string +| true + +| dbPurge +| DBPurge parameters - +| <> +| false + +| apiTimeout +| Default APITimeout for HAProxy and Apache, defaults to 60 seconds +| int +| true + +| notificationBusInstance +| RabbitMQ instance name Needed to request a transportURL that is created and used for notification purposes deprecated: Use NotificationsBus.Cluster instead +| *string +| false + +| notificationsBus +| NotificationsBus configuration (username, vhost, and cluster) for notifications +| *rabbitmqv1.RabbitMqConfig +| false +|=== + +<> + +[#glancestatus] +==== GlanceStatus + +GlanceStatus defines the observed state of Glance + +|=== +| Field | Description | Scheme | Required + +| hash +| Map of hashes to track e.g. job status +| map[string]string +| false + +| apiEndpoint +| API endpoint +| map[string]string +| false + +| serviceID +| ServiceID +| string +| false + +| conditions +| Conditions +| condition.Conditions +| false + +| databaseHostname +| Glance Database Hostname +| string +| false + +| glanceAPIReadyCounts +| GlanceAPIReadyCounts - +| map[string]int32 +| false + +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) +| int64 +| false + +| notificationBusSecret +| NotificationsBusSecret - Secret containing RabbitMQ transportURL used for notification purposes +| string +| false +|=== + +<> + +[#passwordselector-2] +==== PasswordSelector + +PasswordSelector to identify the DB and AdminUser password from the Secret + +|=== +| Field | Description | Scheme | Required + +| service +| Service - Selector to get the glance service password from the Secret +| string +| true +|=== + +<> + +[#quotalimits] +==== QuotaLimits + +QuotaLimits - The parameters exposed to the top level glance CR that represents the limits we set in keystone + +|=== +| Field | Description | Scheme | Required + +| imageSizeTotal +| +| int +| true + +| imageStageTotal +| +| int +| true + +| imageCountTotal +| +| int +| true + +| imageCountUpload +| +| int +| true +|=== + +<> + +[#glanceapi] +==== GlanceAPI + +GlanceAPI is the Schema for the glanceapis API + +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ObjectMeta +| false + +| spec +| +| <> +| false + +| status +| +| <> +| false +|=== + +<> + +[#glanceapilist] +==== GlanceAPIList + +GlanceAPIList contains a list of GlanceAPI + +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ListMeta +| false + +| items +| +| []<> +| true +|=== + +<> + +[#glanceapispec] +==== GlanceAPISpec + +GlanceAPISpec defines the desired state of GlanceAPI + +|=== +| Field | Description | Scheme | Required + +| containerImage +| ContainerImage - GlanceAPI Container Image URL +| string +| true + +| apiType +| +| string +| true + +| serviceUser +| ServiceUser - optional username used for this service to register in glance +| string +| true + +| serviceAccount +| ServiceAccount - service account name used internally to provide GlanceAPI the default SA name +| string +| true + +| databaseHostname +| DatabaseHostname - Glance Database Hostname +| string +| true + +| databaseAccount +| DatabaseAccount - name of MariaDBAccount which will be used to connect. +| string +| true + +| secret +| Secret containing OpenStack password information for glance AdminPassword +| string +| true + +| passwordSelectors +| PasswordSelectors - Selectors to identify the DB and ServiceUser password from the Secret +| <> +| true + +| extraMounts +| ExtraMounts containing conf files and credentials +| []<> +| false + +| quota +| QuotaEnforce if true, per-tenant quotas are enforced according to the registered keystone limits +| bool +| true + +| memcachedInstance +| Memcached instance name. +| string +| true + +| notificationBusSecret +| Secret containing RabbitMq transport URL +| string +| true +|=== + +<> + +[#glanceapistatus] +==== GlanceAPIStatus + +GlanceAPIStatus defines the observed state of GlanceAPI + +|=== +| Field | Description | Scheme | Required + +| readyCount +| ReadyCount of glance API instances +| int32 +| true + +| hash +| Map of hashes to track e.g. job status +| map[string]string +| false + +| apiEndpoint +| API endpoint +| map[string]string +| false + +| conditions +| Conditions +| condition.Conditions +| false + +| networkAttachments +| NetworkAttachments status of the deployment pods +| map[string][]string +| false + +| domain +| Domain is a parameter used by each glanceAPI replicas to setup a worker and set the worker_self_reference_url config option. It's requierd when distributed image import is enabled and it enables pod to pod communication via the associated hostnames +| string +| false + +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) +| int64 +| false + +| lastAppliedTopology +| LastAppliedTopology - the last applied Topology +| *topologyv1.TopoRef +| false + +| notificationBusSecret +| NotificationBusSecret - Secret containing RabbitMQ transportURL for notification purposes +| string +| false + +| applicationCredentialSecret +| ApplicationCredentialSecret - Secret that GlanceAPI is actively consuming (AC consumer finalizer present) +| string +| false + +| appliedInputSecretHash +| AppliedInputSecretHash - hash of the input secrets that the child has confirmed it is running with (set after IsReadyForInput succeeds) +| string +| false +|=== + +<> + +[#apioverridespec-2] +==== APIOverrideSpec + +APIOverrideSpec to override the generated manifest of several child resources. + +|=== +| Field | Description | Scheme | Required + +| service +| Override configuration for the Service created to serve traffic to the cluster. The key must be the endpoint type (public, internal) +| map[service.Endpoint]service.RoutedOverrideSpec +| false +|=== + +<> + +[#authspec-2] +==== AuthSpec + +AuthSpec defines authentication parameters + +|=== +| Field | Description | Scheme | Required + +| applicationCredentialSecret +| ApplicationCredentialSecret - Secret containing Application Credential ID and Secret +| string +| false +|=== + +<> + +[#dbpurge-2] +==== DBPurge + +DBPurge struct is used to model the parameters exposed to the Heat CronJob DBPurge struct is used to model the parameters exposed to the Heat API CronJob + +|=== +| Field | Description | Scheme | Required + +| age +| Age is the DBPurgeAge parameter and indicates the number of days of purging DB records +| int +| true + +| schedule +| Schedule defines the crontab format string to schedule the DBPurge cronJob +| string +| true +|=== + +<> + +[#heatextravolmounts] +==== HeatExtraVolMounts + +HeatExtraVolMounts exposes additional parameters processed by the heat-operator and defines the common VolMounts structure provided by the main storage module + +|=== +| Field | Description | Scheme | Required + +| name +| +| string +| false + +| region +| +| string +| false + +| extraVol +| +| []storage.VolMounts +| true +|=== + +<> + +[#heatservicetemplate] +==== HeatServiceTemplate + +HeatServiceTemplate - + +|=== +| Field | Description | Scheme | Required + +| replicas +| Replicas - +| *int32 +| true + +| defaultConfigOverwrite +| ConfigOverwrite - interface to overwrite default config files like e.g. policy.json. But can also be used to add additional files. Those get added to the service config dir in /etc/++++++.++++++ +| map[string]string +| false + +| nodeSelector +| NodeSelector to target subset of worker nodes for running the service +| *map[string]string +| false + +| customServiceConfig +| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to to /etc/heat/heat.conf.d directory as 02-custom-service.conf file. +| string +| false + +| customServiceConfigSecrets +| CustomServiceConfigSecrets - customize the service config using this parameter to specify Secrets that contain sensitive service config data. The content of each Secret gets added to the /etc/heat/heat.conf.d directory as a custom config file. +| []string +| false + +| resources +| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ +| corev1.ResourceRequirements +| false + +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name +| *topologyv1.TopoRef +| false +|=== + +<> + +[#heattemplate] +==== HeatTemplate + +HeatTemplate - + +|=== +| Field | Description | Scheme | Required + +| serviceUser +| ServiceUser - optional username used for this service to register in heat +| string +| true + +| databaseAccount +| DatabaseAccount - optional MariaDBAccount used for heat DB, defaults to heat. +| string +| true + +| secret +| Secret containing OpenStack password information for heat HeatDatabasePassword, HeatPassword and HeatAuthEncryptionKey +| string +| true + +| passwordSelectors +| PasswordSelectors - Selectors to identify the DB and ServiceUser password from the Secret +| <> +| true + +| extraMounts +| ExtraMounts containing files and plugins +| []<> +| false + +| auth +| Auth - Parameters related to authentication +| <> +| false +|=== + +<> + +[#passwordselector-2] +==== PasswordSelector + +PasswordSelector .. + +|=== +| Field | Description | Scheme | Required + +| service +| Service - Selector to get the heat service password from the Secret +| string +| true + +| authEncryptionKey +| AuthEncryptionKey - Selector to get the heat auth encryption key from the Secret +| string +| true + +| stackDomainAdminPassword +| StackDomainAdminPassword - Selector to get the heat stack domain admin password from the Secret +| string +| true +|=== + +<> + +[#heat] +==== Heat + +Heat is the Schema for the heats API + +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ObjectMeta +| false + +| spec +| +| <> +| false + +| status +| +| <> +| false +|=== + +<> + +[#heatlist] +==== HeatList + +HeatList contains a list of Heat + +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ListMeta +| false + +| items +| +| []<> +| true +|=== + +<> + +[#heatspec] +==== HeatSpec + +HeatSpec defines the desired state of Heat + +|=== +| Field | Description | Scheme | Required + +| heatAPI +| HeatAPI - Spec definition for the API service of this Heat deployment +| <> +| true + +| heatCfnAPI +| HeatCfnAPI - Spec definition for the CfnAPI service of this Heat deployment +| <> +| true + +| heatEngine +| HeatEngine - Spec definition for the Engine service of this Heat deployment +| <> +| true +|=== + +<> + +[#heatspecbase] +==== HeatSpecBase + +HeatSpec defines the desired state of Heat + +|=== +| Field | Description | Scheme | Required + +| databaseInstance +| MariaDB instance name. Right now required by the maridb-operator to get the credentials from the instance to create the DB. Might not be required in future. +| string +| true + +| memcachedInstance +| Memcached instance name. +| string +| true + +| rabbitMqClusterName +| RabbitMQ instance name Needed to request a transportURL that is created and used in Heat Deprecated: Use MessagingBus.Cluster instead +| string +| false + +| messagingBus +| MessagingBus - Messaging Bus configuration +| rabbitmqv1.RabbitMqConfig +| false + +| notificationsBus +| NotificationsBus - Notifications Bus configuration (optional, separate from MessagingBus) +| *rabbitmqv1.RabbitMqConfig +| false + +| customServiceConfig +| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to to /etc/heat/heat.conf.d directory as 01-custom.conf file. +| string +| false + +| customServiceConfigSecrets +| CustomServiceConfigSecrets - customize the service config using this parameter to specify Secrets that contain sensitive service config data. The content of each Secret gets added to the /etc/heat/heat.conf.d directory as a custom config file. +| []string +| false + +| preserveJobs +| PreserveJobs - do not delete jobs after they finished e.g. to check logs +| bool +| true + +| defaultConfigOverwrite +| ConfigOverwrite - interface to overwrite default config files like e.g. policy.json. But can also be used to add additional files. Those get added to the service config dir in /etc/++++++.++++++ +| map[string]string +| false + +| nodeSelector +| NodeSelector to target subset of worker nodes for running the Heat services +| *map[string]string +| false + +| apiTimeout +| APITimeout for Route and Apache +| int +| true + +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name +| *topologyv1.TopoRef +| false + +| dbPurge +| DBPurge defines parameters for the database purge CronJob +| <> +| false +|=== + +<> + +[#heatspeccore] +==== HeatSpecCore + +HeatSpecCore defines the desired state of Heat, for use with OpenStackControlplane (no containerImages) + +|=== +| Field | Description | Scheme | Required + +| heatAPI +| HeatAPI - Spec definition for the API service of this Heat deployment +| <> +| true + +| heatCfnAPI +| HeatCfnAPI - Spec definition for the CfnAPI service of this Heat deployment +| <> +| true + +| heatEngine +| HeatEngine - Spec definition for the Engine service of this Heat deployment +| <> +| true +|=== + +<> + +[#heatstatus] +==== HeatStatus + +HeatStatus defines the observed state of Heat + +|=== +| Field | Description | Scheme | Required + +| conditions +| Conditions +| condition.Conditions +| false + +| hash +| Map of hashes to track e.g. job status +| map[string]string +| false + +| databaseHostname +| Heat Database Hostname +| string +| false + +| transportURLSecret +| TransportURLSecret - Secret containing RabbitMQ transportURL +| string +| false + +| notificationsTransportURLSecret +| NotificationsTransportURLSecret - Secret containing Notifications RabbitMQ transportURL +| string +| false + +| heatApiReadyCount +| ReadyCount of Heat API instance +| int32 +| false + +| heatCfnApiReadyCount +| ReadyCount of Heat CfnAPI instance +| int32 +| false + +| heatEngineReadyCount +| ReadyCount of Heat Engine instance +| int32 +| false + +| applicationCredentialSecret +| ApplicationCredentialSecret - the AC secret Heat is currently consuming and protecting with the openstack.org/heat-ac-consumer finalizer. Tracked so the controller can remove its finalizer from the old secret when the openstack-operator rotates the reference. +| string +| false + +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) +| int64 +| false +|=== + +<> + +[#heatapi] +==== HeatAPI + +HeatAPI ... + +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ObjectMeta +| false + +| spec +| +| <> +| false + +| status +| +| <> +| false +|=== + +<> + +[#heatapilist] +==== HeatAPIList + +HeatAPIList contains a list of HeatAPI + +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ListMeta +| false + +| items +| +| []<> +| true +|=== + +<> + +[#heatapispec] +==== HeatAPISpec + +HeatAPISpec defines the desired state of HeatAPI + +|=== +| Field | Description | Scheme | Required + +| databaseHostname +| DatabaseHostname - Heat Database Hostname +| string +| true + +| transportURLSecret +| TransportURLSecret - Secret containing RabbitMQ transportURL +| string +| true + +| serviceAccount +| ServiceAccount - service account name used internally to provide Heat services the default SA name +| string +| true + +| memcachedInstance +| Memcached instance name. +| *string +| true +|=== + +<> + +[#heatapistatus] +==== HeatAPIStatus + +HeatAPIStatus defines the observed state of HeatAPI + +|=== +| Field | Description | Scheme | Required + +| hash +| Map of hashes to track e.g. job status +| map[string]string +| false + +| conditions +| Conditions +| condition.Conditions +| false + +| readyCount +| ReadyCount of HeatAPI instances +| int32 +| false + +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) +| int64 +| false + +| lastAppliedTopology +| LastAppliedTopology - the last applied Topology +| *topologyv1.TopoRef +| false + +| appliedInputSecretHash +| AppliedInputSecretHash - hash of the input secrets that the child has confirmed it is running with (set after IsReadyForInput succeeds) +| string +| false +|=== + +<> + +[#heatapitemplate] +==== HeatAPITemplate + +HeatAPITemplate defines the input parameters for the Heat API service + +|=== +| Field | Description | Scheme | Required + +| containerImage +| ContainerImage - Container Image URL +| string +| true +|=== + +<> + +[#heatapitemplatecore] +==== HeatAPITemplateCore + +HeatAPITemplateCore - + +|=== +| Field | Description | Scheme | Required + +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> +| false + +| tls +| TLS - Parameters related to the TLS +| tls.API +| false +|=== + +<> + +[#heatcfnapi] +==== HeatCfnAPI + +HeatCfnAPI ... + +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ObjectMeta +| false + +| spec +| +| <> +| false + +| status +| +| <> +| false +|=== + +<> + +[#heatcfnapilist] +==== HeatCfnAPIList + +HeatCfnAPIList contains a list of HeatCfnAPI + +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ListMeta +| false + +| items +| +| []<> +| true +|=== + +<> + +[#heatcfnapispec] +==== HeatCfnAPISpec + +HeatCfnAPISpec defines the desired state of HeatCfnAPI + +|=== +| Field | Description | Scheme | Required + +| databaseHostname +| DatabaseHostname - Heat Database Hostname +| string +| true + +| transportURLSecret +| TransportURLSecret - Secret containing RabbitMQ transportURL +| string +| true + +| serviceAccount +| ServiceAccount - service account name used internally to provide Heat services the default SA name +| string +| true + +| memcachedInstance +| Memcached instance name. +| *string +| true +|=== + +<> + +[#heatcfnapistatus] +==== HeatCfnAPIStatus + +HeatCfnAPIStatus defines the observed state of HeatCfnAPI + +|=== +| Field | Description | Scheme | Required + +| hash +| Map of hashes to track e.g. job status +| map[string]string +| false + +| conditions +| Conditions +| condition.Conditions +| false + +| readyCount +| ReadyCount of HeatCfnAPI instances +| int32 +| false + +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) +| int64 +| false + +| lastAppliedTopology +| LastAppliedTopology - the last applied Topology +| *topologyv1.TopoRef +| false + +| appliedInputSecretHash +| AppliedInputSecretHash - hash of the input secrets that the child has confirmed it is running with (set after IsReadyForInput succeeds) +| string +| false +|=== + +<> + +[#heatcfnapitemplate] +==== HeatCfnAPITemplate + +HeatCfnAPITemplate defines the input parameters for the Heat Cfn API service + +|=== +| Field | Description | Scheme | Required + +| containerImage +| ContainerImage - Container Image URL +| string +| true +|=== + +<> + +[#heatcfnapitemplatecore] +==== HeatCfnAPITemplateCore + +HeatCfnAPITemplateCore - + +|=== +| Field | Description | Scheme | Required + +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> +| false + +| tls +| TLS - Parameters related to the TLS +| tls.API +| false +|=== + +<> + +[#heatengine] +==== HeatEngine + +HeatEngine defined. + +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ObjectMeta +| false + +| spec +| +| <> +| false + +| status +| +| <> +| false +|=== + +<> + +[#heatenginelist] +==== HeatEngineList + +HeatEngineList contains a list of HeatEngine + +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ListMeta +| false + +| items +| +| []<> +| true +|=== + +<> + +[#heatenginespec] +==== HeatEngineSpec + +HeatEngineSpec defines the desired state of HeatEngine + +|=== +| Field | Description | Scheme | Required + +| databaseHostname +| DatabaseHostname - Heat Database Hostname +| string +| true + +| transportURLSecret +| TransportURLSecret - Secret containing RabbitMQ transportURL +| string +| true + +| serviceAccount +| ServiceAccount - service account name used internally to provide Heat services the default SA name +| string +| true + +| tls +| TLS - Parameters related to the TLS +| tls.Ca +| false + +| memcachedInstance +| Memcached instance name. +| *string +| true +|=== + +<> + +[#heatenginestatus] +==== HeatEngineStatus + +HeatEngineStatus defines the observed state of HeatEngine + +|=== +| Field | Description | Scheme | Required + +| hash +| Map of hashes to track e.g. job status +| map[string]string +| false + +| conditions +| Conditions +| condition.Conditions +| false + +| readyCount +| ReadyCount of HeatEngine instances +| int32 +| false + +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) +| int64 +| false + +| lastAppliedTopology +| LastAppliedTopology - the last applied Topology +| *topologyv1.TopoRef +| false + +| appliedInputSecretHash +| AppliedInputSecretHash - hash of the input secrets that the child has confirmed it is running with (set after IsReadyForInput succeeds) +| string +| false +|=== + +<> + +[#heatenginetemplate] +==== HeatEngineTemplate + +HeatEngineTemplate defines the input parameters for the Heat Engine service + +|=== +| Field | Description | Scheme | Required + +| containerImage +| ContainerImage - Container Image URL +| string +| true +|=== + +<> + +[#horizionoverridespec] +==== HorizionOverrideSpec + +HorizionOverrideSpec to override the generated manifest of several child resources. + +|=== +| Field | Description | Scheme | Required + +| service +| Override configuration for the Service created to serve traffic to the cluster. +| *service.RoutedOverrideSpec +| false +|=== + +<> + +[#horizon] +==== Horizon + +Horizon is the Schema for the horizons API + +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ObjectMeta +| false + +| spec +| +| <> +| false + +| status +| +| <> +| false +|=== + +<> + +[#horizonextravolmounts] +==== HorizonExtraVolMounts + +HorizonExtraVolMounts exposes additional parameters processed by the horizon-operator and defines the common VolMounts structure provided by the main storage module + +|=== +| Field | Description | Scheme | Required + +| name +| +| string +| false + +| region +| +| string +| false + +| extraVol +| +| []storage.VolMounts +| true +|=== + +<> + +[#horizonlist] +==== HorizonList + +HorizonList contains a list of Horizon + +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ListMeta +| false + +| items +| +| []<> +| true +|=== + +<> + +[#horizonspec] +==== HorizonSpec + +HorizonSpec defines the desired state of Horizon + +|=== +| Field | Description | Scheme | Required + +| containerImage +| horizon Container Image URL +| string +| true +|=== + +<> + +[#horizonspeccore] +==== HorizonSpecCore + +HorizonSpecCore - + +|=== +| Field | Description | Scheme | Required + +| nodeSelector +| NodeSelector to target subset of worker nodes running this service +| *map[string]string +| false + +| defaultConfigOverwrite +| ConfigOverwrite - interface to overwrite default config files like e.g. logging.conf or policy.json. But can also be used to add additional files. Those get added to the service config dir in /etc/++++++.++++++ +| map[string]string +| false + +| resources +| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ +| corev1.ResourceRequirements +| false + +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> +| false + +| tls +| TLS - Parameters related to the TLS +| tls.SimpleService +| false + +| replicas +| Replicas of horizon API to run +| *int32 +| true + +| secret +| Secret containing OpenStack password information for Horizon Secret Key +| string +| true + +| customServiceConfig +| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to to /etc/openstack-dashboard/local_settings.d directory as 9999_custom_settings.py file. +| string +| true + +| memcachedInstance +| Memcached instance name. +| string +| true + +| preserveJobs +| PreserveJobs - do not delete jobs after they finished e.g. to check logs +| bool +| true + +| extraMounts +| ExtraMounts containing conf files +| []<> +| false + +| networkAttachments +| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network +| []string +| false + +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name +| *topologyv1.TopoRef +| false +|=== + +<> + +[#horizonstatus] +==== HorizonStatus + +HorizonStatus defines the observed state of Horizon + +|=== +| Field | Description | Scheme | Required + +| hash +| Map of hashes to track e.g. job status +| map[string]string +| false + +| endpoint +| Endpoint url to access OpenStack Dashboard +| string +| false + +| conditions +| Conditions +| condition.Conditions +| false + +| readyCount +| ReadyCount of Horizon instances +| int32 +| false + +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) +| int64 +| false + +| networkAttachments +| NetworkAttachments status of the deployment pods +| map[string][]string +| false + +| lastAppliedTopology +| LastAppliedTopology - the last applied Topology +| *topologyv1.TopoRef +| false +|=== + +<> + +[#authspec-2] +==== AuthSpec + +AuthSpec defines authentication parameters + +|=== +| Field | Description | Scheme | Required + +| applicationCredentialSecret +| ApplicationCredentialSecret - Secret containing Application Credential ID and Secret +| string +| false +|=== + +<> + +[#ironicservicetemplate] +==== IronicServiceTemplate + +IronicServiceTemplate defines the common input parameters for Ironic services + +|=== +| Field | Description | Scheme | Required + +| replicas +| Replicas - +| *int32 +| true + +| nodeSelector +| NodeSelector to target subset of worker nodes running this service. Setting here overrides any global NodeSelector settings within the Ironic CR +| *map[string]string +| false + +| resources +| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ +| corev1.ResourceRequirements +| false + +| customServiceConfig +| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ +| string +| true + +| defaultConfigOverwrite +| ConfigOverwrite - interface to overwrite default config files like e.g. policy.json. But can also be used to add additional files. Those get added to the service config dir in /etc/++++++.++++++ +| map[string]string +| false + +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name +| *topologyv1.TopoRef +| false +|=== + +<> + +[#keystoneendpoints] +==== KeystoneEndpoints + +KeystoneEndpoints defines keystone endpoint parameters for service + +|=== +| Field | Description | Scheme | Required + +| internal +| Internal endpoint URL +| string +| true + +| public +| Public endpoint URL +| string +| true +|=== + +<> + +[#passwordselector-2] +==== PasswordSelector + +PasswordSelector to identify the AdminUser password from the Secret + +|=== +| Field | Description | Scheme | Required + +| service +| Service - Selector to get the ironic service password from the Secret +| string +| true +|=== + +<> + +[#dhcprange] +==== DHCPRange + +DHCPRange to define address range for DHCP requests + +|=== +| Field | Description | Scheme | Required + +| name +| Name - Name of the DHCPRange (used for tagging in dnsmasq) +| string +| false + +| cidr +| Cidr - IP address prefix (CIDR) representing an IP network. +| string +| true + +| start +| Start - Start of DHCP range +| string +| true + +| end +| End - End of DHCP range +| string +| true + +| gateway +| Gateway - IP address for the router +| string +| false + +| mtu +| MTU - Maximum Transmission Unit +| int +| false + +| podIndex +| PodIndex - Maps the DHCPRange to a specific statefulset pod index +| int +| false +|=== + +<> + +[#ironic] +==== Ironic + +Ironic is the Schema for the ironics API + +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ObjectMeta +| false + +| spec +| +| <> +| false + +| status +| +| <> +| false +|=== + +<> + +[#ironicimages] +==== IronicImages + +IronicImages to specify container images required by all ironic services + +|=== +| Field | Description | Scheme | Required + +| api +| API - Ironic API Container Image (will be set to environmental default if empty) +| string +| true + +| conductor +| Conductor - Ironic Conductor Container Image (will be set to environmental default if empty) +| string +| true + +| inspector +| Inspector - Ironic Inspector Container Image (will be set to environmental default if empty) +| string +| true + +| neutronAgent +| NeutronAgent - ML2 baremtal - Ironic Neutron Agent Image (will be set to environmental default if empty) +| string +| true + +| pxe +| Pxe- Ironic DHCP/TFTP/HTTP Container Image URL (will be set to environmental default if empty) +| string +| true + +| ironicPythonAgent +| IronicPythonAgent - Image containing the ironic-python-agent kernel and ramdisk +| string +| true + +| novncproxy +| NoVNCProxy - Ironic NoVNCProxy Container Image (will be set to environmental default if empty) +| string +| false + +| graphicalConsole +| GraphicalConsole - Ironic Graphical Console Container Image (will be set to environmental default if empty) +| string +| false +|=== + +<> + +[#ironiclist] +==== IronicList + +IronicList contains a list of Ironic + +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ListMeta +| false + +| items +| +| []<> +| true +|=== + +<> + +[#ironicspec] +==== IronicSpec + +IronicSpec defines the desired state of Ironic + +|=== +| Field | Description | Scheme | Required + +| images +| Images - Container images for all ironic services +| <> +| true +|=== + +<> + +[#ironicspeccore] +==== IronicSpecCore + +IronicSpec defines the desired state of Ironic + +|=== +| Field | Description | Scheme | Required + +| standalone +| Whether to deploy a standalone Ironic. +| bool +| true + +| serviceUser +| ServiceUser - optional username used for this service to register in ironic +| string +| true + +| databaseInstance +| MariaDB instance name. Right now required by the maridb-operator to get the credentials from the instance to create the DB. Might not be required in future. +| string +| true + +| databaseAccount +| DatabaseAccount - optional MariaDBAccount used for ironic DB, defaults to ironic. +| string +| true + +| secret +| Secret containing OpenStack password information for ironic IronicPassword +| string +| true + +| passwordSelectors +| PasswordSelectors - Selectors to identify the DB and ServiceUser password from the Secret +| <> +| true + +| preserveJobs +| PreserveJobs - do not delete jobs after they finished e.g. to check logs +| bool +| true + +| customServiceConfig +| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ +| string +| true + +| defaultConfigOverwrite +| ConfigOverwrite - interface to overwrite default config files like e.g. policy.json. But can also be used to add additional files. Those get added to the service config dir in /etc/++++++.++++++ +| map[string]string +| false + +| ironicAPI +| IronicAPI - Spec definition for the API service of this Ironic deployment +| <> +| true + +| ironicConductors +| IronicConductors - Spec definitions for the conductor service of this Ironic deployment +| []<> +| false + +| ironicInspector +| IronicInspector - Spec definition for the inspector service of this Ironic deployment +| <> +| true + +| ironicNeutronAgent +| IronicNeutronAgent - Spec definition for the ML2 baremetal ironic-neutron-agent service of this Ironic deployment +| <> +| true + +| rabbitMqClusterName +| RabbitMQ instance name Needed to request a transportURL that is created and used in Ironic Deprecated: Use MessagingBus.Cluster instead +| string +| false + +| messagingBus +| MessagingBus configuration (username, vhost, and cluster) for RPC messaging +| rabbitmqv1.RabbitMqConfig +| false + +| notificationsBus +| NotificationsBus configuration (username, vhost, and cluster) for notifications +| *rabbitmqv1.RabbitMqConfig +| false + +| rpcTransport +| RPC transport type - Which RPC transport implementation to use between conductor and API services. 'oslo' to use oslo.messaging transport or 'json-rpc' to use JSON RPC transport. NOTE \-> ironic and ironic-inspector require oslo.messaging transport when not in standalone mode. +| string +| true + +| auth +| Auth - Parameters related to authentication (shared by IronicAPI, IronicConductor, and IronicNeutronAgent) +| <> +| false + +| nodeSelector +| NodeSelector to target subset of worker nodes running this service. Setting NodeSelector here acts as a default value and can be overridden by service specific NodeSelector Settings. +| *map[string]string +| false + +| storageClass +| Storage class to host data. This is passed to IronicConductors unless storageClass is explicitly set for the conductor. +| string +| true + +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name +| *topologyv1.TopoRef +| false + +| apiTimeout +| APITimeout for HAProxy, Apache +| int +| true + +| graphicalConsoles +| Whether to enable graphical consoles. NOTE: Setting this to Enabled is not supported. +| string +| true +|=== + +<> + +[#ironicstatus] +==== IronicStatus + +IronicStatus defines the observed state of Ironic + +|=== +| Field | Description | Scheme | Required + +| hash +| Map of hashes to track e.g. job status +| map[string]string +| false + +| conditions +| Conditions +| condition.Conditions +| false + +| databaseHostname +| Ironic Database Hostname +| string +| false + +| apiEndpoints +| API endpoint +| map[string]map[string]string +| false + +| ironicAPIReadyCount +| ReadyCount of Ironic API instance +| int32 +| false + +| ironicConductorReadyCount +| ReadyCount of Ironic Conductor instance +| map[string]int32 +| false + +| ironicInspectorReadyCount +| ReadyCount of Ironic Inspector instance +| int32 +| false + +| ironicNeutronAgentReadyCount +| ReadyCount of Ironic Neutron Agent instance +| int32 +| false + +| transportURLSecret +| TransportURLSecret - Secret containing RabbitMQ transportURL +| string +| false + +| notificationsURLSecret +| NotificationsURLSecret - Secret containing RabbitMQ notifications URL +| *string +| false + +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) +| int64 +| false + +| applicationCredentialSecret +| ApplicationCredentialSecret - the AC secret ironic is currently consuming and protecting with the openstack.org/ironic-ac-consumer finalizer. Tracked so the controller can remove its finalizer from the old secret when the openstack-operator rotates the reference. +| string +| false + +| inspectorApplicationCredentialSecret +| InspectorApplicationCredentialSecret - the AC secret ironic-inspector is currently consuming and protecting with the openstack.org/ironic-inspector-ac-consumer finalizer. +| string +| false +|=== + +<> + +[#apioverridespec-2] +==== APIOverrideSpec + +APIOverrideSpec to override the generated manifest of several child resources. + +|=== +| Field | Description | Scheme | Required + +| service +| Override configuration for the Service created to serve traffic to the cluster. The key must be the endpoint type (public, internal) +| map[service.Endpoint]service.RoutedOverrideSpec +| false +|=== + +<> + +[#ironicapi] +==== IronicAPI + +IronicAPI is the Schema for the ironicapis API + +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ObjectMeta +| false + +| spec +| +| <> +| false + +| status +| +| <> +| false +|=== + +<> + +[#ironicapilist] +==== IronicAPIList + +IronicAPIList contains a list of IronicAPI + +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ListMeta +| false + +| items +| +| []<> | true +|=== -| designateWorker -| DesignateWorker - Spec definition for the Worker service of this Designate deployment -| <> +<> + +[#ironicapispec] +==== IronicAPISpec + +IronicAPISpec defines the desired state of IronicAPI + +|=== +| Field | Description | Scheme | Required + +| containerImage +| ContainerImage - Ironic API Container Image +| string | true -| designateMdns -| DesignateMdns - Spec definition for the Mdns service of this Designate deployment -| <> +| standalone +| Whether to deploy a standalone Ironic. +| bool | true -| designateProducer -| DesignateProducer - Spec definition for the Producer service of this Designate deployment -| <> +| serviceUser +| ServiceUser - optional username used for this service to register in ironic +| string | true -| designateBackendbind9 -| DesignateBackendbind9 - Spec definition for the Backendbind9 service of this Designate deployment -| <> +| secret +| Secret containing OpenStack password information for AdminPassword +| string +| false + +| passwordSelectors +| PasswordSelectors - Selectors to identify the DB and ServiceUser password from the Secret +| <> +| true + +| databaseHostname +| DatabaseHostname - Ironic Database Hostname +| string +| true + +| databaseAccount +| DatabaseAccount - optional MariaDBAccount used for ironic DB, defaults to ironic. +| string +| true + +| transportURLSecret +| Secret containing RabbitMq transport URL +| string +| false + +| notificationsURLSecret +| Secret containing RabbitMq notifications URL +| string +| false + +| rpcTransport +| RPC transport type - Which RPC transport implementation to use between conductor and API services. 'oslo' to use oslo.messaging transport or 'json-rpc' to use JSON RPC transport. NOTE \-> ironic requires oslo.messaging transport when not in standalone mode. +| string +| true + +| keystoneEndpoints +| KeystoneEndpoints - Internally used Keystone API endpoints +| <> +| true + +| region +| Region - OpenStack region name +| string +| false + +| apiTimeout +| APITimeout for HAProxy, Apache +| int | true -| designateUnbound -| DesignateUnbound - Spec definition for the Unbound Resolver service of this Designate deployment -| <> +| auth +| Auth - Parameters related to authentication (inherited from parent Ironic CR) +| <> +| false +|=== + +<> + +[#ironicapistatus] +==== IronicAPIStatus + +IronicAPIStatus defines the observed state of IronicAPI + +|=== +| Field | Description | Scheme | Required + +| hash +| Map of hashes to track e.g. job status +| map[string]string +| false + +| apiEndpoints +| API endpoint +| map[string]map[string]string +| false + +| conditions +| Conditions +| condition.Conditions +| false + +| readyCount +| ReadyCount of ironic API instances +| int32 +| false + +| networkAttachments +| NetworkAttachments status of the deployment pods +| map[string][]string +| false + +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) +| int64 +| false + +| appliedInputSecretHash +| AppliedInputSecretHash is the hash of the input Secret consumed by the currently ready workload. +| string +| false + +| lastAppliedTopology +| LastAppliedTopology - the last applied Topology +| *topologyv1.TopoRef +| false +|=== + +<> + +[#ironicapitemplate] +==== IronicAPITemplate + +IronicAPITemplate defines the input parameters for Ironic API service + +|=== +| Field | Description | Scheme | Required + +| networkAttachments +| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network +| []string +| false + +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> +| false + +| tls +| TLS - Parameters related to the TLS +| tls.API +| false +|=== + +<> + +[#ironicconductor] +==== IronicConductor + +IronicConductor is the Schema for the ironicconductors Conductor + +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ObjectMeta +| false + +| spec +| +| <> +| false + +| status +| +| <> +| false +|=== + +<> + +[#ironicconductorlist] +==== IronicConductorList + +IronicConductorList contains a list of IronicConductor + +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ListMeta +| false + +| items +| +| []<> | true |=== <> -[#designatespecbase] -==== DesignateSpecBase +[#ironicconductorspec] +==== IronicConductorSpec -DesignateSpecBase - +IronicConductorSpec defines the desired state of IronicConductor |=== | Field | Description | Scheme | Required -| serviceUser -| ServiceUser - optional username used for this service to register in designate +| containerImage +| ContainerImage - Ironic Conductor Container Image | string | true -| databaseInstance -| MariaDB instance name Right now required by the maridb-operator to get the credentials from the instance to create the DB Might not be required in future +| standalone +| Whether to deploy a standalone Ironic. +| bool +| true + +| pxeContainerImage +| PxeContainerImage - Ironic DHCP/TFTP/HTTP Container Image | string | true -| databaseAccount -| DatabaseAccount - name of MariaDBAccount which will be used to connect. +| ironicPythonAgentImage +| IronicPythonAgentImage - Image containing the ironic-python-agent kernel and ramdisk | string | true -| rabbitMqClusterName -| RabbitMQ instance name Needed to request a transportURL that is created and used in Designate +| serviceUser +| ServiceUser - optional username used for this service to register in ironic | string | true | secret -| Secret containing OpenStack password information for designate AdminPassword +| Secret containing OpenStack password information for AdminPassword | string -| true +| false | passwordSelectors -| PasswordSelectors - Selectors to identify the DB and AdminUser password from the Secret +| PasswordSelectors - Selectors to identify the ServiceUser password from the Secret | <> | true -| backendType -| BackendType - Defines the backend service/configuration we are using, i.e. bind9, unhbound, PowerDNS, BYO, etc.. Helps maintain a single init container/init.sh to do container setup +| databaseHostname +| DatabaseHostname - Ironic Database Hostname | string | true -| backendWorkerServerProtocol -| BackendTypeProtocol - Defines the backend protocol to be used between the designate-worker & designate_mdns to/from the DNS server. Acceptable values are: "UDP", "TCP" Please Note: this MUST match what is in the /etc/designate.conf ['service:worker'] +| databaseAccount +| DatabaseAccount - optional MariaDBAccount used for ironic DB, defaults to ironic. | string | true -| backendMdnsServerProtocol -| BackendTypeProtocol - Defines the backend protocol to be used between the designate-worker & designate_mdns to/from the DNS server. Acceptable values are: "UDP", "TCP" Please Note: this MUST match what is in the /etc/designate.conf ['service:mdns'] +| transportURLSecret +| TransportURLSecret - Secret containing RabbitMQ transportURL | string -| true - -| nodeSelector -| NodeSelector to target subset of worker nodes running this service -| *map[string]string | false -| preserveJobs -| PreserveJobs - do not delete jobs after they finished e.g. to check logs -| bool +| notificationsURLSecret +| Secret containing RabbitMq notifications URL +| string | false -| customServiceConfig -| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ +| rpcTransport +| RPC transport type - Which RPC transport implementation to use between conductor and API services. 'oslo' to use oslo.messaging transport or 'json-rpc' to use JSON RPC transport. NOTE \-> ironic requires oslo.messaging transport when not in standalone mode. | string -| false +| true -| defaultConfigOverwrite -| ConfigOverwrite - interface to overwrite default config files like e.g. logging.conf or policy.json. But can also be used to add additional files. Those get added to the service config dir in /etc/++++++.++++++ -| map[string]string +| keystoneEndpoints +| KeystoneEndpoints - Internally used Keystone API endpoints +| <> +| true + +| region +| Region - OpenStack region name +| string | false -| resources -| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ -| corev1.ResourceRequirements +| tls +| TLS - Parameters related to the TLS +| tls.Ca | false -| designateNetworkAttachment -| DesignateNetworkAttachment is a NetworkAttachment resource name for the Designate Control Network +| graphicalConsoles +| Whether to enable graphical consoles. NOTE: Setting this to Enabled is not supported. | string | true -| redisServiceName -| RedisServiceName is the name of the Redis instance to be used (must be in the same namespace as designate) +| novncproxyImage +| NoVNCProxyImage - Ironic NoVNCProxy Container Image | string -| true +| false -| apiTimeout -| Designate API timeout -| int +| consoleImage +| ConsoleImage - Ironic Graphical Console Container Image +| string | true -| topologyRef -| TopologyRef to apply the Topology defined by the associated CR referenced by name -| *topologyv1.TopoRef +| auth +| Auth - Parameters related to authentication (inherited from parent Ironic CR) +| <> | false +|=== -| nsRecords -| NSRecords contains the list of nameserver records for the Designate pool -| []<> +<> + +[#ironicconductorstatus] +==== IronicConductorStatus + +IronicConductorStatus defines the observed state of IronicConductor + +|=== +| Field | Description | Scheme | Required + +| hash +| Map of hashes to track e.g. job status +| map[string]string +| false + +| conditions +| Conditions +| condition.Conditions +| false + +| readyCount +| ReadyCount of ironic Conductor instances +| int32 +| false + +| networkAttachments +| NetworkAttachments status of the deployment pods +| map[string][]string +| false + +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) +| int64 +| false + +| appliedInputSecretHash +| AppliedInputSecretHash is the hash of the input Secret consumed by the currently ready workload. +| string +| false + +| lastAppliedTopology +| LastAppliedTopology - the last applied Topology +| *topologyv1.TopoRef | false |=== <> -[#designatespeccore] -==== DesignateSpecCore +[#ironicconductortemplate] +==== IronicConductorTemplate -DesignateAPISpecCore - this version has no containerImage for use with the OpenStackControlplane +IronicConductorTemplate defines the input parameters for Ironic Conductor service |=== | Field | Description | Scheme | Required -| designateAPI -| DesignateAPI - Spec definition for the API service of this Designate deployment -| <> +| conductorGroup +| ConductorGroup - Ironic Conductor conductor group. +| string | true -| designateCentral -| DesignateCentral - Spec definition for the Central service of this Designate deployment -| <> +| storageClass +| StorageClass +| string | true -| designateWorker -| DesignateWorker - Spec definition for the Worker service of this Designate deployment -| <> +| storageRequest +| StorageRequest +| string | true -| designateMdns -| DesignateMdns - Spec definition for the Mdns service of this Designate deployment -| <> -| true +| networkAttachments +| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network +| []string +| false -| designateProducer -| DesignateProducer - Spec definition for the Producer service of this Designate deployment -| <> -| true +| provisionNetwork +| ProvisionNetwork - Additional network to attach to expose boot DHCP, TFTP, HTTP services. +| string +| false -| designateBackendbind9 -| DesignateBackendbind9 - Spec definition for the Backendbind9 service of this Designate deployment -| <> -| true +| dhcpRanges +| DHCPRanges - List of DHCP ranges to use for provisioning +| []<> +| false -| designateUnbound -| DesignateUnbound - Spec definition for the Unbound Resolver service of this Designate deployment -| <> +| traitBasedNetworking +| TraitBasedNetworking - Configuration for Trait Based Networking +| *<> +| false + +| terminationGracePeriodSeconds +| terminationGracePeriodSeconds - Pod termination grace period in seconds. Controls how long to wait for conductor pods to shut down gracefully before they are forcefully terminated. The default value is long enough for periodic tasks to complete but not for long-running tasks (deployment, cleaning). A node reserved for a long running task will be put into a failed state when the conductor reserving it is forcefully terminated. The terminationGracePeriodSeconds should be chosen with this and maintenance processes in mind. Changing terminationGracePeriodSeconds results in conductor pods being restarted with the old value. +| *int64 | true |=== <> -[#designatestatus] -==== DesignateStatus +[#traitbasednetworkingaction] +==== TraitBasedNetworkingAction -DesignateStatus defines the observed state of Designate +TraitBasedNetworkingAction defines a single port-scheduling action within a trait |=== | Field | Description | Scheme | Required -| hash -| Map of hashes to track e.g. job status -| map[string]string +| action +| Action - The action to take, e.g. attach_port, attach_portgroup, group_and_attach_ports +| string | false -| apiEndpoint -| API endpoint -| map[string]string +| filter +| Filter - The filter expression used to select ports/portgroups for this action +| string | false -| conditions -| Conditions -| condition.Conditions +| min_count +| MinCount - Minimum number of objects that must match before this action applies +| *int | false -| databaseHostname -| DatabaseHostname - Designate Database Hostname -| string +| max_count +| MaxCount - Maximum number of objects that can match this action +| *int | false +|=== -| transportURLSecret -| TransportURLSecret - Secret containing RabbitMQ transportURL +<> + +[#traitbasednetworkingentry] +==== TraitBasedNetworkingEntry + +TraitBasedNetworkingEntry defines a single named trait and its port-scheduling actions + +|=== +| Field | Description | Scheme | Required + +| name +| Name - Trait name, must start with CUSTOM (e.g. CUSTOM_HIGH_SPEED_BOND) | string -| false +| true -| designateAPIReadyCount -| ReadyCount of Designate API instance -| int32 +| order +| Order - Resolution order for this trait relative to others. Lower orders apply first. +| int | false -| designateCentralReadyCount -| ReadyCount of Designate Central instance -| int32 +| actions +| Actions - List of port-scheduling actions to apply for this trait +| []<> | false +|=== -| designateWorkerReadyCount -| ReadyCount of Designate Worker instance -| int32 -| false +<> -| designateMdnsReadyCount -| ReadyCount of Designate Mdns instance -| int32 -| false +[#traitbasednetworkingspec] +==== TraitBasedNetworkingSpec + +TraitBasedNetworkingSpec defines the Trait Based Networking configuration + +|=== +| Field | Description | Scheme | Required + +| state +| State - Whether to enable Trait Based Networking. Set to "Enabled" to activate TBN; "Disabled" (the default) leaves TBN inactive. When set to "Enabled", the config field must also be provided. +| string +| true -| designateProducerReadyCount -| ReadyCount of Designate Producer instance -| int32 +| config +| Config - Named traits and their port-scheduling actions for trait_based_networking.yaml +| []<> | false +|=== -| designateBackendbind9ReadyCount -| ReadyCount of Designate Backendbind9 instance -| int32 -| false +<> -| designateUnboundReadyCount -| ReadyCount of Designate Unbound instance -| int32 -| false +[#inspectoroverridespec] +==== InspectorOverrideSpec -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) -| int64 -| false +InspectorOverrideSpec to override the generated manifest of several child resources. -| redisHostIPs -| List of Redis Host IP addresses -| []string +|=== +| Field | Description | Scheme | Required + +| service +| Override configuration for the Service created to serve traffic to the cluster. The key must be the endpoint type (public, internal) +| map[service.Endpoint]service.RoutedOverrideSpec | false |=== <> -[#designateunbound] -==== DesignateUnbound +[#ironicinspector] +==== IronicInspector -DesignateUnbound is the Schema for the designateworker API +IronicInspector is the Schema for the IronicInspector |=== | Field | Description | Scheme | Required @@ -5634,21 +9569,21 @@ DesignateUnbound is the Schema for the designateworker API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#designateunboundlist] -==== DesignateUnboundList +[#ironicinspectorlist] +==== IronicInspectorList -DesignateUnboundList contains a list of DesignateUnbound +IronicInspectorList contains a list of IronicInspector |=== | Field | Description | Scheme | Required @@ -5660,76 +9595,152 @@ DesignateUnboundList contains a list of DesignateUnbound | items | -| []<> +| []<> | true |=== <> -[#designateunboundspecbase] -==== DesignateUnboundSpecBase +[#ironicinspectorpasswordselector] +==== IronicInspectorPasswordSelector -DesignateUnboundSpecBase - +IronicInspectorPasswordSelector to identify the AdminUser password from the Secret |=== | Field | Description | Scheme | Required -| serviceAccount -| ServiceAccount - service account name used internally to provide Designate services the default SA name +| service +| Service - Selector to get the ironic-inspector service password from the Secret | string | true +|=== -| replicas -| Replicas - Designate Unbound Replicas -| *int32 +<> + +[#ironicinspectorspec] +==== IronicInspectorSpec + +IronicInspectorSpec defines the desired state of IronicInspector + +|=== +| Field | Description | Scheme | Required + +| standalone +| Standalone - Whether to deploy a standalone Ironic Inspector. +| bool | true -| override -| Allows services to be configured for accessing each Unbound pod. For best results, there should be an override for each replica. -| <> +| containerImage +| ContainerImage - Ironic Inspector Container Image +| string +| true + +| pxeContainerImage +| PxeContainerImage - Ironic Inspector DHCP/TFTP/HTTP Container Image +| string +| true + +| ironicPythonAgentImage +| IronicPythonAgentImage - Image containing the ironic-python-agent kernel and ramdisk +| string +| true + +| databaseInstance +| MariaDB instance name. Right now required by the maridb-operator to get the credentials from the instance to create the DB. Might not be required in future. +| string +| true + +| secret +| Secret containing OpenStack password information for AdminPassword +| string | false -| stubZones -| Allows configuring stub zone entries in the managed Unbound servers for the managed nameservers. -| []<> +| rabbitMqClusterName +| RabbitMQ instance name Needed to request a transportURL that is created and used in Ironic Inspector Deprecated: Use MessagingBus.Cluster instead +| string +| false + +| messagingBus +| MessagingBus configuration (username, vhost, and cluster) for RPC messaging +| rabbitmqv1.RabbitMqConfig +| false + +| notificationsBus +| NotificationsBus configuration (username, vhost, and cluster) for notifications +| *rabbitmqv1.RabbitMqConfig | false + +| rpcTransport +| RPC transport type - Which RPC transport implementation to use between conductor and API services. 'oslo' to use oslo.messaging transport or 'json-rpc' to use JSON RPC transport. NOTE \-> ironic-inspector requires oslo.messaging transport when not in standalone mode. +| string +| true + +| apiTimeout +| APITimeout for HAProxy, Apache +| int +| true |=== <> -[#designateunboundstatus] -==== DesignateUnboundStatus +[#ironicinspectorstatus] +==== IronicInspectorStatus -DesignateUnboundStatus defines the observed state of DesignateUnbound +IronicInspectorStatus defines the observed state of IronicInspector |=== | Field | Description | Scheme | Required -| readyCount -| ReadyCount of designate central instances -| int32 -| false - | hash | Map of hashes to track e.g. job status | map[string]string | false +| apiEndpoints +| API endpoint +| map[string]map[string]string +| false + | conditions | Conditions | condition.Conditions | false +| databaseHostname +| IronicInspector Database Hostname +| string +| false + +| readyCount +| ReadyCount of Ironic Inspector instances +| int32 +| false + +| transportURLSecret +| TransportURLSecret - Secret containing RabbitMQ transportURL +| string +| false + +| notificationsURLSecret +| NotificationsURLSecret - Secret containing RabbitMQ notifications URL +| *string +| false + | networkAttachments | NetworkAttachments status of the deployment pods | map[string][]string | false | observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) | int64 | false +| appliedInputSecretHash +| AppliedInputSecretHash is the hash of the input Secret consumed by the currently ready workload. +| string +| false + | lastAppliedTopology | LastAppliedTopology - the last applied Topology | *topologyv1.TopoRef @@ -5738,43 +9749,106 @@ DesignateUnboundStatus defines the observed state of DesignateUnbound <> -[#stubzone] -==== StubZone +[#ironicinspectortemplate] +==== IronicInspectorTemplate + +IronicInspectorTemplate defines the input parameters for Ironic Inspector service |=== | Field | Description | Scheme | Required -| name -| +| serviceUser +| ServiceUser - optional username used for this service to register in ironic-inspector | string | true -| options -| +| replicas +| Replicas - Ironic Inspector Replicas +| *int32 +| true + +| databaseAccount +| DatabaseAccount - optional MariaDBAccount used for ironic DB, defaults to ironic-inspector. this is separate from the account used for ironic, as a MariaDBAccount can only refer to a single MariaDBDatabase and it appears that ironic inspector uses its own MariaDBDatabase. +| string +| true + +| passwordSelectors +| PasswordSelectors - Selectors to identify the ServiceUser password from the Secret +| <> +| true + +| nodeSelector +| NodeSelector to target subset of worker nodes running this service. Setting here overrides any global NodeSelector settings within the Ironic CR +| *map[string]string +| false + +| preserveJobs +| PreserveJobs - do not delete jobs after they finished e.g. to check logs +| bool +| true + +| customServiceConfig +| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ +| string +| true + +| defaultConfigOverwrite +| ConfigOverwrite - interface to overwrite default config files like e.g. policy.json. But can also be used to add additional files. Those get added to the service config dir in /etc/++++++.++++++ | map[string]string | false -|=== -<> +| resources +| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ +| corev1.ResourceRequirements +| false -[#unboundoverridespec] -==== UnboundOverrideSpec +| storageClass +| StorageClass +| string +| false -|=== -| Field | Description | Scheme | Required +| networkAttachments +| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network +| []string +| false -| services -| -| []service.OverrideSpec +| inspectionNetwork +| InspectionNetwork - Additional network to attach to expose boot DHCP, TFTP, HTTP services. +| string +| false + +| dhcpRanges +| DHCPRanges - List of DHCP ranges to use for provisioning +| []<> +| false + +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> +| false + +| tls +| TLS - Parameters related to the TLS +| tls.API +| false + +| auth +| Auth - Parameters related to authentication +| <> +| false + +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name +| *topologyv1.TopoRef | false |=== <> -[#designateworker] -==== DesignateWorker +[#ironicneutronagent] +==== IronicNeutronAgent -DesignateWorker is the Schema for the designateworker API +IronicNeutronAgent is the Schema for the ML2 baremetal - ironic-neutron-agent agents |=== | Field | Description | Scheme | Required @@ -5786,21 +9860,21 @@ DesignateWorker is the Schema for the designateworker API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#designateworkerlist] -==== DesignateWorkerList +[#ironicneutronagentlist] +==== IronicNeutronAgentList -DesignateWorkerList contains a list of DesignateWorker +IronicNeutronAgentList contains a list of IronicConductor |=== | Field | Description | Scheme | Required @@ -5812,61 +9886,61 @@ DesignateWorkerList contains a list of DesignateWorker | items | -| []<> +| []<> | true |=== <> -[#designateworkerspecbase] -==== DesignateWorkerSpecBase +[#ironicneutronagentspec] +==== IronicNeutronAgentSpec -DesignateWorkerSpecBase - +IronicNeutronAgentSpec defines the desired state of ML2 baremetal - ironic-neutron-agent agents |=== | Field | Description | Scheme | Required -| replicas -| Replicas - Designate Worker Replicas -| *int32 +| containerImage +| ContainerImage - ML2 baremtal - Ironic Neutron Agent Image +| string | true -| databaseHostname -| DatabaseHostname - Designate Database Hostname +| serviceUser +| ServiceUser - optional username used for this service to register in ironic | string -| false +| true -| transportURLSecret -| Secret containing RabbitMq transport URL +| secret +| Secret containing OpenStack password information for IronicPassword | string | false -| serviceAccount -| ServiceAccount - service account name used internally to provide Designate services the default SA name -| string +| passwordSelectors +| PasswordSelectors - Selectors to identify the ServiceUser password from the Secret +| <> | true | tls | TLS - Parameters related to the TLS | tls.Ca | false + +| auth +| Auth - Parameters related to authentication (inherited from parent Ironic CR) +| <> +| false |=== <> -[#designateworkerstatus] -==== DesignateWorkerStatus +[#ironicneutronagentstatus] +==== IronicNeutronAgentStatus -DesignateWorkerStatus defines the observed state of DesignateWorker +IronicNeutronAgentStatus defines the observed state of ML2 baremetal - ironic-neutron-agent |=== | Field | Description | Scheme | Required -| readyCount -| ReadyCount of designate central instances -| int32 -| false - | hash | Map of hashes to track e.g. job status | map[string]string @@ -5877,16 +9951,31 @@ DesignateWorkerStatus defines the observed state of DesignateWorker | condition.Conditions | false -| networkAttachments -| NetworkAttachments status of the deployment pods -| map[string][]string +| readyCount +| ReadyCount of ironic Conductor instances +| int32 +| false + +| transportURLSecret +| TransportURLSecret - Secret containing RabbitMQ transportURL +| string +| false + +| notificationsURLSecret +| NotificationsURLSecret - Secret containing RabbitMQ notifications URL +| *string | false | observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) | int64 | false +| appliedInputSecretHash +| AppliedInputSecretHash is the hash of the input Secret consumed by the currently ready workload. +| string +| false + | lastAppliedTopology | LastAppliedTopology - the last applied Topology | *topologyv1.TopoRef @@ -5895,159 +9984,73 @@ DesignateWorkerStatus defines the observed state of DesignateWorker <> -[#apioverridespec-2] -==== APIOverrideSpec - -APIOverrideSpec to override the generated manifest of several child resources. - -|=== -| Field | Description | Scheme | Required - -| service -| Override configuration for the Service created to serve traffic to the cluster. The key must be the endpoint type (public, internal) -| map[service.Endpoint]service.RoutedOverrideSpec -| false -|=== - -<> - -[#glanceapitemplate] -==== GlanceAPITemplate +[#ironicneutronagenttemplate] +==== IronicNeutronAgentTemplate -GlanceAPITemplate defines the desired state of GlanceAPI +IronicNeutronAgentTemplate defines the input parameters for ML2 baremetal - ironic-neutron-agent agents |=== | Field | Description | Scheme | Required -| replicas -| Replicas of glance API to run -| *int32 -| true - -| containerImage -| Glance Container Image URL (will be set to environmental default if empty) -| string -| true - -| nodeSelector -| NodeSelector to target subset of worker nodes running this service -| *map[string]string -| false - -| topologyRef -| TopologyRef to apply the Topology defined by the associated CR referenced by name -| *topologyv1.TopoRef -| false - -| customServiceConfig -| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ -| string -| false - -| customServiceConfigSecrets -| CustomServiceConfigSecrets - customize the service config using this parameter to specify Secrets that contain sensitive service config data. The content of each Secret gets added to the /etc/++++++/++++++.conf.d directory as a custom config file.++++++++++++ -| []string -| false - -| resources -| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ -| corev1.ResourceRequirements -| false - -| networkAttachments -| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network -| []string -| false - -| override -| Override, provides the ability to override the generated manifest of several child resources. -| <> -| false - -| storage -| Storage - -| <> -| false - -| type -| Type - represents the layout of the glanceAPI deployment. +| rabbitMqClusterName +| RabbitMQ instance name Needed to request a transportURL that is created and used in Ironic Deprecated: Use MessagingBus.Cluster instead | string | false -| tls -| TLS - Parameters related to the TLS -| tls.API -| false - -| imageCache -| ImageCache - It represents the struct to expose the ImageCache related parameters (size of the PVC and cronJob schedule) -| <> +| messagingBus +| MessagingBus configuration (username, vhost, and cluster) for RPC messaging +| rabbitmqv1.RabbitMqConfig | false -| apiTimeout -| APITimeout for HAProxy and Apache defaults to GlanceSpecCore APITimeout -| int +| notificationsBus +| NotificationsBus configuration (username, vhost, and cluster) for notifications +| *rabbitmqv1.RabbitMqConfig | false |=== <> -[#imagecache] -==== ImageCache +[#apioverridespec-2] +==== APIOverrideSpec -ImageCache - struct where the exposed imageCache params are defined +APIOverrideSpec to override the generated manifest of several child resources. |=== | Field | Description | Scheme | Required -| size -| Size - Local storage request, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024) -| string -| true - -| cleanerScheduler -| Schedule defines the crontab format string to schedule the Cleaner cronJob -| string -| true - -| prunerScheduler -| Schedule defines the crontab format string to schedule the Pruner cronJob -| string -| true +| service +| Override configuration for the Service created to serve traffic to the cluster. The key must be the endpoint type (public, internal) +| map[service.Endpoint]service.RoutedOverrideSpec +| false |=== <> -[#storage] -==== Storage +[#httpdcustomization] +==== HttpdCustomization -Storage - +HttpdCustomization - customize the httpd service |=== | Field | Description | Scheme | Required -| storageClass -| StorageClass - -| string -| false - -| storageRequest -| StorageRequest - -| string -| false +| processNumber +| ProcessNumber - Number of processes running in keystone API +| *int32 +| true -| external -| External - -| bool +| customConfigSecret +| CustomConfigSecret - customize the httpd vhost config using this parameter to specify a secret that contains service config data. The content of each provided snippet gets rendered as a go template and placed into /etc/httpd/conf/httpd_custom_++++++. In the default httpd template at the end of the vhost those custom configs get included using `Include conf/httpd_custom_++++++_*`. For information on how sections in httpd configuration get merged, check section \"How the sections are merged\" in https://httpd.apache.org/docs/current/sections.html#merging++++++++++++ +| *string | false |=== <> -[#glanceapi] -==== GlanceAPI +[#keystoneapi] +==== KeystoneAPI -GlanceAPI is the Schema for the glanceapis API +KeystoneAPI is the Schema for the keystoneapis API |=== | Field | Description | Scheme | Required @@ -6059,21 +10062,21 @@ GlanceAPI is the Schema for the glanceapis API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#glanceapilist] -==== GlanceAPIList +[#keystoneapilist] +==== KeystoneAPIList -GlanceAPIList contains a list of GlanceAPI +KeystoneAPIList contains a list of KeystoneAPI |=== | Field | Description | Scheme | Required @@ -6085,97 +10088,213 @@ GlanceAPIList contains a list of GlanceAPI | items | -| []<> +| []<> | true |=== <> -[#glanceapispec] -==== GlanceAPISpec +[#keystoneapispec] +==== KeystoneAPISpec -GlanceAPISpec defines the desired state of GlanceAPI +KeystoneAPISpec defines the desired state of KeystoneAPI + +|=== +| Field | Description | Scheme | Required + +| containerImage +| Keystone Container Image URL (will be set to environmental default if empty) +| string +| true +|=== + +<> + +[#keystoneapispeccore] +==== KeystoneAPISpecCore + +KeystoneAPISpecCore defines the desired state of KeystoneAPI core spec |=== | Field | Description | Scheme | Required -| apiType -| +| databaseInstance +| MariaDB instance name Right now required by the maridb-operator to get the credentials from the instance to create the DB Might not be required in future +| string +| true + +| databaseAccount +| DatabaseAccount - name of MariaDBAccount which will be used to connect. +| string +| true + +| memcachedInstance +| Memcached instance name. +| string +| true + +| region +| Region - optional region name for the keystone service | string | true -| serviceUser -| ServiceUser - optional username used for this service to register in glance +| adminProject +| AdminProject - admin project name | string | true -| serviceAccount -| ServiceAccount - service account name used internally to provide GlanceAPI the default SA name +| adminUser +| AdminUser - admin user name | string | true -| databaseHostname -| DatabaseHostname - Glance Database Hostname +| replicas +| Replicas of keystone API to run +| *int32 +| true + +| secret +| Secret containing OpenStack password information for keystone AdminPassword | string | true -| databaseAccount -| DatabaseAccount - name of MariaDBAccount which will be used to connect. +| enableSecureRBAC +| EnableSecureRBAC - Enable Consistent and Secure RBAC policies +| bool +| true + +| trustFlushArgs +| TrustFlushArgs - Arguments added to keystone-manage trust_flush command | string | true -| secret -| Secret containing OpenStack password information for glance AdminPassword +| trustFlushSchedule +| TrustFlushSchedule - Schedule to purge expired or soft-deleted trusts from database | string | true +| trustFlushSuspend +| TrustFlushSuspend - Suspend the cron job to purge trusts +| bool +| true + +| fernetRotationDays +| FernetRotationDays - Rotate fernet token keys every X days +| *int32 +| true + +| fernetMaxActiveKeys +| FernetMaxActiveKeys - Maximum number of fernet token keys after rotation +| *int32 +| true + | passwordSelectors -| PasswordSelectors - Selectors to identify the DB and ServiceUser password from the Secret +| PasswordSelectors - Selectors to identify the AdminUser password from the Secret | <> | true -| extraMounts -| ExtraMounts containing conf files and credentials -| []<> +| nodeSelector +| NodeSelector to target subset of worker nodes running this service +| *map[string]string | false -| quota -| QuotaEnforce if true, per-tenant quotas are enforced according to the registered keystone limits +| preserveJobs +| PreserveJobs - do not delete jobs after they finished e.g. to check logs | bool | true -| memcachedInstance -| Memcached instance name. +| customServiceConfig +| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ | string +| false + +| defaultConfigOverwrite +| ConfigOverwrite - interface to overwrite default config files like e.g. policy.json. But can also be used to add additional files. Those get added to the service config dir in /etc/++++++.++++++ +| map[string]string +| false + +| httpdCustomization +| HttpdCustomization - customize the httpd service +| <> | true -| notificationBusSecret -| Secret containing RabbitMq transport URL +| resources +| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ +| corev1.ResourceRequirements +| false + +| networkAttachments +| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network +| []string +| false + +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> +| false + +| rabbitMqClusterName +| RabbitMQ instance name Needed to request a transportURL that is created and used in Keystone Deprecated: Use NotificationsBus.Cluster instead +| string +| false + +| tls +| TLS - Parameters related to the TLS +| tls.API +| false + +| apiTimeout +| APITimeout for HAProxy, Apache +| int +| true + +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name +| *topologyv1.TopoRef +| false + +| extraMounts +| ExtraMounts containing conf files +| []<> +| false + +| federatedRealmConfig +| Secret containing the configuration for federated realms This is only needed when multiple realms are federated. Config files mount path is set to /var/lib/httpd/metadata/ | string | true + +| externalKeystoneAPI +| ExternalKeystoneAPI - Enable use of external Keystone API endpoints instead of deploying a local Keystone API +| bool +| true + +| notificationsBus +| NotificationsBus configuration (username, vhost, and cluster) +| *rabbitmqv1.RabbitMqConfig +| false |=== <> -[#glanceapistatus] -==== GlanceAPIStatus +[#keystoneapistatus] +==== KeystoneAPIStatus -GlanceAPIStatus defines the observed state of GlanceAPI +KeystoneAPIStatus defines the observed state of KeystoneAPI |=== | Field | Description | Scheme | Required | readyCount -| ReadyCount of glance API instances +| ReadyCount of keystone API instances | int32 -| true +| false | hash | Map of hashes to track e.g. job status | map[string]string | false -| apiEndpoint +| apiEndpoints | API endpoint | map[string]string | false @@ -6185,18 +10304,23 @@ GlanceAPIStatus defines the observed state of GlanceAPI | condition.Conditions | false +| databaseHostname +| Keystone Database Hostname +| string +| false + | networkAttachments | NetworkAttachments status of the deployment pods | map[string][]string | false -| domain -| Domain is a parameter used by each glanceAPI replicas to setup a worker and set the worker_self_reference_url config option. It's requierd when distributed image import is enabled and it enables pod to pod communication via the associated hostnames +| transportURLSecret +| TransportURLSecret - Secret containing RabbitMQ transportURL | string | false | observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes. | int64 | false @@ -6205,39 +10329,86 @@ GlanceAPIStatus defines the observed state of GlanceAPI | *topologyv1.TopoRef | false -| notificationBusSecret -| NotificationBusSecret - Secret containing RabbitMQ transportURL for notification purposes +| region +| Region - optional region name for the keystone service | string | false |=== <> -[#dbpurge-2] -==== DBPurge +[#keystoneextramounts] +==== KeystoneExtraMounts -DBPurge struct is used to model the parameters exposed to the Glance API CronJob +KeystoneExtraMounts exposes additional parameters processed by keystone-operator and defines the common VolMounts structure provided by the main storage module |=== | Field | Description | Scheme | Required -| age -| Age is the DBPurgeAge parameter and indicates the number of days of purging DB records -| int +| name +| +| string +| false + +| region +| +| string +| false + +| extraVol +| +| []storage.VolMounts | true +|=== -| schedule -| Schedule defines the crontab format string to schedule the DBPurge cronJob +<> + +[#passwordselector-2] +==== PasswordSelector + +PasswordSelector to identify the DB and AdminUser password from the Secret + +|=== +| Field | Description | Scheme | Required + +| admin +| Admin - Selector to get the keystone Admin password from the Secret | string | true |=== <> -[#glance] -==== Glance +[#acrule-2] +==== ACRule -Glance is the Schema for the glances API +ACRule defines an access rule for an ApplicationCredential + +|=== +| Field | Description | Scheme | Required + +| service +| Service is the OpenStack service type +| string +| true + +| path +| Path is the API path to allow +| string +| true + +| method +| Method is the HTTP verb to allow +| string +| true +|=== + +<> + +[#keystoneapplicationcredential] +==== KeystoneApplicationCredential + +KeystoneApplicationCredential is the Schema for the applicationcredentials API |=== | Field | Description | Scheme | Required @@ -6249,211 +10420,259 @@ Glance is the Schema for the glances API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#glanceextravolmounts] -==== GlanceExtraVolMounts +[#keystoneapplicationcredentiallist] +==== KeystoneApplicationCredentialList -GlanceExtraVolMounts exposes additional parameters processed by the glance-operator and defines the common VolMounts structure provided by the main storage module +KeystoneApplicationCredentialList contains a list of ApplicationCredential |=== | Field | Description | Scheme | Required -| name +| metadata | -| string +| metav1.ListMeta | false -| region +| items | +| []<> +| true +|=== + +<> + +[#keystoneapplicationcredentialspec] +==== KeystoneApplicationCredentialSpec + +KeystoneApplicationCredentialSpec defines what the user can set + +|=== +| Field | Description | Scheme | Required + +| secret +| Secret containing service user password | string -| false +| true -| extraVol -| -| []storage.VolMounts +| passwordSelector +| PasswordSelector for extracting the service password +| string +| true + +| userName +| UserName - the Keystone user under which this ApplicationCredential is created +| string +| true + +| expirationDays +| ExpirationDays sets the lifetime in days for the ApplicationCredential +| int +| true + +| gracePeriodDays +| GracePeriodDays sets how many days before expiration the ApplicationCredential should be rotated +| int +| true + +| roles +| Roles to assign to the ApplicationCredential +| []string | true + +| unrestricted +| Unrestricted indicates whether the ApplicationCredential may be used to create or destroy other credentials or trusts +| bool +| true + +| accessRules +| AccessRules defines which services the ApplicationCredential is permitted to access +| []<> +| false |=== <> -[#glancelist] -==== GlanceList +[#keystoneapplicationcredentialstatus] +==== KeystoneApplicationCredentialStatus -GlanceList contains a list of Glance +KeystoneApplicationCredentialStatus defines the observed state |=== | Field | Description | Scheme | Required -| metadata -| -| metav1.ListMeta +| acID +| ACID - the ID in Keystone for this ApplicationCredential +| string | false -| items -| -| []<> -| true -|=== +| secretName +| SecretName - name of the k8s Secret storing the ApplicationCredential secret +| string +| false -<> +| previousSecretName +| PreviousSecretName - name of the previous AC secret. Only current and previous are protected by finalizer. +| string +| false -[#glancespec] -==== GlanceSpec +| conditions +| Conditions +| condition.Conditions +| false -GlanceSpec defines the desired state of Glance +| createdAt +| CreatedAt - timestap of creation +| *metav1.Time +| false -|=== -| Field | Description | Scheme | Required +| expiresAt +| ExpiresAt - time of validity expiration +| *metav1.Time +| false -| containerImage -| Glance Container Image URL (will be set to environmental default if empty) +| rotationEligibleAt +| RotationEligibleAt indicates when rotation becomes eligible (start of grace period window). Computed as ExpiresAt - GracePeriodDays. The AC can be rotated after this timestamp. +| *metav1.Time +| false + +| lastRotated +| LastRotated - timestamp when credentials were last rotated +| *metav1.Time +| false + +| observedGeneration +| ObservedGeneration - the most recent generation observed for this ApplicationCredential. +| int64 +| false + +| securityHash +| SecurityHash tracks the hash of security-critical spec fields (roles, accessRules, unrestricted). Used to detect when these fields change and trigger immediate rotation. | string -| true +| false |=== <> -[#glancespeccore] -==== GlanceSpecCore +[#endpoint] +==== Endpoint -GlanceSpecCore defines the desired state of Glance +Endpoint - |=== | Field | Description | Scheme | Required -| serviceUser -| ServiceUser - optional username used for this service to register in glance +| interface +| Interface - public, internal, admin | string | true -| databaseInstance -| MariaDB instance name Right now required by the maridb-operator to get the credentials from the instance to create the DB Might not be required in future +| url +| URL - endpoint url | string | true -| databaseAccount -| DatabaseAccount - name of MariaDBAccount which will be used to connect. +| id +| ID - endpoint id | string | true +|=== -| memcachedInstance -| Memcached instance name. -| string -| true +<> -| secret -| Secret containing OpenStack password information for glance's keystone password; no longer used for database password -| string -| true +[#keystoneendpoint] +==== KeystoneEndpoint -| passwordSelectors -| PasswordSelectors - Selectors to identify the DB and ServiceUser password from the Secret -| <> -| true +KeystoneEndpoint is the Schema for the keystoneendpoints API -| nodeSelector -| NodeSelector to target subset of worker nodes running this service -| *map[string]string -| false +|=== +| Field | Description | Scheme | Required -| topologyRef -| TopologyRef to apply the Topology defined by the associated CR referenced by name -| *topologyv1.TopoRef +| metadata +| +| metav1.ObjectMeta | false -| preserveJobs -| PreserveJobs - do not delete jobs after they finished e.g. to check logs -| bool -| true - -| customServiceConfig -| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ -| string +| spec +| +| <> | false -| customServiceConfigSecrets -| CustomServiceConfigSecrets - customize the service config using this parameter to specify Secrets that contain sensitive service config data. The content of each Secret gets added to the /etc/++++++/++++++.conf.d directory as a custom config file.++++++++++++ -| []string +| status +| +| <> | false +|=== -| storage -| Storage - -| <> -| false +<> -| glanceAPIs -| GlanceAPIs - Spec definition for the API service of this Glance deployment -| map[string]<> -| true +[#keystoneendpointlist] +==== KeystoneEndpointList -| extraMounts -| ExtraMounts containing conf files and credentials -| []<> -| false +KeystoneEndpointList contains a list of KeystoneEndpoint -| quotas -| Quotas is defined, per-tenant quotas are enforced according to the registered keystone limits -| <> +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ListMeta | false -| imageCache -| ImageCache - -| <> +| items +| +| []<> | true +|=== -| keystoneEndpoint -| KeystoneEndpoint - indicates which glanceAPI should be registered in the keystone catalog, and it acts as a selector for the underlying glanceAPI(s) that can be specified by name -| string -| true +<> -| dbPurge -| DBPurge parameters - -| <> -| false +[#keystoneendpointspec] +==== KeystoneEndpointSpec -| apiTimeout -| Default APITimeout for HAProxy and Apache, defaults to 60 seconds -| int +KeystoneEndpointSpec defines the desired state of KeystoneEndpoint + +|=== +| Field | Description | Scheme | Required + +| serviceName +| ServiceName - Name of the service to create the endpoint for +| string | true -| notificationBusInstance -| RabbitMQ instance name Needed to request a transportURL that is created and used for notification purposes -| *string -| false +| endpoints +| Endpoints - map with service api endpoint URLs with the endpoint type as index +| map[string]string +| true |=== <> -[#glancestatus] -==== GlanceStatus +[#keystoneendpointstatus] +==== KeystoneEndpointStatus -GlanceStatus defines the observed state of Glance +KeystoneEndpointStatus defines the observed state of KeystoneEndpoint |=== | Field | Description | Scheme | Required -| hash -| Map of hashes to track e.g. job status -| map[string]string -| false - -| apiEndpoint -| API endpoint +| endpointIDs +| | map[string]string | false | serviceID -| ServiceID +| | string | false @@ -6462,148 +10681,153 @@ GlanceStatus defines the observed state of Glance | condition.Conditions | false -| databaseHostname -| Glance Database Hostname -| string -| false - -| glanceAPIReadyCounts -| GlanceAPIReadyCounts - -| map[string]int32 +| endpoints +| Endpoints - current status of latest configured endpoints for the service +| []<> | false | observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes. | int64 | false - -| notificationBusSecret -| NotificationsBusSecret - Secret containing RabbitMQ transportURL used for notification purposes -| string -| false |=== <> -[#passwordselector-2] -==== PasswordSelector +[#keystoneservice] +==== KeystoneService -PasswordSelector to identify the DB and AdminUser password from the Secret +KeystoneService is the Schema for the keystoneservices API |=== | Field | Description | Scheme | Required -| service -| Service - Selector to get the glance service password from the Secret -| string -| true +| metadata +| +| metav1.ObjectMeta +| false + +| spec +| +| <> +| false + +| status +| +| <> +| false |=== <> -[#quotalimits] -==== QuotaLimits +[#keystoneservicelist] +==== KeystoneServiceList -QuotaLimits - The parameters exposed to the top level glance CR that represents the limits we set in keystone +KeystoneServiceList contains a list of KeystoneService |=== | Field | Description | Scheme | Required -| imageSizeTotal +| metadata | -| int -| true +| metav1.ListMeta +| false -| imageStageTotal +| items | -| int +| []<> | true +|=== -| imageCountTotal -| -| int +<> + +[#keystoneservicespec] +==== KeystoneServiceSpec + +KeystoneServiceSpec defines the desired state of KeystoneService + +|=== +| Field | Description | Scheme | Required + +| serviceType +| ServiceType - Type is the type of the service. +| string | true -| imageCountUpload -| -| int +| serviceName +| ServiceName - Name of the service. +| string | true -|=== -<> +| serviceDescription +| ServiceDescription - Description for the service. +| string +| false -[#apioverridespec-2] -==== APIOverrideSpec +| enabled +| Enabled - whether or not the service is enabled. +| bool +| true -APIOverrideSpec to override the generated manifest of several child resources. +| serviceUser +| ServiceUser - optional username used for this service +| string +| true -|=== -| Field | Description | Scheme | Required +| secret +| Secret containing OpenStack password information for the ServiceUser +| string +| true -| service -| Override configuration for the Service created to serve traffic to the cluster. The key must be the endpoint type (public, internal) -| map[service.Endpoint]service.RoutedOverrideSpec -| false +| passwordSelector +| PasswordSelector - Selector to get the ServiceUser password from the Secret, e.g. PlacementPassword +| string +| true |=== <> -[#heatextravolmounts] -==== HeatExtraVolMounts +[#keystoneservicestatus] +==== KeystoneServiceStatus -HeatExtraVolMounts exposes additional parameters processed by the heat-operator and defines the common VolMounts structure provided by the main storage module +KeystoneServiceStatus defines the observed state of KeystoneService |=== | Field | Description | Scheme | Required -| name +| serviceID | | string | false -| region -| -| string +| conditions +| Conditions +| condition.Conditions | false - -| extraVol -| -| []storage.VolMounts -| true |=== <> -[#heatservicetemplate] -==== HeatServiceTemplate +[#manilaservicetemplate] +==== ManilaServiceTemplate -HeatServiceTemplate - +ManilaServiceTemplate defines the input parameters that can be defined for a given Manila service |=== | Field | Description | Scheme | Required -| replicas -| Replicas - -| *int32 -| true - -| defaultConfigOverwrite -| ConfigOverwrite - interface to overwrite default config files like e.g. policy.json. But can also be used to add additional files. Those get added to the service config dir in /etc/++++++.++++++ -| map[string]string -| false - | nodeSelector -| NodeSelector to target subset of worker nodes for running the service +| NodeSelector to target subset of worker nodes running this service. Setting here overrides any global NodeSelector settings within the Manila CR. | *map[string]string | false | customServiceConfig -| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to /etc/heat/heat.conf.d directory as 02-custom-service.conf file. +| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to to /etc/++++++/++++++.conf.d directory a custom config file.++++++++++++ | string -| false +| true | customServiceConfigSecrets -| CustomServiceConfigSecrets - customize the service config using this parameter to specify Secrets that contain sensitive service config data. The content of each Secret gets added to the /etc/heat/heat.conf.d directory as a custom config file. +| CustomServiceConfigSecrets - customize the service config using this parameter to specify Secrets that contain sensitive service config data. The content of each Secret gets added to the /etc/++++++/++++++.conf.d directory as a custom config file.++++++++++++ | []string | false @@ -6612,6 +10836,11 @@ HeatServiceTemplate - | corev1.ResourceRequirements | false +| networkAttachments +| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network +| []string +| false + | topologyRef | TopologyRef to apply the Topology defined by the associated CR referenced by name | *topologyv1.TopoRef @@ -6620,38 +10849,33 @@ HeatServiceTemplate - <> -[#heattemplate] -==== HeatTemplate +[#manilatemplate] +==== ManilaTemplate -HeatTemplate - +ManilaTemplate defines common input parameters used by all Manila services |=== | Field | Description | Scheme | Required | serviceUser -| ServiceUser - optional username used for this service to register in heat +| ServiceUser - optional username used for this service to register in manila | string | true | databaseAccount -| DatabaseAccount - optional MariaDBAccount used for heat DB, defaults to heat. +| DatabaseAccount - optional MariaDBAccount CR name used for manila DB, defaults to manila | string | true | secret -| Secret containing OpenStack password information for heat HeatDatabasePassword, HeatPassword and HeatAuthEncryptionKey +| Secret containing OpenStack password information for AdminPassword | string -| true +| false | passwordSelectors -| PasswordSelectors - Selectors to identify the DB and ServiceUser password from the Secret +| PasswordSelectors - Selectors to identify the ServiceUser password from the Secret | <> | true - -| extraMounts -| ExtraMounts containing files and plugins -| []<> -| false |=== <> @@ -6659,210 +10883,112 @@ HeatTemplate - [#passwordselector-2] ==== PasswordSelector -PasswordSelector .. +PasswordSelector to identify the DB and AdminUser password from the Secret |=== | Field | Description | Scheme | Required | service -| Service - Selector to get the heat service password from the Secret -| string -| true - -| authEncryptionKey -| AuthEncryptionKey - Selector to get the heat auth encryption key from the Secret -| string -| true - -| stackDomainAdminPassword -| StackDomainAdminPassword - Selector to get the heat stack domain admin password from the Secret +| Service - Selector to get the manila service password from the Secret | string | true |=== <> -[#heatapi] -==== HeatAPI - -HeatAPI ... - -|=== -| Field | Description | Scheme | Required - -| metadata -| -| metav1.ObjectMeta -| false - -| spec -| -| <> -| false - -| status -| -| <> -| false -|=== - -<> - -[#heatapilist] -==== HeatAPIList - -HeatAPIList contains a list of HeatAPI - -|=== -| Field | Description | Scheme | Required - -| metadata -| -| metav1.ListMeta -| false - -| items -| -| []<> -| true -|=== - -<> - -[#heatapispec] -==== HeatAPISpec +[#dbpurge-2] +==== DBPurge -HeatAPISpec defines the desired state of HeatAPI +DBPurge struct is used to model the parameters exposed to the Manila API CronJob |=== | Field | Description | Scheme | Required -| databaseHostname -| DatabaseHostname - Heat Database Hostname -| string -| true - -| transportURLSecret -| TransportURLSecret - Secret containing RabbitMQ transportURL -| string +| age +| Age is the DBPurgeAge parameter and indicates the number of days of purging DB records +| int | true -| serviceAccount -| ServiceAccount - service account name used internally to provide Heat services the default SA name +| schedule +| Schedule defines the crontab format string to schedule the DBPurge cronJob | string | true - -| memcachedInstance -| Memcached instance name. -| *string -| true |=== <> -[#heatapistatus] -==== HeatAPIStatus +[#manila] +==== Manila -HeatAPIStatus defines the observed state of HeatAPI +Manila is the Schema for the manilas API |=== | Field | Description | Scheme | Required -| hash -| Map of hashes to track e.g. job status -| map[string]string -| false - -| conditions -| Conditions -| condition.Conditions -| false - -| readyCount -| ReadyCount of HeatAPI instances -| int32 +| metadata +| +| metav1.ObjectMeta | false -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) -| int64 +| spec +| +| <> | false -| lastAppliedTopology -| LastAppliedTopology - the last applied Topology -| *topologyv1.TopoRef +| status +| +| <> | false |=== <> -[#heatapitemplate] -==== HeatAPITemplate - -HeatAPITemplate defines the input parameters for the Heat API service - -|=== -| Field | Description | Scheme | Required - -| containerImage -| ContainerImage - Container Image URL -| string -| true -|=== - -<> - -[#heatapitemplatecore] -==== HeatAPITemplateCore +[#maniladebug] +==== ManilaDebug -HeatAPITemplateCore - +ManilaDebug contains flags related to multiple debug activities. See the individual comments for what this means for each flag. |=== -| Field | Description | Scheme | Required - -| override -| Override, provides the ability to override the generated manifest of several child resources. -| <> -| false +| Field | Description | Scheme | Required -| tls -| TLS - Parameters related to the TLS -| tls.API -| false +| dbPurge +| DBPurge increases log verbosity by executing the db_purge command with "--debug". +| bool +| true |=== <> -[#heatcfnapi] -==== HeatCfnAPI +[#manilaextravolmounts] +==== ManilaExtraVolMounts -HeatCfnAPI ... +ManilaExtraVolMounts exposes additional parameters processed by the manila-operator and defines the common VolMounts structure provided by the main storage module |=== | Field | Description | Scheme | Required -| metadata +| name | -| metav1.ObjectMeta +| string | false -| spec +| region | -| <> +| string | false -| status +| extraVol | -| <> -| false +| []storage.VolMounts +| true |=== <> -[#heatcfnapilist] -==== HeatCfnAPIList +[#manilalist] +==== ManilaList -HeatCfnAPIList contains a list of HeatCfnAPI +ManilaList contains a list of Manila |=== | Field | Description | Scheme | Required @@ -6874,255 +11000,252 @@ HeatCfnAPIList contains a list of HeatCfnAPI | items | -| []<> +| []<> | true |=== <> -[#heatcfnapispec] -==== HeatCfnAPISpec +[#manilaspec] +==== ManilaSpec -HeatCfnAPISpec defines the desired state of HeatCfnAPI +ManilaSpec defines the desired state of Manila |=== | Field | Description | Scheme | Required -| databaseHostname -| DatabaseHostname - Heat Database Hostname -| string -| true - -| transportURLSecret -| TransportURLSecret - Secret containing RabbitMQ transportURL -| string +| manilaAPI +| ManilaAPI - Spec definition for the API service of this Manila deployment +| <> | true -| serviceAccount -| ServiceAccount - service account name used internally to provide Heat services the default SA name -| string +| manilaScheduler +| ManilaScheduler - Spec definition for the Scheduler service of this Manila deployment +| <> | true -| memcachedInstance -| Memcached instance name. -| *string -| true +| manilaShares +| ManilaShares - Map of chosen names to spec definitions for the Share(s) service(s) of this Manila deployment +| map[string]<> +| false |=== <> -[#heatcfnapistatus] -==== HeatCfnAPIStatus +[#manilaspecbase] +==== ManilaSpecBase -HeatCfnAPIStatus defines the observed state of HeatCfnAPI +ManilaSpecBase - |=== | Field | Description | Scheme | Required -| hash -| Map of hashes to track e.g. job status -| map[string]string -| false - -| conditions -| Conditions -| condition.Conditions -| false +| databaseInstance +| MariaDB instance name Right now required by the maridb-operator to get the credentials from the instance to create the DB Might not be required in future +| string +| true -| readyCount -| ReadyCount of HeatCfnAPI instances -| int32 +| rabbitMqClusterName +| RabbitMQ instance name Needed to request a transportURL that is created and used in Manila Deprecated: Use MessagingBus.Cluster instead +| string | false -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) -| int64 +| messagingBus +| MessagingBus configuration (username, vhost, and cluster) +| rabbitmqv1.RabbitMqConfig | false -| lastAppliedTopology -| LastAppliedTopology - the last applied Topology -| *topologyv1.TopoRef +| notificationsBus +| NotificationsBus configuration (username, vhost, and cluster) for notifications +| *rabbitmqv1.RabbitMqConfig | false -|=== - -<> - -[#heatcfnapitemplate] -==== HeatCfnAPITemplate -HeatCfnAPITemplate defines the input parameters for the Heat Cfn API service - -|=== -| Field | Description | Scheme | Required - -| containerImage -| ContainerImage - Container Image URL +| memcachedInstance +| Memcached instance name. | string | true -|=== - -<> -[#heatcfnapitemplatecore] -==== HeatCfnAPITemplateCore +| debug +| Debug - enable debug for different deploy stages. If an init container is used, it runs and the actual action pod gets started with sleep infinity +| <> +| false -HeatCfnAPITemplateCore - +| preserveJobs +| PreserveJobs - do not delete jobs after they finished e.g. to check logs +| bool +| true -|=== -| Field | Description | Scheme | Required +| customServiceConfig +| CustomServiceConfig - customize the service config for all Manila services using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to to /etc/++++++/++++++.conf.d directory a custom config file.++++++++++++ +| string +| true -| override -| Override, provides the ability to override the generated manifest of several child resources. -| <> +| extraMounts +| ExtraMounts containing conf files and credentials +| []<> | false -| tls -| TLS - Parameters related to the TLS -| tls.API +| nodeSelector +| NodeSelector to target subset of worker nodes running this service. Setting NodeSelector here acts as a default value and can be overridden by service specific NodeSelector Settings. +| *map[string]string | false -|=== - -<> - -[#heatengine] -==== HeatEngine -HeatEngine defined. +| dbPurge +| DBPurge parameters - +| <> +| true -|=== -| Field | Description | Scheme | Required +| apiTimeout +| APITimeout for HAProxy, Apache, and rpc_response_timeout +| int +| true -| metadata -| -| metav1.ObjectMeta +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name +| *topologyv1.TopoRef | false -| spec -| -| <> +| notificationsBusInstance +| RabbitMQ instance name used to request a transportURL that is used for notification purposes Deprecated: Use NotificationsBus.Cluster instead +| *string | false -| status -| -| <> +| auth +| Auth - Parameters related to authentication +| <> | false |=== <> -[#heatenginelist] -==== HeatEngineList +[#manilaspeccore] +==== ManilaSpecCore -HeatEngineList contains a list of HeatEngine +ManilaSpecCore defines the desired state of Manila. This version is used by OpenStackControlplane |=== | Field | Description | Scheme | Required -| metadata -| -| metav1.ListMeta -| false +| manilaAPI +| ManilaAPI - Spec definition for the API service of this Manila deployment +| <> +| true -| items -| -| []<> +| manilaScheduler +| ManilaScheduler - Spec definition for the Scheduler service of this Manila deployment +| <> | true + +| manilaShares +| ManilaShares - Map of chosen names to spec definitions for the Share(s) service(s) of this Manila deployment +| map[string]<> +| false |=== <> -[#heatenginespec] -==== HeatEngineSpec +[#manilastatus] +==== ManilaStatus -HeatEngineSpec defines the desired state of HeatEngine +ManilaStatus defines the observed state of Manila |=== | Field | Description | Scheme | Required +| hash +| Map of hashes to track e.g. job status +| map[string]string +| false + +| conditions +| Conditions +| condition.Conditions +| false + | databaseHostname -| DatabaseHostname - Heat Database Hostname +| Manila Database Hostname | string -| true +| false | transportURLSecret | TransportURLSecret - Secret containing RabbitMQ transportURL | string -| true +| false -| serviceAccount -| ServiceAccount - service account name used internally to provide Heat services the default SA name -| string -| true +| notificationsURLSecret +| NotificationsURLSecret - Secret containing RabbitMQ notificationsURL +| *string +| false -| tls -| TLS - Parameters related to the TLS -| tls.Ca +| manilaAPIReadyCount +| ReadyCount of Manila API instance +| int32 | false -| memcachedInstance -| Memcached instance name. -| *string -| true +| manilaSchedulerReadyCount +| ReadyCount of Manila Scheduler instance +| int32 +| false + +| manilaSharesReadyCounts +| ReadyCounts of Manila Share instances +| map[string]int32 +| false + +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) +| int64 +| false + +| applicationCredentialSecret +| ApplicationCredentialSecret - Secret that Manila is actively consuming (AC consumer finalizer present) +| string +| false |=== <> -[#heatenginestatus] -==== HeatEngineStatus +[#apioverridespec-2] +==== APIOverrideSpec -HeatEngineStatus defines the observed state of HeatEngine +APIOverrideSpec to override the generated manifest of several child resources. |=== | Field | Description | Scheme | Required -| hash -| Map of hashes to track e.g. job status -| map[string]string -| false - -| conditions -| Conditions -| condition.Conditions -| false - -| readyCount -| ReadyCount of HeatEngine instances -| int32 -| false - -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) -| int64 +| service +| Override configuration for the Service created to serve traffic to the cluster. The key must be the endpoint type (public, internal) +| map[service.Endpoint]service.RoutedOverrideSpec | false -| lastAppliedTopology -| LastAppliedTopology - the last applied Topology -| *topologyv1.TopoRef +| probes +| Override probes and other common fields in the StatefulSet +| probes.OverrideSpec | false |=== <> -[#heatenginetemplate] -==== HeatEngineTemplate +[#authspec-2] +==== AuthSpec -HeatEngineTemplate defines the input parameters for the Heat Engine service +AuthSpec defines authentication parameters |=== | Field | Description | Scheme | Required -| containerImage -| ContainerImage - Container Image URL +| applicationCredentialSecret +| ApplicationCredentialSecret - Secret containing Application Credential ID and Secret | string -| true +| false |=== <> -[#heat] -==== Heat +[#manilaapi] +==== ManilaAPI -Heat is the Schema for the heats API +ManilaAPI is the Schema for the manilaapis API |=== | Field | Description | Scheme | Required @@ -7134,21 +11257,21 @@ Heat is the Schema for the heats API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#heatlist] -==== HeatList +[#manilaapilist] +==== ManilaAPIList -HeatList contains a list of Heat +ManilaAPIList contains a list of ManilaAPI |=== | Field | Description | Scheme | Required @@ -7160,248 +11283,176 @@ HeatList contains a list of Heat | items | -| []<> -| true -|=== - -<> - -[#heatspec] -==== HeatSpec - -HeatSpec defines the desired state of Heat - -|=== -| Field | Description | Scheme | Required - -| heatAPI -| HeatAPI - Spec definition for the API service of this Heat deployment -| <> -| true - -| heatCfnAPI -| HeatCfnAPI - Spec definition for the CfnAPI service of this Heat deployment -| <> -| true - -| heatEngine -| HeatEngine - Spec definition for the Engine service of this Heat deployment -| <> +| []<> | true |=== <> -[#heatspecbase] -==== HeatSpecBase +[#manilaapispec] +==== ManilaAPISpec -HeatSpec defines the desired state of Heat +ManilaAPISpec defines the desired state of ManilaAPI |=== | Field | Description | Scheme | Required -| databaseInstance -| MariaDB instance name. Right now required by the maridb-operator to get the credentials from the instance to create the DB. Might not be required in future. -| string -| true - -| memcachedInstance -| Memcached instance name. +| databaseHostname +| DatabaseHostname - Manila Database Hostname | string -| true +| false -| rabbitMqClusterName -| RabbitMQ instance name Needed to request a transportURL that is created and used in Heat +| transportURLSecret +| Secret containing RabbitMq transport URL | string -| true +| false -| customServiceConfig -| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to /etc/heat/heat.conf.d directory as 01-custom.conf file. +| notificationsURLSecret +| Secret containing Notification transport URL | string | false -| customServiceConfigSecrets -| CustomServiceConfigSecrets - customize the service config using this parameter to specify Secrets that contain sensitive service config data. The content of each Secret gets added to the /etc/heat/heat.conf.d directory as a custom config file. -| []string +| extraMounts +| ExtraMounts containing conf files and credentials +| []<> | false -| preserveJobs -| PreserveJobs - do not delete jobs after they finished e.g. to check logs -| bool +| serviceAccount +| ServiceAccount - service account name used internally to provide the default SA name +| string | true -| defaultConfigOverwrite -| ConfigOverwrite - interface to overwrite default config files like e.g. policy.json. But can also be used to add additional files. Those get added to the service config dir in /etc/++++++.++++++ -| map[string]string -| false - -| nodeSelector -| NodeSelector to target subset of worker nodes for running the Heat services -| *map[string]string -| false +| memcachedInstance +| Memcached instance name. +| *string +| true | apiTimeout -| APITimeout for Route and Apache +| APITimeout for HAProxy, Apache, and rpc_response_timeout | int | true - -| topologyRef -| TopologyRef to apply the Topology defined by the associated CR referenced by name -| *topologyv1.TopoRef -| false -|=== - -<> - -[#heatspeccore] -==== HeatSpecCore - -HeatSpecCore defines the desired state of Heat, for use with OpenStackControlplane (no containerImages) - -|=== -| Field | Description | Scheme | Required - -| heatAPI -| HeatAPI - Spec definition for the API service of this Heat deployment -| <> -| true - -| heatCfnAPI -| HeatCfnAPI - Spec definition for the CfnAPI service of this Heat deployment -| <> -| true - -| heatEngine -| HeatEngine - Spec definition for the Engine service of this Heat deployment -| <> -| true |=== <> -[#heatstatus] -==== HeatStatus +[#manilaapistatus] +==== ManilaAPIStatus -HeatStatus defines the observed state of Heat +ManilaAPIStatus defines the observed state of ManilaAPI |=== | Field | Description | Scheme | Required -| conditions -| Conditions -| condition.Conditions -| false - | hash | Map of hashes to track e.g. job status | map[string]string | false -| databaseHostname -| Heat Database Hostname -| string -| false - -| transportURLSecret -| TransportURLSecret - Secret containing RabbitMQ transportURL -| string -| false - -| heatApiReadyCount -| ReadyCount of Heat API instance -| int32 +| conditions +| Conditions +| condition.Conditions | false -| heatCfnApiReadyCount -| ReadyCount of Heat CfnAPI instance +| readyCount +| ReadyCount of Manila API instances | int32 | false -| heatEngineReadyCount -| ReadyCount of Heat Engine instance -| int32 +| networkAttachments +| NetworkAttachments status of the deployment pods +| map[string][]string | false | observedGeneration | ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) | int64 | false + +| appliedInputSecretHash +| AppliedInputSecretHash - hash of input secret names last applied +| string +| false + +| lastAppliedTopology +| LastAppliedTopology - the last applied Topology +| *topologyv1.TopoRef +| false |=== <> -[#horizionoverridespec] -==== HorizionOverrideSpec +[#manilaapitemplate] +==== ManilaAPITemplate -HorizionOverrideSpec to override the generated manifest of several child resources. +ManilaAPITemplate defines the input parameter for the ManilaAPI service |=== | Field | Description | Scheme | Required -| service -| Override configuration for the Service created to serve traffic to the cluster. -| *service.RoutedOverrideSpec -| false +| containerImage +| ContainerImage - Manila API Container Image URL +| string +| true |=== <> -[#horizon] -==== Horizon +[#manilaapitemplatecore] +==== ManilaAPITemplateCore -Horizon is the Schema for the horizons API +ManilaAPITemplateCore - |=== | Field | Description | Scheme | Required -| metadata -| -| metav1.ObjectMeta -| false +| replicas +| Replicas - Manila API Replicas +| *int32 +| true -| spec -| -| <> +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> | false -| status -| -| <> +| tls +| TLS - Parameters related to the TLS +| tls.API | false |=== <> -[#horizonextravolmounts] -==== HorizonExtraVolMounts +[#manilascheduler] +==== ManilaScheduler -HorizonExtraVolMounts exposes additional parameters processed by the horizon-operator and defines the common VolMounts structure provided by the main storage module +ManilaScheduler is the Schema for the manilaschedulers API |=== | Field | Description | Scheme | Required -| name +| metadata | -| string +| metav1.ObjectMeta | false -| region +| spec | -| string +| <> | false -| extraVol +| status | -| []storage.VolMounts -| true +| <> +| false |=== <> -[#horizonlist] -==== HorizonList +[#manilaschedulerlist] +==== ManilaSchedulerList -HorizonList contains a list of Horizon +ManilaSchedulerList contains a list of ManilaScheduler |=== | Field | Description | Scheme | Required @@ -7413,108 +11464,62 @@ HorizonList contains a list of Horizon | items | -| []<> +| []<> | true |=== <> -[#horizonspec] -==== HorizonSpec +[#manilaschedulerspec] +==== ManilaSchedulerSpec -HorizonSpec defines the desired state of Horizon +ManilaSchedulerSpec defines the desired state of ManilaScheduler |=== | Field | Description | Scheme | Required -| containerImage -| horizon Container Image URL +| databaseHostname +| DatabaseHostname - manila Database Hostname | string -| true -|=== - -<> - -[#horizonspeccore] -==== HorizonSpecCore - -HorizonSpecCore - - -|=== -| Field | Description | Scheme | Required - -| nodeSelector -| NodeSelector to target subset of worker nodes running this service -| *map[string]string | false -| defaultConfigOverwrite -| ConfigOverwrite - interface to overwrite default config files like e.g. logging.conf or policy.json. But can also be used to add additional files. Those get added to the service config dir in /etc/++++++.++++++ -| map[string]string -| false - -| resources -| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ -| corev1.ResourceRequirements +| transportURLSecret +| Secret containing RabbitMq transport URL +| string | false -| override -| Override, provides the ability to override the generated manifest of several child resources. -| <> +| notificationsURLSecret +| Secret containing Notification transport URL +| string | false -| tls -| TLS - Parameters related to the TLS -| tls.SimpleService +| extraMounts +| ExtraMounts containing conf files and credentials +| []<> | false -| replicas -| Replicas of horizon API to run -| *int32 -| true - -| secret -| Secret containing OpenStack password information for Horizon Secret Key -| string -| true - -| customServiceConfig -| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to /etc/openstack-dashboard/local_settings.d directory as 9999_custom_settings.py file. +| serviceAccount +| ServiceAccount - service account name used internally to provide the default SA name | string | true | memcachedInstance | Memcached instance name. -| string -| true - -| preserveJobs -| PreserveJobs - do not delete jobs after they finished e.g. to check logs -| bool +| *string | true -| extraMounts -| ExtraMounts containing conf files -| []<> -| false - -| networkAttachments -| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network -| []string -| false - -| topologyRef -| TopologyRef to apply the Topology defined by the associated CR referenced by name -| *topologyv1.TopoRef +| tls +| TLS - Parameters related to the TLS +| tls.Ca | false |=== <> -[#horizonstatus] -==== HorizonStatus +[#manilaschedulerstatus] +==== ManilaSchedulerStatus -HorizonStatus defines the observed state of Horizon +ManilaSchedulerStatus defines the observed state of ManilaScheduler |=== | Field | Description | Scheme | Required @@ -7524,137 +11529,96 @@ HorizonStatus defines the observed state of Horizon | map[string]string | false -| endpoint -| Endpoint url to access OpenStack Dashboard -| string -| false - | conditions | Conditions | condition.Conditions | false | readyCount -| ReadyCount of Horizon instances +| ReadyCount of Manila Scheduler instances | int32 | false -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) -| int64 -| false - | networkAttachments | NetworkAttachments status of the deployment pods | map[string][]string | false -| lastAppliedTopology -| LastAppliedTopology - the last applied Topology -| *topologyv1.TopoRef -| false -|=== - -<> - -[#ironicservicetemplate] -==== IronicServiceTemplate - -IronicServiceTemplate defines the common input parameters for Ironic services - -|=== -| Field | Description | Scheme | Required - -| replicas -| Replicas - -| *int32 -| true - -| nodeSelector -| NodeSelector to target subset of worker nodes running this service. Setting here overrides any global NodeSelector settings within the Ironic CR -| *map[string]string -| false - -| resources -| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ -| corev1.ResourceRequirements +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) +| int64 | false -| customServiceConfig -| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ +| appliedInputSecretHash +| AppliedInputSecretHash - hash of input secret names last applied | string -| true - -| defaultConfigOverwrite -| ConfigOverwrite - interface to overwrite default config files like e.g. policy.json. But can also be used to add additional files. Those get added to the service config dir in /etc/++++++.++++++ -| map[string]string | false -| topologyRef -| TopologyRef to apply the Topology defined by the associated CR referenced by name +| lastAppliedTopology +| LastAppliedTopology - the last applied Topology | *topologyv1.TopoRef | false |=== <> -[#keystoneendpoints] -==== KeystoneEndpoints +[#manilaschedulertemplate] +==== ManilaSchedulerTemplate -KeystoneEndpoints defines keystone endpoint parameters for service +ManilaSchedulerTemplate defines the input parameter for the ManilaScheduler service |=== | Field | Description | Scheme | Required -| internal -| Internal endpoint URL -| string -| true - -| public -| Public endpoint URL +| containerImage +| ContainerImage - Manila API Container Image URL | string | true |=== <> -[#passwordselector-2] -==== PasswordSelector +[#manilaschedulertemplatecore] +==== ManilaSchedulerTemplateCore -PasswordSelector to identify the AdminUser password from the Secret +ManilaSchedulerTemplateCore - |=== | Field | Description | Scheme | Required -| service -| Service - Selector to get the ironic service password from the Secret -| string +| replicas +| Replicas - Manila API Replicas +| *int32 | true + +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> +| false |=== <> -[#apioverridespec-2] -==== APIOverrideSpec +[#scheduleroverridespec-2] +==== SchedulerOverrideSpec -APIOverrideSpec to override the generated manifest of several child resources. +SchedulerOverrideSpec to override the generated manifest of several child resources. |=== | Field | Description | Scheme | Required -| service -| Override configuration for the Service created to serve traffic to the cluster. The key must be the endpoint type (public, internal) -| map[service.Endpoint]service.RoutedOverrideSpec +| probes +| Override probes and other common fields in the StatefulSet +| probes.OverrideSpec | false |=== <> -[#ironicapi] -==== IronicAPI +[#manilashare] +==== ManilaShare -IronicAPI is the Schema for the ironicapis API +ManilaShare is the Schema for the manilashares API |=== | Field | Description | Scheme | Required @@ -7666,21 +11630,21 @@ IronicAPI is the Schema for the ironicapis API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#ironicapilist] -==== IronicAPIList +[#manilasharelist] +==== ManilaShareList -IronicAPIList contains a list of IronicAPI +ManilaShareList contains a list of ManilaShare |=== | Field | Description | Scheme | Required @@ -7692,82 +11656,62 @@ IronicAPIList contains a list of IronicAPI | items | -| []<> +| []<> | true |=== <> -[#ironicapispec] -==== IronicAPISpec - -IronicAPISpec defines the desired state of IronicAPI - -|=== -| Field | Description | Scheme | Required - -| containerImage -| ContainerImage - Ironic API Container Image -| string -| true - -| standalone -| Whether to deploy a standalone Ironic. -| bool -| true - -| serviceUser -| ServiceUser - optional username used for this service to register in ironic -| string -| true - -| secret -| Secret containing OpenStack password information for AdminPassword -| string -| false +[#manilasharespec] +==== ManilaShareSpec -| passwordSelectors -| PasswordSelectors - Selectors to identify the DB and ServiceUser password from the Secret -| <> -| true +ManilaShareSpec defines the desired state of ManilaShare -| databaseHostname -| DatabaseHostname - Ironic Database Hostname -| string -| true +|=== +| Field | Description | Scheme | Required -| databaseAccount -| DatabaseAccount - optional MariaDBAccount used for ironic DB, defaults to ironic. +| databaseHostname +| DatabaseHostname - manila Database Hostname | string -| true +| false | transportURLSecret | Secret containing RabbitMq transport URL | string | false -| rpcTransport -| RPC transport type - Which RPC transport implementation to use between conductor and API services. 'oslo' to use oslo.messaging transport or 'json-rpc' to use JSON RPC transport. NOTE \-> ironic requires oslo.messaging transport when not in standalone mode. +| notificationsURLSecret +| Secret containing Notification transport URL | string -| true +| false -| keystoneEndpoints -| KeystoneEndpoints - Internally used Keystone API endpoints -| <> +| extraMounts +| ExtraMounts containing conf files and credentials +| []<> +| false + +| serviceAccount +| ServiceAccount - service account name used internally to provide the default SA name +| string | true -| apiTimeout -| APITimeout for HAProxy, Apache -| int +| memcachedInstance +| Memcached instance name. +| *string | true + +| tls +| TLS - Parameters related to the TLS +| tls.Ca +| false |=== <> -[#ironicapistatus] -==== IronicAPIStatus +[#manilasharestatus] +==== ManilaShareStatus -IronicAPIStatus defines the observed state of IronicAPI +ManilaShareStatus defines the observed state of ManilaShare |=== | Field | Description | Scheme | Required @@ -7777,18 +11721,13 @@ IronicAPIStatus defines the observed state of IronicAPI | map[string]string | false -| apiEndpoints -| API endpoint -| map[string]map[string]string -| false - | conditions | Conditions | condition.Conditions | false | readyCount -| ReadyCount of ironic API instances +| ReadyCount of ManilaShare instances | int32 | false @@ -7798,10 +11737,15 @@ IronicAPIStatus defines the observed state of IronicAPI | false | observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) | int64 | false +| appliedInputSecretHash +| AppliedInputSecretHash - hash of input secret names last applied +| string +| false + | lastAppliedTopology | LastAppliedTopology - the last applied Topology | *topologyv1.TopoRef @@ -7810,36 +11754,63 @@ IronicAPIStatus defines the observed state of IronicAPI <> -[#ironicapitemplate] -==== IronicAPITemplate +[#manilasharetemplate] +==== ManilaShareTemplate -IronicAPITemplate defines the input parameters for Ironic API service +ManilaShareTemplate defines the input parameter for the ManilaShare service |=== | Field | Description | Scheme | Required -| networkAttachments -| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network -| []string -| false +| containerImage +| ContainerImage - Manila API Container Image URL +| string +| true +|=== + +<> + +[#manilasharetemplatecore] +==== ManilaShareTemplateCore + +ManilaShareTemplateCore - + +|=== +| Field | Description | Scheme | Required + +| replicas +| Replicas - Manila API Replicas +| *int32 +| true | override | Override, provides the ability to override the generated manifest of several child resources. -| <> +| <> | false +|=== -| tls -| TLS - Parameters related to the TLS -| tls.API +<> + +[#shareoverridespec] +==== ShareOverrideSpec + +ShareOverrideSpec to override the generated manifest of several child resources. + +|=== +| Field | Description | Scheme | Required + +| probes +| Override probes and other common fields in the StatefulSet +| probes.OverrideSpec | false |=== <> -[#ironicconductor] -==== IronicConductor +[#galera] +==== Galera -IronicConductor is the Schema for the ironicconductors Conductor +Galera is the Schema for the galeras API |=== | Field | Description | Scheme | Required @@ -7851,21 +11822,62 @@ IronicConductor is the Schema for the ironicconductors Conductor | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#ironicconductorlist] -==== IronicConductorList +[#galeraattributes] +==== GaleraAttributes -IronicConductorList contains a list of IronicConductor +GaleraAttributes holds startup information for a Galera host. This struct is read-only from the operator's perspective -- all fields are pushed by the galera pods via the report_local_galera_state script. The operator must not write to these fields to avoid a concurrency race with the deferred status merge patch. + +|=== +| Field | Description | Scheme | Required + +| uuid +| UUID of the partition that is seen by the galera node +| string +| false + +| seqno +| Last recorded replication sequence number in the DB +| string +| true + +| safe_to_bootstrap +| This galera node can bootstrap a galera cluster +| bool +| false + +| no_grastate +| This galera node has its state recovered from the DB +| bool +| false + +| gcomm +| Gcomm URI used to connect to the galera cluster +| string +| false + +| containerID +| Identifier of the container at the time the gcomm URI was injected +| string +| false +|=== + +<> + +[#galeralist] +==== GaleraList + +GaleraList contains a list of Galera |=== | Field | Description | Scheme | Required @@ -7877,205 +11889,195 @@ IronicConductorList contains a list of IronicConductor | items | -| []<> +| []<> | true |=== <> -[#ironicconductorspec] -==== IronicConductorSpec +[#galeraoverridespec] +==== GaleraOverrideSpec -IronicConductorSpec defines the desired state of IronicConductor +GaleraOverrideSpec to override the generated manifest of several child resources |=== | Field | Description | Scheme | Required -| containerImage -| ContainerImage - Ironic Conductor Container Image -| string -| true +| probes +| Override probes and other common fields in the StatefulSet +| probes.OverrideSpec +| false +|=== -| standalone -| Whether to deploy a standalone Ironic. -| bool -| true +<> -| pxeContainerImage -| PxeContainerImage - Ironic DHCP/TFTP/HTTP Container Image -| string -| true +[#galeraspec] +==== GaleraSpec -| ironicPythonAgentImage -| IronicPythonAgentImage - Image containing the ironic-python-agent kernel and ramdisk -| string -| true +GaleraSpec defines the desired state of Galera -| serviceUser -| ServiceUser - optional username used for this service to register in ironic -| string -| true +|=== +| Field | Description | Scheme | Required -| secret -| Secret containing OpenStack password information for AdminPassword +| containerImage +| Name of the galera container image to run (will be set to environmental default if empty) | string -| false - -| passwordSelectors -| PasswordSelectors - Selectors to identify the ServiceUser password from the Secret -| <> | true +|=== -| databaseHostname -| DatabaseHostname - Ironic Database Hostname -| string -| true +<> -| databaseAccount -| DatabaseAccount - optional MariaDBAccount used for ironic DB, defaults to ironic. -| string -| true +[#galeraspeccore] +==== GaleraSpecCore -| transportURLSecret -| TransportURLSecret - Secret containing RabbitMQ transportURL -| string -| false +GaleraSpec defines the desired state of Galera -| rpcTransport -| RPC transport type - Which RPC transport implementation to use between conductor and API services. 'oslo' to use oslo.messaging transport or 'json-rpc' to use JSON RPC transport. NOTE \-> ironic requires oslo.messaging transport when not in standalone mode. -| string -| true +|=== +| Field | Description | Scheme | Required -| keystoneEndpoints -| KeystoneEndpoints - Internally used Keystone API endpoints -| <> +| secret +| Name of the legacy secret to locate the initial galera root password this field will be removed once scripts can adjust to using root_auth.sh +| string | true -| tls -| TLS - Parameters related to the TLS -| tls.Ca -| false - -| graphicalConsoles -| Whether to enable graphical consoles. NOTE: Setting this to Enabled is not supported. +| rootDatabaseAccount +| RootDatabaseAccount - name of MariaDBAccount which will be used to generate root account / password. this account is generated if not exists, and a name is chosen based on a naming convention if not present. See Galera\->Status\->RootDatabaseAccount for the actual name in use regardless of whether this field is set | string | true -| novncproxyImage -| NoVNCProxyImage - Ironic NoVNCProxy Container Image +| storageClass +| Storage class to host the mariadb databases | string -| false +| true -| consoleImage -| ConsoleImage - Ironic Graphical Console Container Image +| storageRequest +| Storage size allocated for the mariadb databases | string | true -|=== -<> - -[#ironicconductorstatus] -==== IronicConductorStatus +| replicas +| Size of the galera cluster deployment +| *int32 +| true -IronicConductorStatus defines the observed state of IronicConductor +| nodeSelector +| NodeSelector to target subset of worker nodes running this service +| *map[string]string +| false -|=== -| Field | Description | Scheme | Required +| customServiceConfig +| Customize config using this parameter to change service defaults, or overwrite rendered information using raw MariaDB config format. The content gets added to /etc/my.cnf.d/zzz_galera_custom.cnf. The zzz_ prefix is to ensure that this file is loaded last so that any customizations occur after all other configuration is applied. +| string +| false -| hash -| Map of hashes to track e.g. job status -| map[string]string +| tls +| TLS settings for MySQL service and internal Galera replication +| tls.SimpleService | false -| conditions -| Conditions -| condition.Conditions +| disableNonTLSListeners +| When TLS is configured, only allow connections to the DB over TLS +| bool | false -| readyCount -| ReadyCount of ironic Conductor instances -| int32 +| logToDisk +| Log Galera pod's output to disk +| bool +| true + +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name +| *topologyv1.TopoRef | false -| networkAttachments -| NetworkAttachments status of the deployment pods -| map[string][]string +| resources +| Resources QoS configuration for pods +| corev1.ResourceRequirements | false -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) -| int64 +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> | false -| lastAppliedTopology -| LastAppliedTopology - the last applied Topology -| *topologyv1.TopoRef +| targetVersion +| TargetVersion is the MariaDB major.minor version that the cluster should run after an upgrade (e.g. "10.11"). When set and different from the version recorded in the existing data files, the operator performs a full cluster stop and runs mariadb-upgrade on each node before restarting. Leave empty when no version upgrade is in progress. +| string | false |=== <> -[#ironicconductortemplate] -==== IronicConductorTemplate +[#galerastatus] +==== GaleraStatus -IronicConductorTemplate defines the input parameters for Ironic Conductor service +GaleraStatus defines the observed state of Galera |=== | Field | Description | Scheme | Required -| conductorGroup -| ConductorGroup - Ironic Conductor conductor group. +| attributes +| A map of database node attributes for each pod +| map[string]<> +| false + +| rootDatabaseAccount +| RootDatabaseAccount - name of MariaDBAccount being used to maintain the RootDatabaseSecret. | string | true -| storageClass -| StorageClass +| rootDatabaseSecret +| name of the Secret that is being used for the root password | string | true -| storageRequest -| StorageRequest +| safeToBootstrap +| Name of the node that can safely bootstrap a cluster | string +| false + +| bootstrapped +| Is the galera cluster currently running +| bool | true -| networkAttachments -| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network -| []string -| false +| stopRequired +| Does the galera cluster requires to be stopped globally +| bool +| true -| provisionNetwork -| ProvisionNetwork - Additional network to attach to expose boot DHCP, TFTP, HTTP services. -| string +| clusterProperties +| Map of properties that require full cluster restart if changed +| map[string]string | false -| dhcpRanges -| DHCPRanges - List of DHCP ranges to use for provisioning -| []<> +| hash +| Map of hashes to track input changes +| map[string]string | false -|=== - -<> -[#inspectoroverridespec] -==== InspectorOverrideSpec - -InspectorOverrideSpec to override the generated manifest of several child resources. +| conditions +| Deployment Conditions +| condition.Conditions +| false -|=== -| Field | Description | Scheme | Required +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) +| int64 +| false -| service -| Override configuration for the Service created to serve traffic to the cluster. The key must be the endpoint type (public, internal) -| map[service.Endpoint]service.RoutedOverrideSpec +| lastAppliedTopology +| LastAppliedTopology - the last applied Topology +| *topologyv1.TopoRef | false |=== <> -[#ironicinspector] -==== IronicInspector +[#galerabackup] +==== GaleraBackup -IronicInspector is the Schema for the IronicInspector +GaleraBackup is the Schema for the galerabackups API |=== | Field | Description | Scheme | Required @@ -8087,21 +12089,21 @@ IronicInspector is the Schema for the IronicInspector | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#ironicinspectorlist] -==== IronicInspectorList +[#galerabackuplist] +==== GaleraBackupList -IronicInspectorList contains a list of IronicInspector +GaleraBackupList contains a list of GaleraBackup |=== | Field | Description | Scheme | Required @@ -8113,235 +12115,191 @@ IronicInspectorList contains a list of IronicInspector | items | -| []<> -| true -|=== - -<> - -[#ironicinspectorpasswordselector] -==== IronicInspectorPasswordSelector - -IronicInspectorPasswordSelector to identify the AdminUser password from the Secret - -|=== -| Field | Description | Scheme | Required - -| service -| Service - Selector to get the ironic-inspector service password from the Secret -| string +| []<> | true |=== <> -[#ironicinspectorspec] -==== IronicInspectorSpec +[#galerabackupspec] +==== GaleraBackupSpec -IronicInspectorSpec defines the desired state of IronicInspector +GaleraBackupSpec defines the desired state of GaleraBackup |=== | Field | Description | Scheme | Required -| standalone -| Standalone - Whether to deploy a standalone Ironic Inspector. -| bool -| true - -| containerImage -| ContainerImage - Ironic Inspector Container Image -| string -| true - -| pxeContainerImage -| PxeContainerImage - Ironic Inspector DHCP/TFTP/HTTP Container Image -| string -| true - -| ironicPythonAgentImage -| IronicPythonAgentImage - Image containing the ironic-python-agent kernel and ramdisk -| string -| true - | databaseInstance -| MariaDB instance name. Right now required by the maridb-operator to get the credentials from the instance to create the DB. Might not be required in future. +| Galera cluster to backup | string -| true +| false -| secret -| Secret containing OpenStack password information for AdminPassword +| storageClass +| Storage volume for backup data | string | false -| rabbitMqClusterName -| RabbitMQ instance name Needed to request a transportURL that is created and used in Ironic Inspector +| storageRequest +| Storage Request for backup data | string -| true +| false -| rpcTransport -| RPC transport type - Which RPC transport implementation to use between conductor and API services. 'oslo' to use oslo.messaging transport or 'json-rpc' to use JSON RPC transport. NOTE \-> ironic-inspector requires oslo.messaging transport when not in standalone mode. +| transferStorage +| Configuration of storage used for intermediate data transfer +| *<> +| false + +| schedule +| The schedule in Cron format | string | true -| apiTimeout -| APITimeout for HAProxy, Apache -| int -| true +| retention +| Time duration after which old backups must be reclaimed on disk +| *metav1.Duration +| false |=== <> -[#ironicinspectorstatus] -==== IronicInspectorStatus +[#galerabackupstatus] +==== GaleraBackupStatus -IronicInspectorStatus defines the observed state of IronicInspector +GaleraBackupStatus defines the observed state of GaleraBackup |=== | Field | Description | Scheme | Required | hash -| Map of hashes to track e.g. job status +| Map of hashes to track input changes | map[string]string | false -| apiEndpoints -| API endpoint -| map[string]map[string]string -| false - | conditions -| Conditions +| Deployment Conditions | condition.Conditions | false -| databaseHostname -| IronicInspector Database Hostname -| string +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) +| int64 | false +|=== -| readyCount -| ReadyCount of Ironic Inspector instances -| int32 -| false +<> -| transportURLSecret -| TransportURLSecret - Secret containing RabbitMQ transportURL +[#galerabackuptransferstoragespec] +==== GaleraBackupTransferStorageSpec + +|=== +| Field | Description | Scheme | Required + +| storageClass +| Storage volume for backup data | string | false -| networkAttachments -| NetworkAttachments status of the deployment pods -| map[string][]string +| storageRequest +| Storage Request for backup data +| string +| true +|=== + +<> + +[#galerarestore] +==== GaleraRestore + +GaleraRestore is the Schema for the galerabackups API + +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ObjectMeta | false -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) -| int64 +| spec +| +| <> | false -| lastAppliedTopology -| LastAppliedTopology - the last applied Topology -| *topologyv1.TopoRef +| status +| +| <> | false |=== <> -[#ironicinspectortemplate] -==== IronicInspectorTemplate +[#galerarestorelist] +==== GaleraRestoreList -IronicInspectorTemplate defines the input parameters for Ironic Inspector service +GaleraRestoreList contains a list of GaleraRestore |=== | Field | Description | Scheme | Required -| serviceUser -| ServiceUser - optional username used for this service to register in ironic-inspector -| string -| true +| metadata +| +| metav1.ListMeta +| false -| replicas -| Replicas - Ironic Inspector Replicas -| *int32 +| items +| +| []<> | true +|=== -| databaseAccount -| DatabaseAccount - optional MariaDBAccount used for ironic DB, defaults to ironic-inspector. this is separate from the account used for ironic, as a MariaDBAccount can only refer to a single MariaDBDatabase and it appears that ironic inspector uses its own MariaDBDatabase. -| string -| true +<> -| passwordSelectors -| PasswordSelectors - Selectors to identify the ServiceUser password from the Secret -| <> -| true +[#galerarestorespec] +==== GaleraRestoreSpec -| nodeSelector -| NodeSelector to target subset of worker nodes running this service. Setting here overrides any global NodeSelector settings within the Ironic CR -| *map[string]string -| false +GaleraRestoreSpec defines the desired state of GaleraBackup -| preserveJobs -| PreserveJobs - do not delete jobs after they finished e.g. to check logs -| bool -| true +|=== +| Field | Description | Scheme | Required -| customServiceConfig -| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ +| backupSource +| Galera backup to restore into its associated Galera CR | string -| true - -| defaultConfigOverwrite -| ConfigOverwrite - interface to overwrite default config files like e.g. policy.json. But can also be used to add additional files. Those get added to the service config dir in /etc/++++++.++++++ -| map[string]string -| false - -| resources -| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ -| corev1.ResourceRequirements | false +|=== -| storageClass -| StorageClass -| string -| false +<> -| networkAttachments -| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network -| []string -| false +[#galerarestorestatus] +==== GaleraRestoreStatus -| inspectionNetwork -| InspectionNetwork - Additional network to attach to expose boot DHCP, TFTP, HTTP services. -| string -| false +GaleraRestoreStatus defines the observed state of GaleraRestore -| dhcpRanges -| DHCPRanges - List of DHCP ranges to use for provisioning -| []<> -| false +|=== +| Field | Description | Scheme | Required -| override -| Override, provides the ability to override the generated manifest of several child resources. -| <> +| hash +| Map of hashes to track input changes +| map[string]string | false -| tls -| TLS - Parameters related to the TLS -| tls.API +| conditions +| Deployment Conditions +| condition.Conditions | false -| topologyRef -| TopologyRef to apply the Topology defined by the associated CR referenced by name -| *topologyv1.TopoRef +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) +| int64 | false |=== <> -[#ironicneutronagent] -==== IronicNeutronAgent +[#mariadbaccount] +==== MariaDBAccount -IronicNeutronAgent is the Schema for the ML2 baremetal - ironic-neutron-agent agents +MariaDBAccount is the Schema for the mariadbaccounts API |=== | Field | Description | Scheme | Required @@ -8353,21 +12311,21 @@ IronicNeutronAgent is the Schema for the ML2 baremetal - ironic-neutron-agent ag | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#ironicneutronagentlist] -==== IronicNeutronAgentList +[#mariadbaccountlist] +==== MariaDBAccountList -IronicNeutronAgentList contains a list of IronicConductor +MariaDBAccountList contains a list of MariaDBAccount |=== | Field | Description | Scheme | Required @@ -8379,232 +12337,240 @@ IronicNeutronAgentList contains a list of IronicConductor | items | -| []<> +| []<> | true |=== <> -[#ironicneutronagentspec] -==== IronicNeutronAgentSpec +[#mariadbaccountspec] +==== MariaDBAccountSpec -IronicNeutronAgentSpec defines the desired state of ML2 baremetal - ironic-neutron-agent agents +MariaDBAccountSpec defines the desired state of MariaDBAccount |=== | Field | Description | Scheme | Required -| containerImage -| ContainerImage - ML2 baremtal - Ironic Neutron Agent Image -| string -| true - -| serviceUser -| ServiceUser - optional username used for this service to register in ironic +| userName +| UserName for new account | string | true | secret -| Secret containing OpenStack password information for IronicPassword +| Name of secret which contains DatabasePassword | string -| false +| true -| passwordSelectors -| PasswordSelectors - Selectors to identify the ServiceUser password from the Secret -| <> +| requireTLS +| Account must use TLS to connect to the database +| bool | true -| tls -| TLS - Parameters related to the TLS -| tls.Ca +| accountType +| +| AccountType | false |=== <> -[#ironicneutronagentstatus] -==== IronicNeutronAgentStatus +[#mariadbaccountstatus] +==== MariaDBAccountStatus -IronicNeutronAgentStatus defines the observed state of ML2 baremetal - ironic-neutron-agent +MariaDBAccountStatus defines the observed state of MariaDBAccount |=== | Field | Description | Scheme | Required -| hash -| Map of hashes to track e.g. job status -| map[string]string +| currentSecret +| the Secret that's currently in use for the account. keeping a handle to this secret allows us to remove its finalizer when it's replaced with a new one. It also is useful for storing the current "root" secret separate from a newly proposed one which is needed when changing the database root password. +| string | false | conditions -| Conditions +| Deployment Conditions | condition.Conditions | false -| readyCount -| ReadyCount of ironic Conductor instances -| int32 +| hash +| Map of hashes to track e.g. job status +| map[string]string | false +|=== -| transportURLSecret -| TransportURLSecret - Secret containing RabbitMQ transportURL -| string +<> + +[#mariadbdatabase] +==== MariaDBDatabase + +MariaDBDatabase is the Schema for the mariadbdatabases API + +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ObjectMeta | false -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) -| int64 +| spec +| +| <> | false -| lastAppliedTopology -| LastAppliedTopology - the last applied Topology -| *topologyv1.TopoRef +| status +| +| <> | false |=== <> -[#ironicneutronagenttemplate] -==== IronicNeutronAgentTemplate +[#mariadbdatabaselist] +==== MariaDBDatabaseList -IronicNeutronAgentTemplate defines the input parameters for ML2 baremetal - ironic-neutron-agent agents +MariaDBDatabaseList contains a list of MariaDBDatabase |=== | Field | Description | Scheme | Required -| rabbitMqClusterName -| RabbitMQ instance name Needed to request a transportURL that is created and used in Ironic -| string +| metadata +| +| metav1.ListMeta +| false + +| items +| +| []<> | true |=== <> -[#dhcprange] -==== DHCPRange +[#mariadbdatabasespec] +==== MariaDBDatabaseSpec -DHCPRange to define address range for DHCP requests +MariaDBDatabaseSpec defines the desired state of MariaDBDatabase |=== | Field | Description | Scheme | Required +| secret +| Name of secret which contains DatabasePassword (deprecated) +| *string +| false + | name -| Name - Name of the DHCPRange (used for tagging in dnsmasq) +| Name of the database in MariaDB | string | false -| cidr -| Cidr - IP address prefix (CIDR) representing an IP network. +| defaultCharacterSet +| Default character set for this database | string -| true +| false -| start -| Start - Start of DHCP range +| defaultCollation +| Default collation for this database | string -| true +| false +|=== -| end -| End - End of DHCP range -| string -| true +<> -| gateway -| Gateway - IP address for the router -| string +[#mariadbdatabasestatus] +==== MariaDBDatabaseStatus + +MariaDBDatabaseStatus defines the observed state of MariaDBDatabase + +|=== +| Field | Description | Scheme | Required + +| conditions +| Deployment Conditions +| condition.Conditions +| false + +| completed +| +| bool | false -| mtu -| MTU - Maximum Transmission Unit -| int +| hash +| Map of hashes to track e.g. job status +| map[string]string | false -| podIndex -| PodIndex - Maps the DHCPRange to a specific statefulset pod index -| int +| tlsSupport +| Whether TLS is supported by the DB instance +| bool | false |=== <> -[#ironic] -==== Ironic +[#apioverridespec-2] +==== APIOverrideSpec -Ironic is the Schema for the ironics API +APIOverrideSpec to override the generated manifest of several child resources. |=== | Field | Description | Scheme | Required -| metadata -| -| metav1.ObjectMeta -| false - -| spec -| -| <> -| false - -| status -| -| <> +| service +| Override configuration for the Service created to serve traffic to the cluster. The key must be the endpoint type (public, internal) +| map[service.Endpoint]service.RoutedOverrideSpec | false |=== <> -[#ironicimages] -==== IronicImages +[#authspec-2] +==== AuthSpec -IronicImages to specify container images required by all ironic services +AuthSpec defines authentication parameters |=== | Field | Description | Scheme | Required -| api -| API - Ironic API Container Image (will be set to environmental default if empty) +| applicationCredentialSecret +| ApplicationCredentialSecret - Secret containing Application Credential ID and Secret | string -| true +| false +|=== -| conductor -| Conductor - Ironic Conductor Container Image (will be set to environmental default if empty) -| string -| true +<> -| inspector -| Inspector - Ironic Inspector Container Image (will be set to environmental default if empty) -| string -| true +[#neutronapi] +==== NeutronAPI -| neutronAgent -| NeutronAgent - ML2 baremtal - Ironic Neutron Agent Image (will be set to environmental default if empty) -| string -| true +NeutronAPI is the Schema for the neutronapis API -| pxe -| Pxe- Ironic DHCP/TFTP/HTTP Container Image URL (will be set to environmental default if empty) -| string -| true +|=== +| Field | Description | Scheme | Required -| ironicPythonAgent -| IronicPythonAgent - Image containing the ironic-python-agent kernel and ramdisk -| string -| true +| metadata +| +| metav1.ObjectMeta +| false -| novncproxy -| NoVNCProxy - Ironic NoVNCProxy Container Image (will be set to environmental default if empty) -| string +| spec +| +| <> | false -| graphicalConsole -| GraphicalConsole - Ironic Graphical Console Container Image (will be set to environmental default if empty) -| string +| status +| +| <> | false |=== <> -[#ironiclist] -==== IronicList +[#neutronapilist] +==== NeutronAPIList -IronicList contains a list of Ironic +NeutronAPIList contains a list of NeutronAPI |=== | Field | Description | Scheme | Required @@ -8616,185 +12582,190 @@ IronicList contains a list of Ironic | items | -| []<> +| []<> | true |=== <> -[#ironicspec] -==== IronicSpec +[#neutronapispec] +==== NeutronAPISpec -IronicSpec defines the desired state of Ironic +NeutronAPISpec defines the desired state of NeutronAPI |=== | Field | Description | Scheme | Required -| images -| Images - Container images for all ironic services -| <> +| containerImage +| NeutronAPI Container Image URL (will be set to environmental default if empty) +| string | true |=== <> -[#ironicspeccore] -==== IronicSpecCore +[#neutronapispeccore] +==== NeutronAPISpecCore -IronicSpec defines the desired state of Ironic +NeutronAPISpecCore - |=== | Field | Description | Scheme | Required -| standalone -| Whether to deploy a standalone Ironic. -| bool +| apiTimeout +| APITimeout for HAProxy, Apache +| int | true | serviceUser -| ServiceUser - optional username used for this service to register in ironic +| ServiceUser - optional username used for this service to register in neutron | string | true | databaseInstance -| MariaDB instance name. Right now required by the maridb-operator to get the credentials from the instance to create the DB. Might not be required in future. +| MariaDB instance name Right now required by the maridb-operator to get the credentials from the instance to create the DB Might not be required in future | string | true | databaseAccount -| DatabaseAccount - optional MariaDBAccount used for ironic DB, defaults to ironic. +| DatabaseAccount - optional MariaDBAccount CR name used for neutron DB, defaults to neutron +| string +| true + +| rabbitMqClusterName +| RabbitMQ instance name Needed to request a transportURL that is created and used in Neutron Deprecated: Use MessagingBus.Cluster instead +| string +| false + +| messagingBus +| MessagingBus configuration (username, vhost, and cluster) +| rabbitmqv1.RabbitMqConfig +| false + +| notificationsBus +| NotificationsBus configuration (username, vhost, and cluster) for notifications +| *rabbitmqv1.RabbitMqConfig +| false + +| memcachedInstance +| Memcached instance name. | string | true +| replicas +| Replicas of neutron API to run +| *int32 +| true + | secret -| Secret containing OpenStack password information for ironic IronicPassword +| Secret containing OpenStack password information for NeutronPassword | string | true | passwordSelectors -| PasswordSelectors - Selectors to identify the DB and ServiceUser password from the Secret +| PasswordSelectors - Selectors to identify the ServiceUser password from the Secret | <> | true +| nodeSelector +| NodeSelector to target subset of worker nodes running this service +| *map[string]string +| false + | preserveJobs | PreserveJobs - do not delete jobs after they finished e.g. to check logs | bool | true -| customServiceConfig -| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ +| corePlugin +| CorePlugin - Neutron core plugin to use. Using "ml2" if not set. | string | true +| ml2MechanismDrivers +| Ml2MechanismDrivers - list of ml2 drivers to enable. Using {"ovn"} if not set. +| []string +| true + +| customServiceConfig +| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ +| string +| false + | defaultConfigOverwrite -| ConfigOverwrite - interface to overwrite default config files like e.g. policy.json. But can also be used to add additional files. Those get added to the service config dir in /etc/++++++.++++++ +| DefaultConfigOverwrite - interface to overwrite default config files like policy.yaml | map[string]string | false -| ironicAPI -| IronicAPI - Spec definition for the API service of this Ironic deployment -| <> -| true - -| ironicConductors -| IronicConductors - Spec definitions for the conductor service of this Ironic deployment -| []<> +| resources +| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ +| corev1.ResourceRequirements | false -| ironicInspector -| IronicInspector - Spec definition for the inspector service of this Ironic deployment -| <> -| true - -| ironicNeutronAgent -| IronicNeutronAgent - Spec definition for the ML2 baremetal ironic-neutron-agent service of this Ironic deployment -| <> -| true +| networkAttachments +| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network +| []string +| false -| rabbitMqClusterName -| RabbitMQ instance name Needed to request a transportURL that is created and used in Ironic -| string -| true +| extraMounts +| ExtraMounts containing conf files +| []<> +| false -| rpcTransport -| RPC transport type - Which RPC transport implementation to use between conductor and API services. 'oslo' to use oslo.messaging transport or 'json-rpc' to use JSON RPC transport. NOTE \-> ironic and ironic-inspector require oslo.messaging transport when not in standalone mode. -| string -| true +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> +| false -| nodeSelector -| NodeSelector to target subset of worker nodes running this service. Setting NodeSelector here acts as a default value and can be overridden by service specific NodeSelector Settings. -| *map[string]string +| tls +| TLS - Parameters related to the TLS +| <> | false -| storageClass -| Storage class to host data. This is passed to IronicConductors unless storageClass is explicitly set for the conductor. -| string -| true +| auth +| Auth - Parameters related to authentication +| <> +| false | topologyRef | TopologyRef to apply the Topology defined by the associated CR referenced by name | *topologyv1.TopoRef | false -| apiTimeout -| APITimeout for HAProxy, Apache -| int -| true - -| graphicalConsoles -| Whether to enable graphical consoles. NOTE: Setting this to Enabled is not supported. -| string -| true +| notificationsBusInstance +| NotificationsBusInstance is the name of the RabbitMqCluster CR to select the Message Bus Service instance used by the neutron to publish external notifications. If undefined, the value will be inherited from OpenStackControlPlane. An empty value "" leaves the notification drivers unconfigured and emitting no notifications at all. Avoid colocating it with RabbitMqClusterName used for RPC. +| *string +| false |=== <> -[#ironicstatus] -==== IronicStatus +[#neutronapistatus] +==== NeutronAPIStatus -IronicStatus defines the observed state of Ironic +NeutronAPIStatus defines the observed state of NeutronAPI |=== | Field | Description | Scheme | Required - -| hash -| Map of hashes to track e.g. job status -| map[string]string -| false - -| conditions -| Conditions -| condition.Conditions -| false - -| databaseHostname -| Ironic Database Hostname -| string -| false - -| apiEndpoints -| API endpoint -| map[string]map[string]string -| false - -| ironicAPIReadyCount -| ReadyCount of Ironic API instance + +| readyCount +| ReadyCount of neutron API instances | int32 | false -| ironicConductorReadyCount -| ReadyCount of Ironic Conductor instance -| map[string]int32 +| hash +| Map of hashes to track e.g. job status +| map[string]string | false -| ironicInspectorReadyCount -| ReadyCount of Ironic Inspector instance -| int32 +| conditions +| Conditions +| condition.Conditions | false -| ironicNeutronAgentReadyCount -| ReadyCount of Ironic Neutron Agent instance -| int32 +| databaseHostname +| Neutron Database Hostname +| string | false | transportURLSecret @@ -8802,248 +12773,276 @@ IronicStatus defines the observed state of Ironic | string | false +| networkAttachments +| NetworkAttachments status of the deployment pods +| map[string][]string +| false + +| applicationCredentialSecret +| ApplicationCredentialSecret - the AC secret NeutronAPI is currently consuming and protecting with the openstack.org/neutronapi-ac-consumer finalizer. Tracked so the controller can remove its finalizer from the old secret when the openstack-operator rotates the reference. +| string +| false + | observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) | int64 | false -|=== -<> - -[#apioverridespec-2] -==== APIOverrideSpec +| lastAppliedTopology +| LastAppliedTopology - the last applied Topology +| *topologyv1.TopoRef +| false -APIOverrideSpec to override the generated manifest of several child resources. +| notificationsTransportURLSecret +| NotificationsTransportURLSecret - Secret containing external notifications transportURL +| *string +| false -|=== -| Field | Description | Scheme | Required +| rpcReadyCount +| RPCReadyCount of neutron-rpc-server instances. Only populated when the WSGI deployment strategy is enabled and the RPC worker is not disabled via rpc_workers=0 in customServiceConfig. +| int32 +| false -| service -| Override configuration for the Service created to serve traffic to the cluster. The key must be the endpoint type (public, internal) -| map[service.Endpoint]service.RoutedOverrideSpec +| workerReadyCount +| WorkerReadyCount of neutron background worker (periodic/OVN maintenance) instances. Only populated when the WSGI deployment strategy is enabled. +| int32 | false |=== <> -[#httpdcustomization] -==== HttpdCustomization - -HttpdCustomization - customize the httpd service +[#neutronapitls] +==== NeutronApiTLS |=== | Field | Description | Scheme | Required -| processNumber -| ProcessNumber - Number of processes running in keystone API -| *int32 -| true +| api +| API tls type which encapsulates for API services +| tls.APIService +| false -| customConfigSecret -| CustomConfigSecret - customize the httpd vhost config using this parameter to specify a secret that contains service config data. The content of each provided snippet gets rendered as a go template and placed into /etc/httpd/conf/httpd_custom_++++++. In the default httpd template at the end of the vhost those custom configs get included using `Include conf/httpd_custom_++++++_*`. For information on how sections in httpd configuration get merged, check section \"How the sections are merged\" in https://httpd.apache.org/docs/current/sections.html#merging++++++++++++ -| *string +| ovn +| Ovn GenericService - holds the secret for the OvnDb client cert +| tls.GenericService | false |=== <> -[#keystoneapi] -==== KeystoneAPI +[#neutronextravolmounts] +==== NeutronExtraVolMounts -KeystoneAPI is the Schema for the keystoneapis API +NeutronExtraVolMounts exposes additional parameters processed by the neutron-operator and defines the common VolMounts structure provided by the main storage module |=== | Field | Description | Scheme | Required -| metadata +| name | -| metav1.ObjectMeta +| string | false -| spec +| region | -| <> +| string | false -| status +| extraVol | -| <> -| false +| []storage.VolMounts +| true |=== <> -[#keystoneapilist] -==== KeystoneAPIList +[#passwordselector-2] +==== PasswordSelector -KeystoneAPIList contains a list of KeystoneAPI +PasswordSelector to identify the DB and AdminUser password from the Secret |=== | Field | Description | Scheme | Required -| metadata -| -| metav1.ListMeta -| false - -| items -| -| []<> +| service +| Database - Selector to get the neutron service password from the Secret +| string | true |=== <> -[#keystoneapispec] -==== KeystoneAPISpec +[#authspec-2] +==== AuthSpec + +AuthSpec defines authentication parameters for Cyborg services |=== | Field | Description | Scheme | Required -| containerImage -| Keystone Container Image URL (will be set to environmental default if empty) +| applicationCredentialSecret +| ApplicationCredentialSecret - the name of the k8s Secret that contains the application credential data used for authentication | string -| true +| false |=== <> -[#keystoneapispeccore] -==== KeystoneAPISpecCore +[#cyborgimages] +==== CyborgImages -KeystoneAPISpec defines the desired state of KeystoneAPI +CyborgImages defines container images used by top level Cyborg CR |=== | Field | Description | Scheme | Required -| databaseInstance -| MariaDB instance name Right now required by the maridb-operator to get the credentials from the instance to create the DB Might not be required in future +| apiContainerImageURL +| APIContainerImageURL | string | true -| databaseAccount -| DatabaseAccount - name of MariaDBAccount which will be used to connect. +| conductorContainerImageURL +| ConductorContainerImageURL | string | true -| memcachedInstance -| Memcached instance name. +| agentContainerImageURL +| AgentContainerImageURL | string | true +|=== -| region -| Region - optional region name for the keystone service -| string -| true +<> -| adminProject -| AdminProject - admin project name -| string -| true +[#passwordselector-2] +==== PasswordSelector -| adminUser -| AdminUser - admin user name -| string -| true +PasswordSelector to identify the DB and AdminUser password from the Secret -| replicas -| Replicas of keystone API to run -| *int32 -| true +|=== +| Field | Description | Scheme | Required -| secret -| Secret containing OpenStack password information for keystone AdminPassword +| service +| Service - Selector to get the keystone service user password from the Secret | string | true +|=== -| enableSecureRBAC -| EnableSecureRBAC - Enable Consistent and Secure RBAC policies -| bool -| true +<> -| trustFlushArgs -| TrustFlushArgs - Arguments added to keystone-manage trust_flush command -| string -| true +[#cyborg] +==== Cyborg -| trustFlushSchedule -| TrustFlushSchedule - Schedule to purge expired or soft-deleted trusts from database -| string -| true +Cyborg is the Schema for the cyborgs API. -| trustFlushSuspend -| TrustFlushSuspend - Suspend the cron job to purge trusts -| bool -| true +|=== +| Field | Description | Scheme | Required -| fernetRotationDays -| FernetRotationDays - Rotate fernet token keys every X days -| *int32 +| metadata +| +| metav1.ObjectMeta +| false + +| spec +| +| <> +| false + +| status +| +| <> +| false +|=== + +<> + +[#cyborglist] +==== CyborgList + +CyborgList contains a list of Cyborg. + +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ListMeta +| false + +| items +| +| []<> | true +|=== -| fernetMaxActiveKeys -| FernetMaxActiveKeys - Maximum number of fernet token keys after rotation -| *int32 +<> + +[#cyborgspeccore] +==== CyborgSpecCore + +CyborgSpecCore defines the template for CyborgSpec used in OpenStackControlPlane + +|=== +| Field | Description | Scheme | Required + +| keystoneInstance +| KeystoneInstance to name of the KeystoneAPI CR to select the Service instance used by the Cyborg services to authenticate. +| *string | true -| passwordSelectors -| PasswordSelectors - Selectors to identify the AdminUser password from the Secret -| <> +| databaseInstance +| DatabaseInstance is the name of the MariaDB CR to select the DB Service instance used for the Cyborg API DB. +| *string | true -| nodeSelector -| NodeSelector to target subset of worker nodes running this service -| *map[string]string +| messagingBus +| MessagingBus configuration (username, vhost, and cluster) +| rabbitmqv1.RabbitMqConfig | false -| preserveJobs -| PreserveJobs - do not delete jobs after they finished e.g. to check logs -| bool +| serviceUser +| ServiceUser - optional username used for this service to register in keystone +| *string | true -| customServiceConfig -| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ -| string -| false - -| defaultConfigOverwrite -| ConfigOverwrite - interface to overwrite default config files like e.g. policy.json. But can also be used to add additional files. Those get added to the service config dir in /etc/++++++.++++++ -| map[string]string -| false +| passwordSelectors +| PasswordSelectors - Selectors to identify the DB and ServiceUser passwords from the Secret +| *<> +| true -| httpdCustomization -| HttpdCustomization - customize the httpd service -| <> +| databaseAccount +| DatabaseAccount - MariaDBAccount to use when accessing the API DB +| *string | true -| resources -| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ -| corev1.ResourceRequirements -| false +| apiTimeout +| APITimeout for Route and Apache +| *int +| true -| networkAttachments -| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network -| []string -| false +| secret +| Secret is the name of the Secret instance containing password information for cyborg like the keystone service password and DB passwords +| *string +| true -| override -| Override, provides the ability to override the generated manifest of several child resources. -| <> +| nodeSelector +| NodeSelector to target subset of worker nodes running this service. Setting NodeSelector here acts as a default value and can be overridden by service specific NodeSelector Settings. +| *map[string]string | false -| rabbitMqClusterName -| RabbitMQ instance name Needed to request a transportURL that is created and used in Keystone -| string +| preserveJobs +| PreserveJobs - do not delete jobs after they finished e.g. to check logs +| bool | true -| tls -| TLS - Parameters related to the TLS -| tls.API -| false +| apiServiceTemplate +| APIServiceTemplate - define the cyborg-api service +| <> +| true -| apiTimeout -| APITimeout for HAProxy, Apache -| int +| conductorServiceTemplate +| ConductorServiceTemplate - define the cyborg-conductor service +| <> | true | topologyRef @@ -9051,60 +13050,45 @@ KeystoneAPISpec defines the desired state of KeystoneAPI | *topologyv1.TopoRef | false -| extraMounts -| ExtraMounts containing conf files -| []<> +| auth +| Auth - Parameters related to authentication (shared by all Cyborg services) +| <> | false - -| federatedRealmConfig -| Secret containing the configuration for federated realms This is only needed when multiple realms are federated. Config files mount path is set to /var/lib/httpd/metadata/ -| string -| true |=== <> -[#keystoneapistatus] -==== KeystoneAPIStatus +[#cyborgstatus] +==== CyborgStatus -KeystoneAPIStatus defines the observed state of KeystoneAPI +CyborgStatus defines the observed state of Cyborg. |=== | Field | Description | Scheme | Required -| readyCount -| ReadyCount of keystone API instances -| int32 -| false - -| hash -| Map of hashes to track e.g. job status -| map[string]string -| false - -| apiEndpoints -| API endpoint -| map[string]string -| false - | conditions | Conditions | condition.Conditions | false -| databaseHostname -| Keystone Database Hostname +| serviceID +| ServiceID - The ID of the cyborg service registered in keystone | string | false -| networkAttachments -| NetworkAttachments status of the deployment pods -| map[string][]string +| hash +| Hash - Map of hashes to track e.g. job status +| map[string]string | false -| transportURLSecret -| TransportURLSecret - Secret containing RabbitMQ transportURL -| string +| apiServiceReadyCount +| APIServiceReadyCount defines the number or replicas ready from cyborg-api +| int32 +| false + +| conductorServiceReadyCount +| ConductorServiceReadyCount defines the number or replicas ready from cyborg-conductor +| int32 | false | observedGeneration @@ -9112,91 +13096,225 @@ KeystoneAPIStatus defines the observed state of KeystoneAPI | int64 | false -| lastAppliedTopology -| LastAppliedTopology - the last applied Topology -| *topologyv1.TopoRef +| applicationCredentialSecret +| ApplicationCredentialSecret - the AC secret cyborg is currently consuming and protecting with the openstack.org/cyborg-ac-consumer finalizer. Tracked so the controller can remove its finalizer from the old secret when the openstack-operator rotates the reference. +| string | false -| region -| Region - optional region name for the keystone service +| appliedInputSecretHash +| AppliedInputSecretHash is the hash of the top-level input Secret that both CyborgAPI and CyborgConductor have confirmed applied and rolled out with. It is only updated once both report readiness for this input, so a higher-level control-plane CR can correlate Cyborg's readiness with a specific applied input instead of relying on a possibly stale ReadyCondition. | string | false |=== <> -[#keystoneextramounts] -==== KeystoneExtraMounts +[#apioverridespec-2] +==== APIOverrideSpec -KeystoneExtraVolMounts exposes additional parameters processed by keystone-operator and defines the common VolMounts structure provided by the main storage module +APIOverrideSpec to override the generated manifest of several child resources. |=== | Field | Description | Scheme | Required -| name +| service +| Override configuration for the Service created to serve traffic to the cluster. The key must be the endpoint type (public, internal) +| map[service.Endpoint]service.RoutedOverrideSpec +| false + +| probes +| Override probe configuration for the service deployment +| probes.OverrideSpec +| false +|=== + +<> + +[#cyborgapi] +==== CyborgAPI + +CyborgAPI is the Schema for the cyborgapis API. + +|=== +| Field | Description | Scheme | Required + +| metadata | -| string +| metav1.ObjectMeta | false -| region +| spec | -| string +| <> | false -| extraVol +| status | -| []storage.VolMounts -| true +| <> +| false |=== <> -[#passwordselector-2] -==== PasswordSelector +[#cyborgapilist] +==== CyborgAPIList -PasswordSelector to identify the DB and AdminUser password from the Secret +CyborgAPIList contains a list of CyborgAPI. |=== | Field | Description | Scheme | Required -| admin -| Admin - Selector to get the keystone Admin password from the Secret -| string +| metadata +| +| metav1.ListMeta +| false + +| items +| +| []<> | true |=== <> -[#endpoint] -==== Endpoint +[#cyborgapispec] +==== CyborgAPISpec -Endpoint - +CyborgAPISpec defines the desired state of CyborgAPI. |=== | Field | Description | Scheme | Required -| interface -| Interface - public, internal, admin +| configSecret +| ConfigSecret - containing all the configuration needed provided by Cyborg object | string | true -| url -| URL - endpoint url +| containerImage +| ContainerImage is the container image URL for cyborg-api | string | true -| id -| ID - endpoint id +| serviceAccount +| ServiceAccount used by the api pods | string | true + +| apiTimeout +| APITimeout for Route and Apache +| *int +| true |=== <> -[#keystoneendpoint] -==== KeystoneEndpoint +[#cyborgapistatus] +==== CyborgAPIStatus -KeystoneEndpoint is the Schema for the keystoneendpoints API +CyborgAPIStatus defines the observed state of CyborgAPI. + +|=== +| Field | Description | Scheme | Required + +| readyCount +| ReadyCount defines the number of replicas ready +| int32 +| false + +| conditions +| Conditions +| condition.Conditions +| false + +| observedGeneration +| ObservedGeneration - the most recent generation observed +| int64 +| false + +| hash +| Hash - Map of hashes to track config changes +| map[string]string +| false + +| lastAppliedTopology +| LastAppliedTopology - the last applied Topology +| *topologyv1.TopoRef +| false + +| appliedInputSecretHash +| AppliedInputSecretHash is the hash of the input Secret consumed by the last StatefulSet rollout that has been confirmed ready. It is only updated once the StatefulSet is observed to be running with this input, so a parent CR can correlate readiness with a specific applied input instead of relying on a possibly stale ReadyCondition. +| string +| false +|=== + +<> + +[#cyborgapitemplate] +==== CyborgAPITemplate + +CyborgAPITemplate defines the input parameters specified by the user to create a CyborgAPI via higher level CRDs. + +|=== +| Field | Description | Scheme | Required + +| replicas +| Replicas of the service to run +| *int32 +| true + +| nodeSelector +| NodeSelector to target subset of worker nodes running this service. Setting here overrides any global NodeSelector settings within the Cyborg CR. +| *map[string]string +| false + +| customServiceConfig +| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ +| string +| true + +| resources +| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ +| corev1.ResourceRequirements +| false + +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> +| false + +| tls +| TLS - Parameters related to the TLS +| tls.API +| false + +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name +| *topologyv1.TopoRef +| false +|=== + +<> + +[#conductoroverridespec] +==== ConductorOverrideSpec + +ConductorOverrideSpec to override the generated manifest of several child resources. + +|=== +| Field | Description | Scheme | Required + +| probes +| Override probe configuration for the service deployment +| probes.OverrideSpec +| false +|=== + +<> + +[#cyborgconductor] +==== CyborgConductor + +CyborgConductor is the Schema for the cyborgconductors API. |=== | Field | Description | Scheme | Required @@ -9208,21 +13326,21 @@ KeystoneEndpoint is the Schema for the keystoneendpoints API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#keystoneendpointlist] -==== KeystoneEndpointList +[#cyborgconductorlist] +==== CyborgConductorList -KeystoneEndpointList contains a list of KeystoneEndpoint +CyborgConductorList contains a list of CyborgConductor. |=== | Field | Description | Scheme | Required @@ -9234,49 +13352,54 @@ KeystoneEndpointList contains a list of KeystoneEndpoint | items | -| []<> +| []<> | true |=== <> -[#keystoneendpointspec] -==== KeystoneEndpointSpec +[#cyborgconductorspec] +==== CyborgConductorSpec -KeystoneEndpointSpec defines the desired state of KeystoneEndpoint +CyborgConductorSpec defines the desired state of CyborgConductor. |=== | Field | Description | Scheme | Required -| serviceName -| ServiceName - Name of the service to create the endpoint for +| configSecret +| Secret is the name of the sub-level secret containing all required data (transport URL, DB creds, keystone auth, service password, etc.) | string | true -| endpoints -| Endpoints - map with service api endpoint URLs with the endpoint type as index -| map[string]string +| containerImage +| ContainerImage is the container image URL for cyborg-conductor +| string +| true + +| serviceAccount +| ServiceAccount used by the conductor pods +| string | true + +| tls +| TLS - Parameters related to the TLS +| tls.Ca +| false |=== <> -[#keystoneendpointstatus] -==== KeystoneEndpointStatus - -KeystoneEndpointStatus defines the observed state of KeystoneEndpoint +[#cyborgconductorstatus] +==== CyborgConductorStatus + +CyborgConductorStatus defines the observed state of CyborgConductor. |=== | Field | Description | Scheme | Required -| endpointIDs -| -| map[string]string -| false - -| serviceID -| -| string +| readyCount +| ReadyCount defines the number of replicas ready +| int32 | false | conditions @@ -9284,155 +13407,165 @@ KeystoneEndpointStatus defines the observed state of KeystoneEndpoint | condition.Conditions | false -| endpoints -| Endpoints - current status of latest configured endpoints for the service -| []<> -| false - | observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes. +| ObservedGeneration - the most recent generation observed | int64 | false + +| hash +| Hash - Map of hashes to track config changes +| map[string]string +| false + +| lastAppliedTopology +| LastAppliedTopology - the last applied Topology +| *topologyv1.TopoRef +| false + +| appliedInputSecretHash +| AppliedInputSecretHash is the hash of the input Secret consumed by the last StatefulSet rollout that has been confirmed ready. It is only updated once the StatefulSet is observed to be running with this input, so a parent CR can correlate readiness with a specific applied input instead of relying on a possibly stale ReadyCondition. +| string +| false |=== <> -[#keystoneservice] -==== KeystoneService +[#cyborgconductortemplate] +==== CyborgConductorTemplate -KeystoneService is the Schema for the keystoneservices API +CyborgConductorTemplate defines the input parameters specified by the user to create a CyborgConductor via higher level CRDs. |=== | Field | Description | Scheme | Required -| metadata -| -| metav1.ObjectMeta +| replicas +| Replicas of the service to run +| *int32 +| true + +| nodeSelector +| NodeSelector to target subset of worker nodes running this service. Setting here overrides any global NodeSelector settings within the Cyborg CR. +| *map[string]string | false -| spec -| -| <> +| customServiceConfig +| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ +| string +| true + +| resources +| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ +| corev1.ResourceRequirements | false -| status -| -| <> +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name +| *topologyv1.TopoRef +| false + +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> | false |=== <> -[#keystoneservicelist] -==== KeystoneServiceList +[#authspec-2] +==== AuthSpec -KeystoneServiceList contains a list of KeystoneService +AuthSpec defines authentication parameters for Nova services |=== | Field | Description | Scheme | Required -| metadata -| -| metav1.ListMeta +| applicationCredentialSecret +| ApplicationCredentialSecret - the name of the k8s Secret that contains the application credential data used for authentication +| string | false - -| items -| -| []<> -| true |=== <> -[#keystoneservicespec] -==== KeystoneServiceSpec +[#novacellimages] +==== NovaCellImages -KeystoneServiceSpec defines the desired state of KeystoneService +NovaCellImages defines container images used by NovaCell services |=== | Field | Description | Scheme | Required -| serviceType -| ServiceType - Type is the type of the service. -| string -| true - -| serviceName -| ServiceName - Name of the service. -| string -| true - -| serviceDescription -| ServiceDescription - Description for the service. +| conductorContainerImageURL +| ConductorContainerImageURL | string -| false - -| enabled -| Enabled - whether or not the service is enabled. -| bool | true -| serviceUser -| ServiceUser - optional username used for this service +| metadataContainerImageURL +| MetadataContainerImageURL | string | true -| secret -| Secret containing OpenStack password information for the ServiceUser +| novncproxyContainerImageURL +| NoVNCContainerImageURL | string | true -| passwordSelector -| PasswordSelector - Selector to get the ServiceUser password from the Secret, e.g. PlacementPassword +| computeContainerImageURL +| NovaComputeContainerImageURL | string | true |=== <> -[#keystoneservicestatus] -==== KeystoneServiceStatus +[#novaimages] +==== NovaImages -KeystoneServiceStatus defines the observed state of KeystoneService +NovaImages defines container images used by top level Nova CR |=== | Field | Description | Scheme | Required -| serviceID -| +| apiContainerImageURL +| APIContainerImageURL | string -| false +| true -| conditions -| Conditions -| condition.Conditions -| false +| schedulerContainerImageURL +| SchedulerContainerImageURL +| string +| true |=== <> -[#manilaservicetemplate] -==== ManilaServiceTemplate +[#novaservicebase] +==== NovaServiceBase -ManilaServiceTemplate defines the input parameters that can be defined for a given Manila service +NovaServiceBase contains the fields that are needed for each nova service CRD |=== | Field | Description | Scheme | Required +| containerImage +| The service specific Container Image URL (will be set to environmental default if empty) +| string +| true + +| replicas +| Replicas of the service to run +| *int32 +| true + | nodeSelector -| NodeSelector to target subset of worker nodes running this service. Setting here overrides any global NodeSelector settings within the Manila CR. +| NodeSelector to target subset of worker nodes running this service | *map[string]string | false | customServiceConfig -| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to /etc/++++++/++++++.conf.d directory a custom config file.++++++++++++ +| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ | string -| false - -| customServiceConfigSecrets -| CustomServiceConfigSecrets - customize the service config using this parameter to specify Secrets that contain sensitive service config data. The content of each Secret gets added to the /etc/++++++/++++++.conf.d directory as a custom config file.++++++++++++ -| []string -| false +| true | resources | Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ @@ -9452,244 +13585,281 @@ ManilaServiceTemplate defines the input parameters that can be defined for a giv <> -[#manilatemplate] -==== ManilaTemplate +[#passwordselector-2] +==== PasswordSelector -ManilaTemplate defines common input parameters used by all Manila services +PasswordSelector to identify the DB and AdminUser password from the Secret |=== | Field | Description | Scheme | Required -| serviceUser -| ServiceUser - optional username used for this service to register in manila +| service +| Service - Selector to get the keystone service user password from the Secret | string | true -| databaseAccount -| DatabaseAccount - optional MariaDBAccount CR name used for manila DB, defaults to manila +| metadataSecret +| MetadataSecret - the name of the field to get the metadata secret from the Secret | string | true -| secret -| Secret containing OpenStack password information for AdminPassword +| prefixMetadataCellsSecret +| prefixMetadataCellsSecret - the prefix name of the field to get the metadata secret from the Secret for cells. Vale of metadata_proxy_shared_secret information for the nova-metadata service. This secret is shared between nova and neutron ovn-metadata inside selected cell and if this is not defined the global metadata_proxy_shared_secret secret will be used | string -| false - -| passwordSelectors -| PasswordSelectors - Selectors to identify the ServiceUser password from the Secret -| <> -| false +| true |=== <> -[#passwordselector-2] -==== PasswordSelector +[#nova] +==== Nova -PasswordSelector to identify the DB and AdminUser password from the Secret +Nova is the Schema for the nova API |=== | Field | Description | Scheme | Required -| service -| Service - Selector to get the manila service password from the Secret -| string +| metadata +| +| metav1.ObjectMeta +| false + +| spec +| +| <> +| false + +| status +| +| <> | false |=== <> -[#apioverridespec-2] -==== APIOverrideSpec +[#novalist] +==== NovaList -APIOverrideSpec to override the generated manifest of several child resources. +NovaList contains a list of Nova |=== | Field | Description | Scheme | Required -| service -| Override configuration for the Service created to serve traffic to the cluster. The key must be the endpoint type (public, internal) -| map[service.Endpoint]service.RoutedOverrideSpec +| metadata +| +| metav1.ListMeta | false + +| items +| +| []<> +| true |=== <> -[#manilaapi] -==== ManilaAPI +[#novaspeccore] +==== NovaSpecCore -ManilaAPI is the Schema for the manilaapis API +NovaSpecCore defines the template for NovaSpec used in OpenStackControlPlane |=== | Field | Description | Scheme | Required -| metadata -| -| metav1.ObjectMeta -| false +| keystoneInstance +| KeystoneInstance to name of the KeystoneAPI CR to select the Service instance used by the Nova services to authenticate. +| string +| true -| spec -| -| <> +| apiDatabaseInstance +| APIDatabaseInstance is the name of the MariaDB CR to select the DB Service instance used for the Nova API DB. +| string +| true + +| apiMessageBusInstance +| APIMessageBusInstance is the name of the RabbitMqCluster CR to select the Message Bus Service instance used by the Nova top level services to communicate. Deprecated: Use MessagingBus.Cluster instead +| string | false -| status -| -| <> +| messagingBus +| MessagingBus configuration (username, vhost, and cluster) +| rabbitmqv1.RabbitMqConfig | false -|=== -<> +| cellTemplates +| Cells is a mapping of cell names to NovaCellTemplate objects defining the cells in the deployment. The "cell0" cell is a mandatory cell in every deployment. Moreover any real deployment needs at least one additional normal cell as "cell0" cannot have any computes. +| map[string]<> +| true + +| serviceUser +| ServiceUser - optional username used for this service to register in keystone +| string +| true + +| apiDatabaseAccount +| APIDatabaseAccount - MariaDBAccount to use when accessing the API DB +| string +| true -[#manilaapilist] -==== ManilaAPIList +| apiTimeout +| APITimeout for Route and Apache +| int +| true -ManilaAPIList contains a list of ManilaAPI +| secret +| Secret is the name of the Secret instance containing password information for nova like the keystone service password and DB passwords +| string +| true -|=== -| Field | Description | Scheme | Required +| passwordSelectors +| PasswordSelectors - Selectors to identify the DB and ServiceUser passwords from the Secret +| <> +| true -| metadata -| -| metav1.ListMeta +| nodeSelector +| NodeSelector to target subset of worker nodes running this service. Setting NodeSelector here acts as a default value and can be overridden by service specific NodeSelector Settings. +| *map[string]string | false -| items -| -| []<> +| preserveJobs +| PreserveJobs - do not delete jobs after they finished e.g. to check logs +| bool | true -|=== -<> - -[#manilaapispec] -==== ManilaAPISpec +| apiServiceTemplate +| APIServiceTemplate - define the nova-api service +| <> +| true -ManilaAPISpec defines the desired state of ManilaAPI +| schedulerServiceTemplate +| SchedulerServiceTemplate- define the nova-scheduler service +| <> +| true -|=== -| Field | Description | Scheme | Required +| metadataServiceTemplate +| MetadataServiceTemplate - defines the metadata service that is global for the deployment serving all the cells. Note that if you want to deploy metadata per cell then the metadata service should be disabled here and enabled in the cellTemplates instead. +| <> +| true -| databaseHostname -| DatabaseHostname - Manila Database Hostname +| memcachedInstance +| MemcachedInstance is the name of the Memcached CR that all nova service will use. | string -| false +| true -| transportURLSecret -| Secret containing RabbitMq transport URL -| string +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name +| *topologyv1.TopoRef | false -| notificationsURLSecret -| Secret containing Notification transport URL -| string +| notificationsBusInstance +| NotificationsBusInstance is the name of the RabbitMqCluster CR to select the Message Bus Service instance used by the Nova top level services and all cells to publish notifications. If undefined, the value will be inherited from OpenStackControlPlane. An empty value "" leaves the notification drivers unconfigured and emitting no notifications at all. Avoid colocating it with RabbitMqClusterName, APIMessageBusInstance or CellMessageBusInstance used for RPC. For particular Nova cells, notifications cannot be disabled, nor configured differently. +| *string | false -| extraMounts -| ExtraMounts containing conf files and credentials -| []<> +| notificationsBus +| NotificationsBus configuration (username, vhost, and cluster) for notifications +| *rabbitmqv1.RabbitMqConfig | false -| serviceAccount -| ServiceAccount - service account name used internally to provide the default SA name -| string -| true - -| memcachedInstance -| Memcached instance name. -| *string -| true +| auth +| Auth - Parameters related to authentication (shared by all Nova services) +| <> +| false |=== <> -[#manilaapistatus] -==== ManilaAPIStatus +[#novastatus] +==== NovaStatus -ManilaAPIStatus defines the observed state of ManilaAPI +NovaStatus defines the observed state of Nova |=== | Field | Description | Scheme | Required -| hash -| Map of hashes to track e.g. job status -| map[string]string -| false - | conditions | Conditions | condition.Conditions | false -| readyCount -| ReadyCount of Manila API instances +| apiServiceReadyCount +| APIServiceReadyCount defines the number or replicas ready from nova-api | int32 | false -| networkAttachments -| NetworkAttachments status of the deployment pods -| map[string][]string +| schedulerServiceReadyCount +| SchedulerServiceReadyCount defines the number or replicas ready from nova-scheduler +| int32 | false -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) -| int64 +| metadataServiceReadyCount +| MetadataReadyCount defines the number of replicas ready from nova-metadata service +| int32 | false -| lastAppliedTopology -| LastAppliedTopology - the last applied Topology -| *topologyv1.TopoRef +| registeredCells +| RegisteredCells is a map keyed by cell names that are registered in the nova_api database with a value that is the hash of the given cell configuration. +| map[string]string | false -|=== -<> +| discoveredCells +| DiscoveredCells is a map keyed by cell names that have discovered all kubernetes managed computes in cell value is a hash of config from all kubernetes managed computes in cell +| map[string]string +| false -[#manilaapitemplate] -==== ManilaAPITemplate +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes. +| int64 +| false -ManilaAPITemplate defines the input parameter for the ManilaAPI service +| applicationCredentialSecret +| ApplicationCredentialSecret - the AC secret nova is currently consuming and protecting with the openstack.org/nova-ac-consumer finalizer. Tracked so the controller can remove its finalizer from the old secret when the openstack-operator rotates the reference. +| string +| false -|=== -| Field | Description | Scheme | Required +| appliedInputSecretHash +| AppliedInputSecretHash is the hash of the top-level input Secret that all of NovaAPI, NovaScheduler, NovaMetadata, and cell0 have confirmed applied and rolled out with. It is only updated once all of them report readiness for this input, so a higher-level control-plane CR can correlate Nova's readiness with a specific applied input instead of relying on a possibly stale ReadyCondition. +| string +| false -| containerImage -| ContainerImage - Manila API Container Image URL +| transportURLSecret +| TransportURLSecret is the name of the transport URL secret nova is currently consuming and protecting with a consumer finalizer during credential rotation. | string -| true +| false + +| notificationsTransportURLSecret +| NotificationsTransportURLSecret is the name of the notifications transport URL secret nova is currently consuming and protecting with a consumer finalizer during credential rotation. +| string +| false |=== <> -[#manilaapitemplatecore] -==== ManilaAPITemplateCore +[#apioverridespec-2] +==== APIOverrideSpec -ManilaAPITemplateCore - +APIOverrideSpec to override the generated manifest of several child resources. |=== | Field | Description | Scheme | Required -| replicas -| Replicas - Manila API Replicas -| *int32 -| true - -| override -| Override, provides the ability to override the generated manifest of several child resources. -| <> +| service +| Override configuration for the Service created to serve traffic to the cluster. The key must be the endpoint type (public, internal) +| map[service.Endpoint]service.RoutedOverrideSpec | false -| tls -| TLS - Parameters related to the TLS -| tls.API +| probes +| Override probe configuration for the service deployment +| probes.OverrideSpec | false |=== <> -[#manilascheduler] -==== ManilaScheduler +[#novaapi] +==== NovaAPI -ManilaScheduler is the Schema for the manilaschedulers API +NovaAPI is the Schema for the novaapis API |=== | Field | Description | Scheme | Required @@ -9701,21 +13871,21 @@ ManilaScheduler is the Schema for the manilaschedulers API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#manilaschedulerlist] -==== ManilaSchedulerList +[#novaapilist] +==== NovaAPIList -ManilaSchedulerList contains a list of ManilaScheduler +NovaAPIList contains a list of NovaAPI |=== | Field | Description | Scheme | Required @@ -9727,62 +13897,107 @@ ManilaSchedulerList contains a list of ManilaScheduler | items | -| []<> +| []<> | true |=== <> -[#manilaschedulerspec] -==== ManilaSchedulerSpec +[#novaapispec] +==== NovaAPISpec -ManilaSchedulerSpec defines the desired state of ManilaScheduler +NovaAPISpec defines the desired state of NovaAPI |=== | Field | Description | Scheme | Required -| databaseHostname -| DatabaseHostname - manila Database Hostname +| apiTimeout +| APITimeout for Route and Apache +| int +| true + +| secret +| Secret is the name of the Secret instance containing password information for the nova-api service. This secret is expected to be generated by the nova-operator based on the information passed to the Nova CR. | string -| false +| true -| transportURLSecret -| Secret containing RabbitMq transport URL +| serviceUser +| ServiceUser - optional username used for this service to register in keystone | string -| false +| true -| notificationsURLSecret -| Secret containing Notification transport URL +| keystoneAuthURL +| KeystoneAuthURL configures the keystone API endpoint to be used by the service for authentication and authorization | string -| false +| true -| extraMounts -| ExtraMounts containing conf files and credentials -| []<> -| false +| keystonePublicAuthURL +| KeystonePublicAuthURL configures the public keystone API endpoint. This can be different from KeystoneAuthURL. The service uses this value to redirect unauthenticated users. +| string +| true -| serviceAccount -| ServiceAccount - service account name used internally to provide the default SA name +| region +| Region - the region name to use for service endpoint discovery | string | true -| memcachedInstance -| Memcached instance name. -| *string +| apiDatabaseAccount +| APIDatabaseAccount - MariaDBAccount to use when accessing the API DB +| string +| true + +| apiDatabaseHostname +| APIDatabaseHostname - hostname to use when accessing the API DB +| string +| true + +| cell0DatabaseAccount +| APIDatabaseAccount - MariaDBAccount to use when accessing the cell0 DB +| string +| true + +| cell0DatabaseHostname +| APIDatabaseHostname - hostname to use when accessing the cell0 DB +| string +| true + +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> +| false + +| serviceAccount +| ServiceAccount - service account name used internally to provide Nova services the default SA name +| string +| true + +| registeredCells +| RegisteredCells is a map keyed by cell names that are registered in the nova_api database with a value that is the hash of the given cell configuration. This is used to detect when a new cell is added or an existing cell is reconfigured to trigger refresh of the in memory cell caches of the service. +| map[string]string | true | tls | TLS - Parameters related to the TLS -| tls.Ca +| tls.API +| false + +| defaultConfigOverwrite +| DefaultConfigOverwrite - interface to overwrite default config files like e.g. api-paste.ini, policy.yaml or nova_api_audit_map.conf. +| map[string]string | false + +| memcachedInstance +| MemcachedInstance is the name of the Memcached CR that all nova service will use. +| string +| true |=== <> -[#manilaschedulerstatus] -==== ManilaSchedulerStatus +[#novaapistatus] +==== NovaAPIStatus -ManilaSchedulerStatus defines the observed state of ManilaScheduler +NovaAPIStatus defines the observed state of NovaAPI |=== | Field | Description | Scheme | Required @@ -9798,7 +14013,7 @@ ManilaSchedulerStatus defines the observed state of ManilaScheduler | false | readyCount -| ReadyCount of Manila Scheduler instances +| ReadyCount defines the number of replicas ready from nova-api | int32 | false @@ -9808,7 +14023,7 @@ ManilaSchedulerStatus defines the observed state of ManilaScheduler | false | observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) | int64 | false @@ -9816,46 +14031,75 @@ ManilaSchedulerStatus defines the observed state of ManilaScheduler | LastAppliedTopology - the last applied Topology | *topologyv1.TopoRef | false + +| appliedInputSecretHash +| AppliedInputSecretHash is the hash of the input Secret consumed by the last StatefulSet rollout that has been confirmed ready. It is only updated once the StatefulSet is observed to be running with this input, so a parent CR can correlate readiness with a specific applied input instead of relying on a possibly stale ReadyCondition. +| string +| false |=== <> -[#manilaschedulertemplate] -==== ManilaSchedulerTemplate +[#novaapitemplate] +==== NovaAPITemplate -ManilaSchedulerTemplate defines the input parameter for the ManilaScheduler service +NovaAPITemplate defines the input parameters specified by the user to create a NovaAPI via higher level CRDs. NOTE(gibi): NovaAPITemplate has the same structure than NovaServiceBase BUT we want to default ContainerImage for the template, therefore the structs are duplicated. |=== | Field | Description | Scheme | Required -| containerImage -| ContainerImage - Manila API Container Image URL +| replicas +| Replicas of the service to run +| *int32 +| true + +| nodeSelector +| NodeSelector to target subset of worker nodes running this service. Setting here overrides any global NodeSelector settings within the Nova CR. +| *map[string]string +| false + +| customServiceConfig +| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ | string | true -|=== -<> +| defaultConfigOverwrite +| DefaultConfigOverwrite - interface to overwrite default config files like e.g. api-paste.ini, policy.yaml or nova_api_audit_map.conf. +| map[string]string +| false -[#manilaschedulertemplatecore] -==== ManilaSchedulerTemplateCore +| resources +| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ +| corev1.ResourceRequirements +| false -ManilaSchedulerTemplateCore - +| networkAttachments +| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network +| []string +| false -|=== -| Field | Description | Scheme | Required +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> +| false -| replicas -| Replicas - Manila API Replicas -| *int32 -| true +| tls +| TLS - Parameters related to the TLS +| tls.API +| false + +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name +| *topologyv1.TopoRef +| false |=== <> -[#manilashare] -==== ManilaShare +[#novacell] +==== NovaCell -ManilaShare is the Schema for the manilashares API +NovaCell is the Schema for the novacells API |=== | Field | Description | Scheme | Required @@ -9867,21 +14111,47 @@ ManilaShare is the Schema for the manilashares API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#manilasharelist] -==== ManilaShareList +[#novacelldbpurge] +==== NovaCellDBPurge -ManilaShareList contains a list of ManilaShare +NovaCellDBPurge defines the parameters for the DB archiving and purging cron job + +|=== +| Field | Description | Scheme | Required + +| schedule +| Schedule defines when to run the DB maintenance job in a cron format. By default it runs every midnight. +| *string +| true + +| archiveAge +| ArchiveAge defines the minimum age of the records in days that can be moved to the shadow tables. +| *int +| true + +| purgeAge +| PurgeAge defines the minimum age of the records in days that can be deleted from the shadow tables +| *int +| true +|=== + +<> + +[#novacelllist] +==== NovaCellList + +NovaCellList contains a list of NovaCell |=== | Field | Description | Scheme | Required @@ -9893,68 +14163,138 @@ ManilaShareList contains a list of ManilaShare | items | -| []<> +| []<> | true |=== <> -[#manilasharespec] -==== ManilaShareSpec +[#novacellspec] +==== NovaCellSpec -ManilaShareSpec defines the desired state of ManilaShare +NovaCellSpec defines the desired state of NovaCell |=== | Field | Description | Scheme | Required -| databaseHostname -| DatabaseHostname - manila Database Hostname +| cellName +| CellName is the name of the Nova Cell. The value "cell0" has a special meaning. The "cell0" Cell cannot have compute nodes associated and the conductor in this cell acts as the super conductor for all the cells in the deployment. | string -| false +| true -| transportURLSecret -| Secret containing RabbitMq transport URL +| apiTimeout +| APITimeout for Route and Apache +| int +| true + +| secret +| Secret is the name of the Secret instance containing password information for the nova cell. This secret is expected to be generated by the nova-operator based on the information passed to the Nova CR. | string +| true + +| nodeSelector +| NodeSelector to target subset of worker nodes running this services. +| *map[string]string | false -| notificationsURLSecret -| Secret containing Notification transport URL +| serviceUser +| ServiceUser - optional username used for this service to register in keystone | string -| false +| true -| extraMounts -| ExtraMounts containing conf files and credentials -| []<> -| false +| keystoneAuthURL +| KeystoneAuthURL - the URL that the service in the cell can use to talk to keystone +| string +| true -| serviceAccount -| ServiceAccount - service account name used internally to provide the default SA name +| region +| Region - the region name to use for service endpoint discovery | string | true -| memcachedInstance -| Memcached instance name. -| *string +| apiDatabaseAccount +| APIDatabaseAccount - MariaDBAccount to use when accessing the API DB +| string +| true + +| apiDatabaseHostname +| APIDatabaseHostname - hostname to use when accessing the API DB. If not provided then up-calls will be disabled. This filed is Required for cell0. +| string +| true + +| cellDatabaseAccount +| CellDatabaseAccount - MariaDBAccount to use when accessing the cell DB +| string +| true + +| cellDatabaseHostname +| CellDatabaseHostname - hostname to use when accessing the cell DB +| string +| true + +| preserveJobs +| PreserveJobs - do not delete jobs after they finished e.g. to check logs +| bool +| true + +| conductorServiceTemplate +| ConductorServiceTemplate - defines the cell conductor deployment for the cell +| <> +| true + +| metadataServiceTemplate +| MetadataServiceTemplate - defines the metadata service dedicated for the cell. +| <> +| true + +| noVNCProxyServiceTemplate +| NoVNCProxyServiceTemplate - defines the novncproxy service dedicated for the cell. +| <> +| true + +| novaComputeTemplates +| NovaComputeTemplates - map of nova computes template with selected drivers in format compute_name: compute_template. Key from map is arbitrary name for the compute. because of that there is a 20 character limit on the compute name. +| map[string]<> +| false + +| serviceAccount +| ServiceAccount - service account name used internally to provide Nova services the default SA name +| string | true | tls | TLS - Parameters related to the TLS | tls.Ca | false + +| memcachedInstance +| MemcachedInstance is the name of the Memcached CR that all nova service will use. +| string +| true + +| dbPurge +| DBPurge defines the parameters for the DB archiving and purging cron job +| <> +| true + +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name +| *topologyv1.TopoRef +| false |=== <> -[#manilasharestatus] -==== ManilaShareStatus +[#novacellstatus] +==== NovaCellStatus -ManilaShareStatus defines the observed state of ManilaShare +NovaCellStatus defines the observed state of NovaCell |=== | Field | Description | Scheme | Required | hash -| Map of hashes to track e.g. job status +| INSERT ADDITIONAL STATUS FIELD - define observed state of cluster Important: Run "make" to regenerate code after modifying this file Map of hashes to track e.g. job status | map[string]string | false @@ -9963,86 +14303,135 @@ ManilaShareStatus defines the observed state of ManilaShare | condition.Conditions | false -| readyCount -| ReadyCount of ManilaShare instances +| conductorServiceReadyCount +| ConductorServiceReadyCount defines the number of replicas ready from nova-conductor service in the cell +| int32 +| false + +| metadataServiceReadyCount +| MetadataServiceReadyCount defines the number of replicas ready from nova-metadata service in the cell +| int32 +| false + +| noVNCProxyServiceReadyCount +| NoVNCPRoxyServiceReadyCount defines the number of replicas ready from nova-novncproxy service in the cell | int32 | false -| networkAttachments -| NetworkAttachments status of the deployment pods -| map[string][]string +| novaComputesStatus +| NovaComputesStatus is a map with format cell_name: NovaComputeCellStatus where NovaComputeCellStatus tell if compute with selected name deployed successfully and indicates if the compute is successfully mapped to the cell in the nova_api database. When a compute is removed from the Spec the operator will delete the related NovaCompute CR and then remove the compute from this Status field. +| map[string]<> | false | observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) | int64 | false -| lastAppliedTopology -| LastAppliedTopology - the last applied Topology -| *topologyv1.TopoRef +| appliedInputSecretHash +| AppliedInputSecretHash is the hash of the per-cell input Secret that all of this cell's child services (Conductor, Metadata, NoVNCProxy, Compute) have confirmed applied and rolled out with. It is only updated once all of them report readiness for this input, so the top-level Nova CR can correlate this cell's readiness with a specific applied input instead of relying on a possibly stale ReadyCondition. +| string | false |=== <> -[#manilasharetemplate] -==== ManilaShareTemplate +[#novacelltemplate] +==== NovaCellTemplate -ManilaShareTemplate defines the input parameter for the ManilaShare service +NovaCellTemplate defines the input parameters specified by the user to create a NovaCell via higher level CRDs. |=== | Field | Description | Scheme | Required -| containerImage -| ContainerImage - Manila API Container Image URL +| cellDatabaseInstance +| CellDatabaseInstance is the name of the MariaDB CR to select the DB Service instance used as the DB of this cell. | string | true -|=== -<> +| cellDatabaseAccount +| CellDatabaseAccount - MariaDBAccount to use when accessing the give cell DB +| string +| true -[#manilasharetemplatecore] -==== ManilaShareTemplateCore +| cellMessageBusInstance +| CellMessageBusInstance is the name of the RabbitMqCluster CR to select the Message Bus Service instance used by the nova services to communicate in this cell. For cell0 it is unused. Deprecated: Use MessagingBus.Cluster instead +| string +| false -ManilaShareTemplateCore - +| messagingBus +| MessagingBus configuration (username, vhost, and cluster) +| rabbitmqv1.RabbitMqConfig +| false -|=== -| Field | Description | Scheme | Required +| hasAPIAccess +| HasAPIAccess defines if this Cell is configured to have access to the API DB and message bus. +| bool +| true -| replicas -| Replicas - Manila API Replicas -| *int32 +| nodeSelector +| NodeSelector to target subset of worker nodes running cell. +| *map[string]string +| false + +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name +| *topologyv1.TopoRef +| false + +| conductorServiceTemplate +| ConductorServiceTemplate - defines the cell conductor deployment for the cell. +| <> +| true + +| metadataServiceTemplate +| MetadataServiceTemplate - defines the metadata service dedicated for the cell. Note that for cell0 metadata service should not be deployed. Also if metadata service needs to be deployed per cell here then it should not be enabled to be deployed on the top level via the Nova CR at the same time. By default Nova CR deploys the metadata service at the top level and disables it on the cell level. +| <> +| true + +| noVNCProxyServiceTemplate +| NoVNCProxyServiceTemplate - defines the novncproxy service dedicated for the cell. Note that for cell0 novncproxy should not be deployed so the enabled field of this template is defaulted to false in cell0 but defaulted to true in other cells. +| <> +| true + +| novaComputeTemplates +| NovaComputeTemplates - map of nova computes template with selected drivers in format compute_name: compute_template. Key from map is arbitrary name for the compute with a limit of 20 characters. +| map[string]<> +| false + +| memcachedInstance +| MemcachedInstance is the name of the Memcached CR that the services in the cell will use. If defined then this takes precedence over Nova.Spec.MemcachedInstance for this cel +| string +| true + +| dbPurge +| DBPurge defines the parameters for the DB archiving and purging cron job +| <> | true |=== <> -[#dbpurge-2] -==== DBPurge +[#computeoverridespec] +==== ComputeOverrideSpec -DBPurge struct is used to model the parameters exposed to the Manila API CronJob +ComputeOverrideSpec to override the generated manifest of several child resources. |=== | Field | Description | Scheme | Required -| age -| Age is the DBPurgeAge parameter and indicates the number of days of purging DB records -| int -| true - -| schedule -| Schedule defines the crontab format string to schedule the DBPurge cronJob -| string -| true +| probes +| Override probes and other common fields in the StatefulSet +| probes.OverrideSpec +| false |=== <> -[#manila] -==== Manila +[#novacompute] +==== NovaCompute -Manila is the Schema for the manilas API +NovaCompute is the Schema for the NovaCompute |=== | Field | Description | Scheme | Required @@ -10054,63 +14443,42 @@ Manila is the Schema for the manilas API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#maniladebug] -==== ManilaDebug +[#novacomputecellstatus] +==== NovaComputeCellStatus -ManilaDebug contains flags related to multiple debug activities. See the individual comments for what this means for each flag. +NovaComputeCellStatus defines state of NovaCompute in cell |=== | Field | Description | Scheme | Required -| dbPurge -| DBPurge increases log verbosity by executing the db_purge command with "--debug". +| deployed +| Deployed value: true means that the compute is deployed but can still be undiscovered | bool -| false -|=== - -<> - -[#manilaextravolmounts] -==== ManilaExtraVolMounts - -ManilaExtraVolMounts exposes additional parameters processed by the manila-operator and defines the common VolMounts structure provided by the main storage module - -|=== -| Field | Description | Scheme | Required - -| name -| -| string -| false - -| region -| -| string -| false +| true -| extraVol -| -| []storage.VolMounts +| errors +| Errors value True means that during deployment, errors appear, and the user needs to check the compute for problems +| bool | true |=== <> -[#manilalist] -==== ManilaList +[#novacomputelist] +==== NovaComputeList -ManilaList contains a list of Manila +NovaComputeList contains a list of NovaCompute |=== | Field | Description | Scheme | Required @@ -10122,139 +14490,87 @@ ManilaList contains a list of Manila | items | -| []<> +| []<> | true |=== <> -[#manilaspec] -==== ManilaSpec +[#novacomputespec] +==== NovaComputeSpec -ManilaSpec defines the desired state of Manila +NovaComputeSpec defines the desired state of NovaCompute |=== | Field | Description | Scheme | Required -| manilaAPI -| ManilaAPI - Spec definition for the API service of this Manila deployment -| <> +| cellName +| CellName is the name of the Nova Cell this NovaCompute belongs to. +| string | true -| manilaScheduler -| ManilaScheduler - Spec definition for the Scheduler service of this Manila deployment -| <> +| computeName +| ComputeName - compute name. +| string | true -| manilaShares -| ManilaShares - Map of chosen names to spec definitions for the Share(s) service(s) of this Manila deployment -| map[string]<> -| false -|=== - -<> - -[#manilaspecbase] -==== ManilaSpecBase - -ManilaSpecBase - - -|=== -| Field | Description | Scheme | Required - -| databaseInstance -| MariaDB instance name Right now required by the maridb-operator to get the credentials from the instance to create the DB Might not be required in future +| secret +| Secret is the name of the Secret instance containing password information for the NovaCompute service. This secret is expected to be generated by the nova-operator based on the information passed to the Nova CR. | string | true -| rabbitMqClusterName -| RabbitMQ instance name Needed to request a transportURL that is created and used in Manila +| serviceUser +| ServiceUser - optional username used for this service to register in keystone | string | true -| memcachedInstance -| Memcached instance name. +| keystoneAuthURL +| | string | true -| debug -| Debug - enable debug for different deploy stages. If an init container is used, it runs and the actual action pod gets started with sleep infinity -| <> -| false - -| preserveJobs -| PreserveJobs - do not delete jobs after they finished e.g. to check logs -| bool -| false - -| customServiceConfig -| CustomServiceConfig - customize the service config for all Manila services using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to /etc/++++++/++++++.conf.d directory a custom config file.++++++++++++ +| region +| Region - the region name to use for service endpoint discovery | string -| false - -| extraMounts -| ExtraMounts containing conf files and credentials -| []<> -| false - -| nodeSelector -| NodeSelector to target subset of worker nodes running this service. Setting NodeSelector here acts as a default value and can be overridden by service specific NodeSelector Settings. -| *map[string]string -| false - -| dbPurge -| DBPurge parameters - -| <> -| false - -| apiTimeout -| APITimeout for HAProxy, Apache, and rpc_response_timeout -| int | true -| topologyRef -| TopologyRef to apply the Topology defined by the associated CR referenced by name -| *topologyv1.TopoRef -| false - -| notificationsBusInstance -| RabbitMQ instance name used to request a transportURL that is used for notification purposes -| *string +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> | false -|=== - -<> - -[#manilaspeccore] -==== ManilaSpecCore - -ManilaSpecCore defines the desired state of Manila. This version is used by OpenStackControlplane -|=== -| Field | Description | Scheme | Required - -| manilaAPI -| ManilaAPI - Spec definition for the API service of this Manila deployment -| <> +| serviceAccount +| ServiceAccount - service account name used internally to provide Nova services the default SA name +| string | true -| manilaScheduler -| ManilaScheduler - Spec definition for the Scheduler service of this Manila deployment -| <> +| computeDriver +| ComputeDriver defines which driver to use for controlling virtualization +| string | true -| manilaShares -| ManilaShares - Map of chosen names to spec definitions for the Share(s) service(s) of this Manila deployment -| map[string]<> +| tls +| TLS - Parameters related to the TLS +| tls.Ca +| false + +| defaultConfigOverwrite +| DefaultConfigOverwrite - interface to overwrite default config files like e.g. provider.yaml +| map[string]string +| false + +| noVNCProxyURL +| NoVNCProxyURL is the public URL of the noVNCProxy service for this cell. When set, VNC console access is enabled for this compute service. This is set by the parent NovaCellReconciler based on the cell's NoVNCProxy deployment state. +| *string | false |=== <> -[#manilastatus] -==== ManilaStatus +[#novacomputestatus] +==== NovaComputeStatus -ManilaStatus defines the observed state of Manila +NovaComputeStatus defines the observed state of NovaCompute |=== | Field | Description | Scheme | Required @@ -10269,407 +14585,356 @@ ManilaStatus defines the observed state of Manila | condition.Conditions | false -| databaseHostname -| Manila Database Hostname -| string -| false - -| transportURLSecret -| TransportURLSecret - Secret containing RabbitMQ transportURL -| string -| false - -| notificationsURLSecret -| NotificationsURLSecret - Secret containing RabbitMQ notificationsURL -| *string +| readyCount +| ReadyCount defines the number of replicas ready from NovaCompute +| int32 | false -| manilaAPIReadyCount -| ReadyCount of Manila API instance -| int32 +| networkAttachments +| NetworkAttachments status of the deployment pods +| map[string][]string | false -| manilaSchedulerReadyCount -| ReadyCount of Manila Scheduler instance -| int32 +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) +| int64 | false -| manilaSharesReadyCounts -| ReadyCounts of Manila Share instances -| map[string]int32 +| lastAppliedTopology +| LastAppliedTopology - the last applied Topology +| *topologyv1.TopoRef | false -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) -| int64 +| appliedInputSecretHash +| AppliedInputSecretHash is the hash of the input Secret consumed by the last StatefulSet rollout that has been confirmed ready. It is only updated once the StatefulSet is observed to be running with this input, so a parent CR can correlate readiness with a specific applied input instead of relying on a possibly stale ReadyCondition. +| string | false |=== <> -[#galerabackup] -==== GaleraBackup +[#novacomputetemplate] +==== NovaComputeTemplate -GaleraBackup is the Schema for the galerabackups API +NovaComputeTemplate defines the input parameters specified by the user to create a NovaCompute via higher level CRDs. |=== | Field | Description | Scheme | Required -| metadata -| -| metav1.ObjectMeta -| false +| replicas +| Replicas of the service to run. For ironic.IronicDriver the max replica is 1 +| *int32 +| true -| spec -| -| <> +| nodeSelector +| NodeSelector to target subset of worker nodes running this service. Setting here overrides any global NodeSelector settings within the Nova CR. +| *map[string]string | false -| status -| -| <> +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name +| *topologyv1.TopoRef | false -|=== -<> +| customServiceConfig +| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ +| string +| true -[#galerabackuplist] -==== GaleraBackupList +| defaultConfigOverwrite +| DefaultConfigOverwrite - interface to overwrite default config files like e.g. provider.yaml +| map[string]string +| false -GaleraBackupList contains a list of GaleraBackup +| resources +| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ +| corev1.ResourceRequirements +| false -|=== -| Field | Description | Scheme | Required +| networkAttachments +| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network +| []string +| false -| metadata -| -| metav1.ListMeta +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> | false -| items -| -| []<> +| computeDriver +| ComputeDriver - defines which driver to use for controlling virtualization +| string | true |=== <> -[#galerabackupspec] -==== GaleraBackupSpec +[#conductoroverridespec-2] +==== ConductorOverrideSpec -GaleraBackupSpec defines the desired state of GaleraBackup +ConductorOverrideSpec to override the generated manifest of several child resources. |=== | Field | Description | Scheme | Required -| databaseInstance -| Galera cluster to backup -| string -| false - -| storageClass -| Storage volume for backup data -| string -| false - -| storageRequest -| Storage Request for backup data -| string -| false - -| transferStorage -| Configuration of storage used for intermediate data transfer -| *<> -| false - -| schedule -| The schedule in Cron format -| string -| true - -| retention -| Time duration after which old backups must be reclaimed on disk -| *metav1.Duration +| probes +| Override probes and other common fields in the StatefulSet +| probes.OverrideSpec | false |=== <> -[#galerabackupstatus] -==== GaleraBackupStatus +[#novaconductor] +==== NovaConductor -GaleraBackupStatus defines the observed state of GaleraBackup +NovaConductor is the Schema for the novaconductors API |=== | Field | Description | Scheme | Required -| hash -| Map of hashes to track input changes -| map[string]string +| metadata +| +| metav1.ObjectMeta | false -| conditions -| Deployment Conditions -| condition.Conditions +| spec +| +| <> | false -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) -| int64 +| status +| +| <> | false |=== <> -[#galerabackuptransferstoragespec] -==== GaleraBackupTransferStorageSpec +[#novaconductorlist] +==== NovaConductorList + +NovaConductorList contains a list of NovaConductor |=== | Field | Description | Scheme | Required -| storageClass -| Storage volume for backup data -| string +| metadata +| +| metav1.ListMeta | false -| storageRequest -| Storage Request for backup data -| string +| items +| +| []<> | true |=== <> -[#galera] -==== Galera +[#novaconductorspec] +==== NovaConductorSpec -Galera is the Schema for the galeras API +NovaConductorSpec defines the desired state of NovaConductor |=== | Field | Description | Scheme | Required -| metadata -| -| metav1.ObjectMeta -| false +| cellName +| CellName is the name of the Nova Cell this conductor belongs to. +| string +| true -| spec -| -| <> -| false +| secret +| Secret is the name of the Secret instance containing password information for the nova-conductor service. This secret is expected to be generated by the nova-operator based on the information passed to the Nova CR. +| string +| true -| status -| -| <> -| false -|=== +| serviceUser +| ServiceUser - optional username used for this service to register in keystone +| string +| true -<> +| keystoneAuthURL +| KeystoneAuthURL - the URL that the nova-conductor service can use to talk to keystone +| string +| true -[#galeraattributes] -==== GaleraAttributes +| region +| Region - the region name to use for service endpoint discovery +| string +| true -GaleraAttributes holds startup information for a Galera host +| apiDatabaseAccount +| APIDatabaseAccount - MariaDBAccount to use when accessing the API DB +| string +| true -|=== -| Field | Description | Scheme | Required +| apiDatabaseHostname +| APIDatabaseHostname - hostname to use when accessing the API DB. If not provided then up-calls will be disabled. This filed is Required for cell0. +| string +| true -| uuid -| UUID of the partition that is seen by the galera node +| cellDatabaseAccount +| CellDatabaseAccount - MariaDBAccount to use when accessing the cell DB | string -| false +| true -| seqno -| Last recorded replication sequence number in the DB +| cellDatabaseHostname +| NOTE(gibi): This should be Required, see notes in KeystoneAuthURL CellDatabaseHostname - hostname to use when accessing the cell DB | string | true -| safe_to_bootstrap -| This galera node can bootstrap a galera cluster +| preserveJobs +| PreserveJobs - do not delete jobs after they finished e.g. to check logs | bool -| false +| true -| no_grastate -| This galera node has its state recovered from the DB -| bool +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> | false -| gcomm -| Gcomm URI used to connect to the galera cluster +| serviceAccount +| ServiceAccount - service account name used internally to provide Nova services the default SA name | string +| true + +| tls +| TLS - Parameters related to the TLS +| tls.Ca | false -| containerID -| Identifier of the container at the time the gcomm URI was injected +| memcachedInstance +| MemcachedInstance is the name of the Memcached CR that all nova service will use. | string -| false +| true + +| dbPurge +| DBPurge defines the parameters for the DB archiving and purging cron job +| <> +| true |=== <> -[#galeralist] -==== GaleraList +[#novaconductorstatus] +==== NovaConductorStatus -GaleraList contains a list of Galera +NovaConductorStatus defines the observed state of NovaConductor |=== | Field | Description | Scheme | Required -| metadata -| -| metav1.ListMeta +| hash +| Map of hashes to track e.g. job status +| map[string]string | false -| items -| -| []<> -| true -|=== +| conditions +| Conditions +| condition.Conditions +| false -<> +| readyCount +| ReadyCount defines the number of replicas ready from nova-conductor +| int32 +| false -[#galeraspec] -==== GaleraSpec +| networkAttachments +| NetworkAttachments status of the deployment pods +| map[string][]string +| false -GaleraSpec defines the desired state of Galera +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) +| int64 +| false -|=== -| Field | Description | Scheme | Required +| lastAppliedTopology +| LastAppliedTopology - the last applied Topology +| *topologyv1.TopoRef +| false -| containerImage -| Name of the galera container image to run (will be set to environmental default if empty) +| appliedInputSecretHash +| AppliedInputSecretHash is the hash of the input Secret consumed by the last StatefulSet rollout that has been confirmed ready. It is only updated once the StatefulSet is observed to be running with this input, so a parent CR can correlate readiness with a specific applied input instead of relying on a possibly stale ReadyCondition. | string -| true +| false |=== <> -[#galeraspeccore] -==== GaleraSpecCore +[#novaconductortemplate] +==== NovaConductorTemplate -GaleraSpec defines the desired state of Galera +NovaConductorTemplate defines the input parameters specified by the user to create a NovaConductor via higher level CRDs. |=== | Field | Description | Scheme | Required -| secret -| Name of the secret to look for password keys -| string -| true - -| storageClass -| Storage class to host the mariadb databases -| string -| true - -| storageRequest -| Storage size allocated for the mariadb databases -| string -| true - | replicas -| Size of the galera cluster deployment +| Replicas of the service to run | *int32 | true | nodeSelector -| NodeSelector to target subset of worker nodes running this service +| NodeSelector to target subset of worker nodes running this service. Setting here overrides any global NodeSelector settings within the Nova CR. | *map[string]string | false | customServiceConfig -| Customize config using this parameter to change service defaults, or overwrite rendered information using raw MariaDB config format. The content gets added to /etc/my.cnf.d/galera_custom.cnf +| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ | string -| false +| true -| tls -| TLS settings for MySQL service and internal Galera replication -| tls.SimpleService +| resources +| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ +| corev1.ResourceRequirements | false -| disableNonTLSListeners -| When TLS is configured, only allow connections to the DB over TLS -| bool +| networkAttachments +| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network +| []string | false -| logToDisk -| Log Galera pod's output to disk -| bool -| true - | topologyRef | TopologyRef to apply the Topology defined by the associated CR referenced by name | *topologyv1.TopoRef | false -| resources -| Resources QoS configuration for pods -| corev1.ResourceRequirements +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> | false |=== <> -[#galerastatus] -==== GaleraStatus +[#metadataoverridespec] +==== MetadataOverrideSpec -GaleraStatus defines the observed state of Galera +MetadataOverrideSpec to override the generated manifest of several child resources. |=== | Field | Description | Scheme | Required -| attributes -| A map of database node attributes for each pod -| map[string]<> -| false - -| safeToBootstrap -| Name of the node that can safely bootstrap a cluster -| string -| false - -| bootstrapped -| Is the galera cluster currently running -| bool -| true - -| stopRequired -| Does the galera cluster requires to be stopped globally -| bool -| true - -| clusterProperties -| Map of properties that require full cluster restart if changed -| map[string]string -| false - -| hash -| Map of hashes to track input changes -| map[string]string -| false - -| conditions -| Deployment Conditions -| condition.Conditions -| false - -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) -| int64 +| service +| Override configuration for the Service created to serve traffic to the cluster for internal communication. +| *service.OverrideSpec | false -| lastAppliedTopology -| LastAppliedTopology - the last applied Topology -| *topologyv1.TopoRef +| probes +| Override probe configuration for the service deployment +| probes.OverrideSpec | false |=== <> -[#mariadbaccount] -==== MariaDBAccount +[#novametadata] +==== NovaMetadata -MariaDBAccount is the Schema for the mariadbaccounts API +NovaMetadata is the Schema for the novametadata API |=== | Field | Description | Scheme | Required @@ -10681,21 +14946,21 @@ MariaDBAccount is the Schema for the mariadbaccounts API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#mariadbaccountlist] -==== MariaDBAccountList +[#novametadatalist] +==== NovaMetadataList -MariaDBAccountList contains a list of MariaDBAccount +NovaMetadataList contains a list of NovaMetadata |=== | Field | Description | Scheme | Required @@ -10707,329 +14972,396 @@ MariaDBAccountList contains a list of MariaDBAccount | items | -| []<> +| []<> | true |=== <> -[#mariadbaccountspec] -==== MariaDBAccountSpec +[#novametadataspec] +==== NovaMetadataSpec -MariaDBAccountSpec defines the desired state of MariaDBAccount +NovaMetadataSpec defines the desired state of NovaMetadata |=== | Field | Description | Scheme | Required -| userName -| UserName for new account +| cellName +| CellName is the name of the Nova Cell this metadata service belongs to. If not provided then the metadata serving every cells in the deployment +| string +| false + +| apiTimeout +| APITimeout for Route and Apache +| int +| true + +| secret +| Secret is the name of the Secret instance containing password information for the nova-conductor service. This secret is expected to be generated by the nova-operator based on the information passed to the Nova CR. +| string +| true + +| serviceUser +| ServiceUser - optional username used for this service to register in keystone +| string +| true + +| keystoneAuthURL +| KeystoneAuthURL - the URL that the nova-metadata service can use to talk to keystone +| string +| true + +| region +| Region - the region name to use for service endpoint discovery +| string +| true + +| apiDatabaseAccount +| APIDatabaseAccount - MariaDBAccount to use when accessing the API DB +| string +| true + +| apiDatabaseHostname +| APIDatabaseHostname - hostname to use when accessing the API DB. This filed is Required if the CellName is not provided +| string +| true + +| cellDatabaseAccount +| CellDatabaseAccount - MariaDBAccount to use when accessing the cell DB +| string +| true + +| cellDatabaseHostname +| CellDatabaseHostname - hostname to use when accessing the cell DB This is unused if CellName is not provided. But if it is provided then CellDatabaseHostName is also Required. +| string +| true + +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> +| false + +| serviceAccount +| ServiceAccount - service account name used internally to provide Nova services the default SA name | string | true -| secret -| Name of secret which contains DatabasePassword -| string -| true +| registeredCells +| RegisteredCells is a map keyed by cell names that are registered in the nova_api database with a value that is the hash of the given cell configuration. This is used to detect when a new cell is added or an existing cell is reconfigured to trigger refresh of the in memory cell caches of the service. This is empty for the case when nova-metadata runs within the cell. +| map[string]string +| false -| requireTLS -| Account must use TLS to connect to the database -| bool +| tls +| TLS - Parameters related to the TLS +| tls.SimpleService +| false + +| defaultConfigOverwrite +| DefaultConfigOverwrite - interface to overwrite default config files like e.g. api-paste.ini. +| map[string]string +| false + +| memcachedInstance +| MemcachedInstance is the name of the Memcached CR that all nova service will use. +| string | true |=== <> -[#mariadbaccountstatus] -==== MariaDBAccountStatus +[#novametadatastatus] +==== NovaMetadataStatus -MariaDBAccountStatus defines the observed state of MariaDBAccount +NovaMetadataStatus defines the observed state of NovaMetadata |=== | Field | Description | Scheme | Required -| conditions -| Deployment Conditions -| condition.Conditions -| false - | hash | Map of hashes to track e.g. job status | map[string]string | false -|=== -<> - -[#mariadbdatabase] -==== MariaDBDatabase +| conditions +| Conditions +| condition.Conditions +| false -MariaDBDatabase is the Schema for the mariadbdatabases API +| readyCount +| ReadyCount defines the number of replicas ready from nova-metadata +| int32 +| false -|=== -| Field | Description | Scheme | Required +| networkAttachments +| NetworkAttachments status of the deployment pods +| map[string][]string +| false -| metadata -| -| metav1.ObjectMeta +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) +| int64 | false -| spec -| -| <> +| lastAppliedTopology +| LastAppliedTopology - the last applied Topology +| *topologyv1.TopoRef | false -| status -| -| <> +| appliedInputSecretHash +| AppliedInputSecretHash is the hash of the input Secret consumed by the last StatefulSet rollout that has been confirmed ready. It is only updated once the StatefulSet is observed to be running with this input, so a parent CR can correlate readiness with a specific applied input instead of relying on a possibly stale ReadyCondition. +| string | false |=== <> -[#mariadbdatabaselist] -==== MariaDBDatabaseList +[#novametadatatemplate] +==== NovaMetadataTemplate -MariaDBDatabaseList contains a list of MariaDBDatabase +NovaMetadataTemplate defines the input parameters specified by the user to create a NovaMetadata via higher level CRDs. |=== | Field | Description | Scheme | Required -| metadata -| -| metav1.ListMeta -| false +| enabled +| Enabled - Whether NovaMetadata services should be deployed and managed. If it is set to false then the related NovaMetadata CR will be deleted if exists and owned by a higher level nova CR (Nova or NovaCell). If it exist but not owned by a higher level nova CR then the NovaMetadata CR will not be touched. If it is set to true the a NovaMetadata CR will be created. If there is already a manually created NovaMetadata CR with the relevant name then this operator will not try to update that CR, instead the higher level nova CR will be in error state until the manually create NovaMetadata CR is deleted manually. +| *bool +| true -| items -| -| []<> +| replicas +| Replicas of the service to run +| *int32 | true -|=== -<> +| nodeSelector +| NodeSelector to target subset of worker nodes running this service. Setting here overrides any global NodeSelector settings within the Nova CR. +| *map[string]string +| false -[#mariadbdatabasespec] -==== MariaDBDatabaseSpec +| customServiceConfig +| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ +| string +| true -MariaDBDatabaseSpec defines the desired state of MariaDBDatabase +| defaultConfigOverwrite +| DefaultConfigOverwrite - interface to overwrite default config files like e.g. api-paste.ini. +| map[string]string +| false -|=== -| Field | Description | Scheme | Required +| resources +| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ +| corev1.ResourceRequirements +| false -| secret -| Name of secret which contains DatabasePassword (deprecated) -| *string +| networkAttachments +| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network +| []string | false -| name -| Name of the database in MariaDB -| string +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> | false -| defaultCharacterSet -| Default character set for this database -| string +| tls +| TLS - Parameters related to the TLS +| tls.SimpleService | false -| defaultCollation -| Default collation for this database -| string +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name +| *topologyv1.TopoRef | false |=== <> -[#mariadbdatabasestatus] -==== MariaDBDatabaseStatus +[#novanovncproxy] +==== NovaNoVNCProxy -MariaDBDatabaseStatus defines the observed state of MariaDBDatabase +NovaNoVNCProxy is the Schema for the novanovncproxies API |=== | Field | Description | Scheme | Required -| conditions -| Deployment Conditions -| condition.Conditions -| false - -| completed +| metadata | -| bool +| metav1.ObjectMeta | false -| hash -| Map of hashes to track e.g. job status -| map[string]string +| spec +| +| <> | false -| tlsSupport -| Whether TLS is supported by the DB instance -| bool +| status +| +| <> | false |=== <> -[#apioverridespec-2] -==== APIOverrideSpec +[#novanovncproxylist] +==== NovaNoVNCProxyList -APIOverrideSpec to override the generated manifest of several child resources. +NovaNoVNCProxyList contains a list of NovaNoVNCProxy |=== | Field | Description | Scheme | Required -| service -| Override configuration for the Service created to serve traffic to the cluster. The key must be the endpoint type (public, internal) -| map[service.Endpoint]service.RoutedOverrideSpec +| metadata +| +| metav1.ListMeta | false + +| items +| +| []<> +| true |=== <> -[#neutronapi] -==== NeutronAPI +[#novanovncproxyspec] +==== NovaNoVNCProxySpec -NeutronAPI is the Schema for the neutronapis API +NovaNoVNCProxySpec defines the desired state of NovaNoVNCProxy |=== | Field | Description | Scheme | Required -| metadata -| -| metav1.ObjectMeta -| false +| cellName +| CellName is the name of the Nova Cell this novncproxy belongs to. +| string +| true -| spec -| -| <> -| false +| secret +| Secret is the name of the Secret instance containing password information for the nova-novncproxy service. This secret is expected to be generated by the nova-operator based on the information passed to the Nova CR. +| string +| true -| status -| -| <> -| false -|=== +| serviceUser +| ServiceUser - optional username used for this service to register in keystone +| string +| true -<> +| keystoneAuthURL +| KeystoneAuthURL - the URL that the nova-novncproxy service can use to talk to keystone +| string +| true -[#neutronapilist] -==== NeutronAPIList +| region +| Region - the region name to use for service endpoint discovery +| string +| true -NeutronAPIList contains a list of NeutronAPI +| cellDatabaseAccount +| CellDatabaseAccount - MariaDBAccount to use when accessing the cell DB +| string +| true -|=== -| Field | Description | Scheme | Required +| cellDatabaseHostname +| CellDatabaseHostname - hostname to use when accessing the cell DB +| string +| true -| metadata -| -| metav1.ListMeta +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> | false -| items -| -| []<> +| serviceAccount +| ServiceAccount - service account name used internally to provide Nova services the default SA name +| string +| true + +| tls +| TLS - Parameters related to the TLS +| <> +| true + +| memcachedInstance +| MemcachedInstance is the name of the Memcached CR that all nova service will use. +| string | true |=== <> -[#neutronapispec] -==== NeutronAPISpec +[#novanovncproxystatus] +==== NovaNoVNCProxyStatus -NeutronAPISpec defines the desired state of NeutronAPI +NovaNoVNCProxyStatus defines the observed state of NovaNoVNCProxy |=== | Field | Description | Scheme | Required -| containerImage -| NeutronAPI Container Image URL (will be set to environmental default if empty) -| string -| true -|=== +| hash +| Map of hashes to track e.g. job status +| map[string]string +| false -<> +| conditions +| Conditions +| condition.Conditions +| false -[#neutronapispeccore] -==== NeutronAPISpecCore +| readyCount +| ReadyCount defines the number of replicas ready from nova-novncproxy +| int32 +| false -NeutronAPISpecCore - +| networkAttachments +| NetworkAttachments status of the deployment pods +| map[string][]string +| false -|=== -| Field | Description | Scheme | Required +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) +| int64 +| false -| apiTimeout -| APITimeout for HAProxy, Apache -| int -| true +| lastAppliedTopology +| LastAppliedTopology - the last applied Topology +| *topologyv1.TopoRef +| false -| serviceUser -| ServiceUser - optional username used for this service to register in neutron +| appliedInputSecretHash +| AppliedInputSecretHash is the hash of the input Secret consumed by the last StatefulSet rollout that has been confirmed ready. It is only updated once the StatefulSet is observed to be running with this input, so a parent CR can correlate readiness with a specific applied input instead of relying on a possibly stale ReadyCondition. | string -| true +| false +|=== -| databaseInstance -| MariaDB instance name Right now required by the maridb-operator to get the credentials from the instance to create the DB Might not be required in future -| string -| true +<> -| databaseAccount -| DatabaseAccount - optional MariaDBAccount CR name used for neutron DB, defaults to neutron -| string -| true +[#novanovncproxytemplate] +==== NovaNoVNCProxyTemplate -| rabbitMqClusterName -| RabbitMQ instance name Needed to request a transportURL that is created and used in Neutron -| string -| true +NovaNoVNCProxyTemplate defines the input parameters specified by the user to create a NovaNoVNCProxy via higher level CRDs. -| memcachedInstance -| Memcached instance name. -| string +|=== +| Field | Description | Scheme | Required + +| enabled +| Enabled - Whether NovaNoVNCProxy services should be deployed and managed. If it is set to false then the related NovaNoVNCProxy CR will be deleted if exists and owned by the NovaCell. If it exist but not owned by the NovaCell then the NovaNoVNCProxy will not be touched. If it is set to true the a NovaNoVNCProxy CR will be created. If there is already a manually created NovaNoVNCProxy CR with the relevant name then the cell will not try to update that CR, instead the NovaCell be in error state until the manually create NovaNoVNCProxy CR is deleted by the operator. +| *bool | true | replicas -| Replicas of neutron API to run +| Replicas of the service to run | *int32 | true -| secret -| Secret containing OpenStack password information for NeutronPassword -| string -| true - -| passwordSelectors -| PasswordSelectors - Selectors to identify the ServiceUser password from the Secret -| <> -| true - | nodeSelector | NodeSelector to target subset of worker nodes running this service | *map[string]string | false -| preserveJobs -| PreserveJobs - do not delete jobs after they finished e.g. to check logs -| bool -| true - -| corePlugin -| CorePlugin - Neutron core plugin to use. Using "ml2" if not set. -| string -| true - -| ml2MechanismDrivers -| Ml2MechanismDrivers - list of ml2 drivers to enable. Using {"ovn"} if not set. -| []string -| true - | customServiceConfig -| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ +| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ | string -| false - -| defaultConfigOverwrite -| DefaultConfigOverwrite - interface to overwrite default config files like policy.yaml -| map[string]string -| false +| true | resources | Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ @@ -11041,224 +15373,255 @@ NeutronAPISpecCore - | []string | false -| extraMounts -| ExtraMounts containing conf files -| []<> -| false - | override | Override, provides the ability to override the generated manifest of several child resources. -| <> +| <> | false | tls | TLS - Parameters related to the TLS -| <> -| false +| <> +| true | topologyRef | TopologyRef to apply the Topology defined by the associated CR referenced by name | *topologyv1.TopoRef | false - -| notificationsBusInstance -| NotificationsBusInstance is the name of the RabbitMqCluster CR to select the Message Bus Service instance used by the neutron to publish external notifications. If undefined, the value will be inherited from OpenStackControlPlane. An empty value "" leaves the notification drivers unconfigured and emitting no notifications at all. Avoid colocating it with RabbitMqClusterName used for RPC. -| *string -| false |=== <> -[#neutronapistatus] -==== NeutronAPIStatus +[#tlssection-2] +==== TLSSection -NeutronAPIStatus defines the observed state of NeutronAPI +TLSSection defines the desired state of TLS configuration |=== | Field | Description | Scheme | Required -| readyCount -| ReadyCount of neutron API instances -| int32 -| false - -| hash -| Map of hashes to track e.g. job status -| map[string]string +| service +| Service - Cert secret used for the nova novnc service endpoint +| tls.GenericService | false -| conditions -| Conditions -| condition.Conditions +| vencrypt +| Vencrypt - cert secret containing the x509 certificate to be presented to the VNC server. The CommonName field should match the primary hostname of the controller node. If using a HA deployment, the Organization field can also be configured to a value that is common across all console proxy instances in the deployment. https://docs.openstack.org/nova/latest/admin/remote-console-access.html#novnc-proxy-server-configuration +| tls.GenericService | false +|=== -| databaseHostname -| Neutron Database Hostname -| string -| false +<> -| transportURLSecret -| TransportURLSecret - Secret containing RabbitMQ transportURL -| string -| false +[#vncproxyoverridespec] +==== VNCProxyOverrideSpec -| networkAttachments -| NetworkAttachments status of the deployment pods -| map[string][]string -| false +VNCProxyOverrideSpec to override the generated manifest of several child resources. -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) -| int64 -| false +|=== +| Field | Description | Scheme | Required -| lastAppliedTopology -| LastAppliedTopology - the last applied Topology -| *topologyv1.TopoRef +| service +| Override configuration for the Service created to serve traffic to the cluster. +| *service.RoutedOverrideSpec | false -| notificationsTransportURLSecret -| NotificationsTransportURLSecret - Secret containing external notifications transportURL -| *string +| probes +| Override probe configuration for the service deployment +| probes.OverrideSpec | false |=== <> -[#neutronapitls] -==== NeutronApiTLS +[#novascheduler] +==== NovaScheduler + +NovaScheduler is the Schema for the novaschedulers API |=== | Field | Description | Scheme | Required -| api -| API tls type which encapsulates for API services -| tls.APIService +| metadata +| +| metav1.ObjectMeta | false -| ovn -| Ovn GenericService - holds the secret for the OvnDb client cert -| tls.GenericService +| spec +| +| <> +| false + +| status +| +| <> | false |=== <> -[#neutronextravolmounts] -==== NeutronExtraVolMounts +[#novaschedulerlist] +==== NovaSchedulerList -NeutronExtraVolMounts exposes additional parameters processed by the neutron-operator and defines the common VolMounts structure provided by the main storage module +NovaSchedulerList contains a list of NovaScheduler |=== | Field | Description | Scheme | Required -| name -| -| string -| false - -| region +| metadata | -| string +| metav1.ListMeta | false -| extraVol +| items | -| []storage.VolMounts +| []<> | true |=== <> -[#passwordselector-2] -==== PasswordSelector +[#novaschedulerspec] +==== NovaSchedulerSpec -PasswordSelector to identify the DB and AdminUser password from the Secret +NovaSchedulerSpec defines the desired state of NovaScheduler |=== | Field | Description | Scheme | Required -| service -| Database - Selector to get the neutron service password from the Secret +| secret +| Secret is the name of the Secret instance containing password information for the nova-scheduler service. This secret is expected to be generated by the nova-operator based on the information passed to the Nova CR. +| string +| true + +| serviceUser +| ServiceUser - optional username used for this service to register in keystone +| string +| true + +| keystoneAuthURL +| KeystoneAuthURL - the URL that the nova-scheduler service can use to talk to keystone +| string +| true + +| region +| Region - the region name to use for service endpoint discovery +| string +| true + +| apiDatabaseAccount +| APIDatabaseAccount - MariaDBAccount to use when accessing the API DB +| string +| true + +| apiDatabaseHostname +| APIDatabaseHostname - hostname to use when accessing the API DB | string | true -|=== - -<> - -[#novacellimages] -==== NovaCellImages -|=== -| Field | Description | Scheme | Required - -| conductorContainerImageURL -| ConductorContainerImageURL +| cell0DatabaseAccount +| Cell0DatabaseAccount - MariaDBAccount to use when accessing the cell0 DB | string | true -| metadataContainerImageURL -| MetadataContainerImageURL +| cell0DatabaseHostname +| Cell0DatabaseHostname - hostname to use when accessing the cell0 DB | string | true -| novncproxyContainerImageURL -| NoVNCContainerImageURL +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> +| false + +| serviceAccount +| ServiceAccount - service account name used internally to provide Nova services the default SA name | string | true -| computeContainerImageURL -| NovaComputeContainerImageURL +| registeredCells +| RegisteredCells is a map keyed by cell names that are registered in the nova_api database with a value that is the hash of the given cell configuration. This is used to detect when a new cell is added or an existing cell is reconfigured to trigger refresh of the in memory cell caches of the service. +| map[string]string +| true + +| tls +| TLS - Parameters related to the TLS +| tls.Ca +| false + +| memcachedInstance +| MemcachedInstance is the name of the Memcached CR that all nova service will use. | string | true |=== <> -[#novaimages] -==== NovaImages +[#novaschedulerstatus] +==== NovaSchedulerStatus + +NovaSchedulerStatus defines the observed state of NovaScheduler |=== | Field | Description | Scheme | Required -| apiContainerImageURL -| APIContainerImageURL -| string -| true +| hash +| INSERT ADDITIONAL STATUS FIELD - define observed state of cluster Important: Run "make" to regenerate code after modifying this file Map of hashes to track e.g. job status +| map[string]string +| false -| schedulerContainerImageURL -| SchedulerContainerImageURL +| conditions +| Conditions +| condition.Conditions +| false + +| readyCount +| ReadyCount defines the number of replicas ready from nova-scheduler +| int32 +| false + +| networkAttachments +| NetworkAttachments status of the deployment pods +| map[string][]string +| false + +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) +| int64 +| false + +| lastAppliedTopology +| LastAppliedTopology - the last applied Topology +| *topologyv1.TopoRef +| false + +| appliedInputSecretHash +| AppliedInputSecretHash is the hash of the input Secret consumed by the last StatefulSet rollout that has been confirmed ready. It is only updated once the StatefulSet is observed to be running with this input, so a parent CR can correlate readiness with a specific applied input instead of relying on a possibly stale ReadyCondition. | string -| true +| false |=== <> -[#novaservicebase] -==== NovaServiceBase +[#novaschedulertemplate] +==== NovaSchedulerTemplate -NovaServiceBase contains the fields that are needed for each nova service CRD +NovaSchedulerTemplate defines the input parameters specified by the user to create a NovaScheduler via higher level CRDs. |=== | Field | Description | Scheme | Required -| containerImage -| The service specific Container Image URL (will be set to environmental default if empty) -| string -| true - | replicas | Replicas of the service to run | *int32 | true | nodeSelector -| NodeSelector to target subset of worker nodes running this service +| NodeSelector to target subset of worker nodes running this service. Setting here overrides any global NodeSelector settings within the Nova CR. | *map[string]string | false | customServiceConfig -| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ +| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ | string | true @@ -11276,32 +15639,27 @@ NovaServiceBase contains the fields that are needed for each nova service CRD | TopologyRef to apply the Topology defined by the associated CR referenced by name | *topologyv1.TopoRef | false + +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> +| false |=== <> -[#passwordselector-2] -==== PasswordSelector +[#scheduleroverridespec-2] +==== SchedulerOverrideSpec -PasswordSelector to identify the DB and AdminUser password from the Secret +SchedulerOverrideSpec to override the generated manifest of several child resources. |=== | Field | Description | Scheme | Required -| service -| Service - Selector to get the keystone service user password from the Secret -| string -| true - -| metadataSecret -| MetadataSecret - the name of the field to get the metadata secret from the Secret -| string -| true - -| prefixMetadataCellsSecret -| prefixMetadataCellsSecret - the prefix name of the field to get the metadata secret from the Secret for cells. Vale of metadata_proxy_shared_secret information for the nova-metadata service. This secret is shared between nova and neutron ovn-metadata inside selected cell and if this is not defined the global metadata_proxy_shared_secret secret will be used -| string -| true +| probes +| Override probes and other common fields in the StatefulSet +| probes.OverrideSpec +| false |=== <> @@ -11318,14 +15676,51 @@ APIOverrideSpec to override the generated manifest of several child resources. | Override configuration for the Service created to serve traffic to the cluster. The key must be the endpoint type (public, internal) | map[service.Endpoint]service.RoutedOverrideSpec | false + +| probes +| Override probe configuration for the service deployment +| probes.OverrideSpec +| false |=== <> -[#novaapi] -==== NovaAPI +[#authspec-2] +==== AuthSpec -NovaAPI is the Schema for the novaapis API +AuthSpec defines authentication parameters + +|=== +| Field | Description | Scheme | Required + +| applicationCredentialSecret +| ApplicationCredentialSecret - Secret containing Application Credential ID and Secret +| string +| false +|=== + +<> + +[#passwordselector-2] +==== PasswordSelector + +PasswordSelector to identify the DB and AdminUser password from the Secret + +|=== +| Field | Description | Scheme | Required + +| service +| Service - Selector to get the service user password from the Secret +| string +| true +|=== + +<> + +[#placementapi] +==== PlacementAPI + +PlacementAPI is the Schema for the placementapis API |=== | Field | Description | Scheme | Required @@ -11337,21 +15732,21 @@ NovaAPI is the Schema for the novaapis API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#novaapilist] -==== NovaAPIList +[#placementapilist] +==== PlacementAPIList -NovaAPIList contains a list of NovaAPI +PlacementAPIList contains a list of PlacementAPI |=== | Field | Description | Scheme | Required @@ -11363,28 +15758,39 @@ NovaAPIList contains a list of NovaAPI | items | -| []<> +| []<> | true |=== <> -[#novaapispec] -==== NovaAPISpec +[#placementapispec] +==== PlacementAPISpec -NovaAPISpec defines the desired state of NovaAPI +PlacementAPISpec defines the desired state of PlacementAPI |=== | Field | Description | Scheme | Required -| apiTimeout -| APITimeout for Route and Apache -| int +| containerImage +| PlacementAPI Container Image URL (will be set to environmental default if empty) +| string | true +|=== -| secret -| Secret is the name of the Secret instance containing password information for the nova-api service. This secret is expected to be generated by the nova-operator based on the information passed to the Nova CR. -| string +<> + +[#placementapispeccore] +==== PlacementAPISpecCore + +PlacementAPISpecCore - + +|=== +| Field | Description | Scheme | Required + +| apiTimeout +| APITimeout for HAProxy, Apache +| int | true | serviceUser @@ -11392,77 +15798,97 @@ NovaAPISpec defines the desired state of NovaAPI | string | true -| keystoneAuthURL -| KeystoneAuthURL configures the keystone API endpoint to be used by the service for authentication and authorization -| string -| true - -| keystonePublicAuthURL -| KeystonePublicAuthURL configures the public keystone API endpoint. This can be different from KeystoneAuthURL. The service uses this value to redirect unauthenticated users. +| databaseInstance +| MariaDB instance name Right now required by the maridb-operator to get the credentials from the instance to create the DB Might not be required in future | string | true -| apiDatabaseAccount -| APIDatabaseAccount - MariaDBAccount to use when accessing the API DB +| databaseAccount +| DatabaseAccount - name of MariaDBAccount which will be used to connect. | string | true -| apiDatabaseHostname -| APIDatabaseHostname - hostname to use when accessing the API DB -| string +| replicas +| Replicas of placement API to run +| *int32 | true -| cell0DatabaseAccount -| APIDatabaseAccount - MariaDBAccount to use when accessing the cell0 DB +| secret +| Secret containing OpenStack password information for placement PlacementPassword | string | true -| cell0DatabaseHostname -| APIDatabaseHostname - hostname to use when accessing the cell0 DB -| string +| passwordSelectors +| PasswordSelectors - Selectors to identify the DB and ServiceUser password from the Secret +| <> | true -| override -| Override, provides the ability to override the generated manifest of several child resources. -| <> +| nodeSelector +| NodeSelector to target subset of worker nodes running this service +| *map[string]string | false -| serviceAccount -| ServiceAccount - service account name used internally to provide Nova services the default SA name +| preserveJobs +| PreserveJobs - do not delete jobs after they finished e.g. to check logs +| bool +| true + +| customServiceConfig +| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ | string | true -| registeredCells -| RegisteredCells is a map keyed by cell names that are registered in the nova_api database with a value that is the hash of the given cell configuration. This is used to detect when a new cell is added or an existing cell is reconfigured to trigger refresh of the in memory cell caches of the service. +| defaultConfigOverwrite +| DefaultConfigOverwrite - interface to overwrite default config files like policy.yaml. | map[string]string -| true +| false + +| resources +| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ +| corev1.ResourceRequirements +| false + +| networkAttachments +| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network +| []string +| false + +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> +| false | tls | TLS - Parameters related to the TLS | tls.API | false -| defaultConfigOverwrite -| DefaultConfigOverwrite - interface to overwrite default config files like e.g. api-paste.ini or policy.yaml. -| map[string]string +| auth +| Auth - Parameters related to authentication +| <> | false -| memcachedInstance -| MemcachedInstance is the name of the Memcached CR that all nova service will use. -| string -| true +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name +| *topologyv1.TopoRef +| false |=== <> -[#novaapistatus] -==== NovaAPIStatus +[#placementapistatus] +==== PlacementAPIStatus -NovaAPIStatus defines the observed state of NovaAPI +PlacementAPIStatus defines the observed state of PlacementAPI |=== | Field | Description | Scheme | Required +| readyCount +| ReadyCount of placement API instances +| int32 +| false + | hash | Map of hashes to track e.g. job status | map[string]string @@ -11473,9 +15899,9 @@ NovaAPIStatus defines the observed state of NovaAPI | condition.Conditions | false -| readyCount -| ReadyCount defines the number of replicas ready from nova-api -| int32 +| databaseHostname +| Placement Database Hostname +| string | false | networkAttachments @@ -11484,7 +15910,7 @@ NovaAPIStatus defines the observed state of NovaAPI | false | observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes. | int64 | false @@ -11492,70 +15918,24 @@ NovaAPIStatus defines the observed state of NovaAPI | LastAppliedTopology - the last applied Topology | *topologyv1.TopoRef | false -|=== - -<> - -[#novaapitemplate] -==== NovaAPITemplate - -NovaAPITemplate defines the input parameters specified by the user to create a NovaAPI via higher level CRDs. NOTE(gibi): NovaAPITemplate has the same structure than NovaServiceBase BUT we want to default ContainerImage for the template, therefore the structs are duplicated. - -|=== -| Field | Description | Scheme | Required - -| replicas -| Replicas of the service to run -| *int32 -| true -| nodeSelector -| NodeSelector to target subset of worker nodes running this service. Setting here overrides any global NodeSelector settings within the Nova CR. -| *map[string]string -| false - -| customServiceConfig -| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ +| applicationCredentialSecret +| ApplicationCredentialSecret - the AC secret placement is currently consuming and protecting with the openstack.org/placementapi-ac-consumer finalizer. Tracked so the controller can remove its finalizer from the old secret when the openstack-operator rotates the reference. | string -| true - -| defaultConfigOverwrite -| DefaultConfigOverwrite - interface to overwrite default config files like e.g. api-paste.ini or policy.yaml. -| map[string]string -| false - -| resources -| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ -| corev1.ResourceRequirements -| false - -| networkAttachments -| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network -| []string -| false - -| override -| Override, provides the ability to override the generated manifest of several child resources. -| <> -| false - -| tls -| TLS - Parameters related to the TLS -| tls.API | false -| topologyRef -| TopologyRef to apply the Topology defined by the associated CR referenced by name -| *topologyv1.TopoRef +| appliedInputSecretHash +| AppliedInputSecretHash is the hash of the input Secret consumed by the last Deployment rollout that has been confirmed ready. It is only updated once the Deployment is observed to be running with this input, so consumers can correlate readiness with a specific applied input instead of relying on a possibly stale ReadyCondition. +| string | false |=== <> -[#novacell] -==== NovaCell +[#octaviaamphoracontroller] +==== OctaviaAmphoraController -NovaCell is the Schema for the novacells API +OctaviaAmphoraController is the Schema for the octaviaworkers API |=== | Field | Description | Scheme | Required @@ -11567,185 +15947,235 @@ NovaCell is the Schema for the novacells API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#novacelldbpurge] -==== NovaCellDBPurge +[#octaviaamphoracontrollerlist] +==== OctaviaAmphoraControllerList -NovaCellDBPurge defines the parameters for the DB archiving and purging cron job +OctaviaAmphoraControllerList contains a list of OctaviaWorker |=== | Field | Description | Scheme | Required -| schedule -| Schedule defines when to run the DB maintenance job in a cron format. By default it runs every midnight. -| *string -| true - -| archiveAge -| ArchiveAge defines the minimum age of the records in days that can be moved to the shadow tables. -| *int -| true +| metadata +| +| metav1.ListMeta +| false -| purgeAge -| PurgeAge defines the minimum age of the records in days that can be deleted from the shadow tables -| *int +| items +| +| []<> | true |=== <> -[#novacelllist] -==== NovaCellList +[#octaviaamphoracontrollerspec] +==== OctaviaAmphoraControllerSpec -NovaCellList contains a list of NovaCell +OctaviaAmphoraControllerSpec defines common state for all Octavia Amphora Controllers |=== | Field | Description | Scheme | Required -| metadata -| -| metav1.ListMeta +| containerImage +| ContainerImage - Amphora Controller Container Image URL +| string | false - -| items -| -| []<> -| true |=== <> -[#novacellspec] -==== NovaCellSpec +[#octaviaamphoracontrollerspeccore] +==== OctaviaAmphoraControllerSpecCore -NovaCellSpec defines the desired state of NovaCell +OctaviaAmphoraControllerSpecCore - |=== | Field | Description | Scheme | Required -| cellName -| CellName is the name of the Nova Cell. The value "cell0" has a special meaning. The "cell0" Cell cannot have compute nodes associated and the conductor in this cell acts as the super conductor for all the cells in the deployment. +| databaseInstance +| MariaDB instance name Right now required by the maridb-operator to get the credentials from the instance to create the DB Might not be required in future | string | true -| apiTimeout -| APITimeout for Route and Apache -| int +| databaseAccount +| DatabaseAccount - name of MariaDBAccount which will be used to connect for the main octavia database +| string | true -| secret -| Secret is the name of the Secret instance containing password information for the nova cell. This secret is expected to be generated by the nova-operator based on the information passed to the Nova CR. +| persistenceDatabaseAccount +| PersistenceDatabaseAccount - name of MariaDBAccount which will be used to connect for the persistence database | string | true -| nodeSelector -| NodeSelector to target subset of worker nodes running this services. -| *map[string]string +| databaseHostname +| DatabaseHostname - Octavia DB hostname +| string | false | serviceUser -| ServiceUser - optional username used for this service to register in keystone +| ServiceUser - service user name (TODO: beagles, do we need this at all) | string | true -| keystoneAuthURL -| KeystoneAuthURL - the URL that the service in the cell can use to talk to keystone +| serviceAccount +| ServiceAccount - service account name used internally to provide Octavia services the default SA name | string | true -| apiDatabaseAccount -| APIDatabaseAccount - MariaDBAccount to use when accessing the API DB +| role +| Role - the role for the controller (one of worker, housekeeping, healthmanager) | string | true -| apiDatabaseHostname -| APIDatabaseHostname - hostname to use when accessing the API DB. If not provided then up-calls will be disabled. This filed is Required for cell0. +| secret +| Secret containing OpenStack password information for octavia OctaviaDatabasePassword, AdminPassword | string | true -| cellDatabaseAccount -| CellDatabaseAccount - MariaDBAccount to use when accessing the cell DB +| passwordSelectors +| PasswordSelectors - Selectors to identify the AdminUser password from the Secret +| <> +| false + +| nodeSelector +| NodeSelector to target subset of worker nodes running this service +| *map[string]string +| false + +| customServiceConfig +| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to /etc/++++++/++++++.conf.d as a priority-ordered config file.++++++++++++ | string -| true +| false -| cellDatabaseHostname -| CellDatabaseHostname - hostname to use when accessing the cell DB +| defaultConfigOverwrite +| ConfigOverwrite - interface to overwrite default config files like e.g. logging.conf or policy.json. But can also be used to add additional files. Those get added to the service config dir in /etc/++++++.++++++ +| map[string]string +| false + +| transportURLSecret +| TransportURLSecret - Secret containing RabbitMQ transportURL | string -| true +| false -| preserveJobs -| PreserveJobs - do not delete jobs after they finished e.g. to check logs -| bool +| notificationsTransportURLSecret +| NotificationsTransportURLSecret - Secret containing RabbitMQ notifications transportURL +| string +| false + +| resources +| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ +| corev1.ResourceRequirements +| false + +| networkAttachments +| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network +| []string +| false + +| tenantName +| TenantName - the name of the OpenStack tenant that controls the Octavia resources +| string | true -| conductorServiceTemplate -| ConductorServiceTemplate - defines the cell conductor deployment for the cell -| <> +| tenantDomainName +| TenantDomainName - the name of the OpenStack domain associated with the tenant +| string | true -| metadataServiceTemplate -| MetadataServiceTemplate - defines the metadata service dedicated for the cell. -| <> +| lbMgmtNetworkID +| +| string | true -| noVNCProxyServiceTemplate -| NoVNCProxyServiceTemplate - defines the novncproxy service dedicated for the cell. -| <> +| lbSecurityGroupID +| +| string | true -| novaComputeTemplates -| NovaComputeTemplates - map of nova computes template with selected drivers in format compute_name: compute_template. Key from map is arbitrary name for the compute. because of that there is a 20 character limit on the compute name. -| map[string]<> +| amphoraCustomFlavors +| AmphoraCustomFlavors - User-defined flavors for Octavia +| []<> | false -| serviceAccount -| ServiceAccount - service account name used internally to provide Nova services the default SA name +| createFlavors +| CreateFlavors - when enabled or empty (default), octavia-operator creates Octavia flavors and flavor profiles. Set to disabled to manage Octavia flavors externally. Note: Nova compute flavors for amphorae are always created regardless of this setting. | string -| true +| false + +| amphoraImageOwnerID +| +| string +| false + +| redisHosts +| List of Redis Hosts +| []string +| false | tls | TLS - Parameters related to the TLS | tls.Ca | false -| memcachedInstance -| MemcachedInstance is the name of the Memcached CR that all nova service will use. +| octaviaProviderSubnetGateway +| OctaviaProviderSubnetGateway - | string | true -| dbPurge -| DBPurge defines the parameters for the DB archiving and purging cron job -| <> +| octaviaProviderSubnetCIDR +| OctaviaProviderSubnetCIDR - +| string | true +| octaviaProviderSubnetExtraCIDRs +| OctaviaProviderSubnetExtraCIDRs - +| []string +| false + | topologyRef | TopologyRef to apply the Topology defined by the associated CR referenced by name | *topologyv1.TopoRef | false + +| auth +| Auth - Parameters related to authentication +| <> +| false |=== <> -[#novacellstatus] -==== NovaCellStatus +[#octaviaamphoracontrollerstatus] +==== OctaviaAmphoraControllerStatus -NovaCellStatus defines the observed state of NovaCell +OctaviaAmphoraControllerStatus defines the observed state of the Octavia Amphora Controller |=== | Field | Description | Scheme | Required +| readyCount +| ReadyCount of Octavia Amphora Controllers +| int32 +| false + +| desiredNumberScheduled +| DesiredNumberScheduled - total number of the nodes which should be running Daemon +| int32 +| false + | hash -| INSERT ADDITIONAL STATUS FIELD - define observed state of cluster Important: Run "make" to regenerate code after modifying this file Map of hashes to track e.g. job status +| Map of hashes to track e.g. job status | map[string]string | false @@ -11754,109 +16184,33 @@ NovaCellStatus defines the observed state of NovaCell | condition.Conditions | false -| conductorServiceReadyCount -| ConductorServiceReadyCount defines the number of replicas ready from nova-conductor service in the cell -| int32 -| false - -| metadataServiceReadyCount -| MetadataServiceReadyCount defines the number of replicas ready from nova-metadata service in the cell -| int32 -| false - -| noVNCProxyServiceReadyCount -| NoVNCPRoxyServiceReadyCount defines the number of replicas ready from nova-novncproxy service in the cell -| int32 +| networkAttachments +| NetworkAttachment status of the deployment pods +| map[string][]string | false -| novaComputesStatus -| NovaComputesStatus is a map with format cell_name: NovaComputeCellStatus where NovaComputeCellStatus tell if compute with selected name deployed successfully and indicates if the compute is successfully mapped to the cell in the nova_api database. When a compute is removed from the Spec the operator will delete the related NovaCompute CR and then remove the compute from this Status field. -| map[string]<> +| appliedInputSecretHash +| AppliedInputSecretHash - hash of the input secret names that have been fully rolled out. The parent controller uses this to gate condition mirroring and secret rotation finalization. +| string | false | observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) | int64 | false -|=== - -<> - -[#novacelltemplate] -==== NovaCellTemplate - -NovaCellTemplate defines the input parameters specified by the user to create a NovaCell via higher level CRDs. - -|=== -| Field | Description | Scheme | Required - -| cellDatabaseInstance -| CellDatabaseInstance is the name of the MariaDB CR to select the DB Service instance used as the DB of this cell. -| string -| true - -| cellDatabaseAccount -| CellDatabaseAccount - MariaDBAccount to use when accessing the give cell DB -| string -| true - -| cellMessageBusInstance -| CellMessageBusInstance is the name of the RabbitMqCluster CR to select the Message Bus Service instance used by the nova services to communicate in this cell. For cell0 it is unused. -| string -| true - -| hasAPIAccess -| HasAPIAccess defines if this Cell is configured to have access to the API DB and message bus. -| bool -| true - -| nodeSelector -| NodeSelector to target subset of worker nodes running cell. -| *map[string]string -| false -| topologyRef -| TopologyRef to apply the Topology defined by the associated CR referenced by name +| lastAppliedTopology +| LastAppliedTopology - the last applied Topology | *topologyv1.TopoRef | false - -| conductorServiceTemplate -| ConductorServiceTemplate - defines the cell conductor deployment for the cell. -| <> -| true - -| metadataServiceTemplate -| MetadataServiceTemplate - defines the metadata service dedicated for the cell. Note that for cell0 metadata service should not be deployed. Also if metadata service needs to be deployed per cell here then it should not be enabled to be deployed on the top level via the Nova CR at the same time. By default Nova CR deploys the metadata service at the top level and disables it on the cell level. -| <> -| true - -| noVNCProxyServiceTemplate -| NoVNCProxyServiceTemplate - defines the novncproxy service dedicated for the cell. Note that for cell0 novncproxy should not be deployed so the enabled field of this template is defaulted to false in cell0 but defaulted to true in other cells. -| <> -| true - -| novaComputeTemplates -| NovaComputeTemplates - map of nova computes template with selected drivers in format compute_name: compute_template. Key from map is arbitrary name for the compute with a limit of 20 characters. -| map[string]<> -| false - -| memcachedInstance -| MemcachedInstance is the name of the Memcached CR that the services in the cell will use. If defined then this takes precedence over Nova.Spec.MemcachedInstance for this cel -| string -| true - -| dbPurge -| DBPurge defines the parameters for the DB archiving and purging cron job -| <> -| true |=== <> -[#novacompute] -==== NovaCompute +[#octavia] +==== Octavia -NovaCompute is the Schema for the NovaCompute +Octavia is the Schema for the octavia API |=== | Field | Description | Scheme | Required @@ -11868,334 +16222,357 @@ NovaCompute is the Schema for the NovaCompute | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#novacomputecellstatus] -==== NovaComputeCellStatus - -NovaComputeCellStatus defines state of NovaCompute in cell - -|=== -| Field | Description | Scheme | Required - -| deployed -| Deployed value: true means that the compute is deployed but can still be undiscovered -| bool -| true - -| errors -| Errors value True means that during deployment, errors appear, and the user needs to check the compute for problems -| bool -| true -|=== - -<> - -[#novacomputelist] -==== NovaComputeList +[#octaviaamphoraflavor] +==== OctaviaAmphoraFlavor -NovaComputeList contains a list of NovaCompute +OctaviaAmphoraFlavor Settings for custom Amphora flavors |=== | Field | Description | Scheme | Required -| metadata -| -| metav1.ListMeta -| false - -| items +| name | -| []<> -| true -|=== - -<> - -[#novacomputespec] -==== NovaComputeSpec - -NovaComputeSpec defines the desired state of NovaCompute - -|=== -| Field | Description | Scheme | Required - -| cellName -| CellName is the name of the Nova Cell this NovaCompute belongs to. -| string -| true - -| computeName -| ComputeName - compute name. -| string -| true - -| secret -| Secret is the name of the Secret instance containing password information for the NovaCompute service. This secret is expected to be generated by the nova-operator based on the information passed to the Nova CR. -| string -| true - -| serviceUser -| ServiceUser - optional username used for this service to register in keystone | string | true -| keystoneAuthURL +| description | | string | true -| serviceAccount -| ServiceAccount - service account name used internally to provide Nova services the default SA name -| string -| true - -| computeDriver -| ComputeDriver defines which driver to use for controlling virtualization -| string +| VCPUs +| +| int | true -| tls -| TLS - Parameters related to the TLS -| tls.Ca -| false - -| defaultConfigOverwrite -| DefaultConfigOverwrite - interface to overwrite default config files like e.g. provider.yaml -| map[string]string -| false -|=== - -<> - -[#novacomputestatus] -==== NovaComputeStatus - -NovaComputeStatus defines the observed state of NovaCompute - -|=== -| Field | Description | Scheme | Required - -| hash -| Map of hashes to track e.g. job status -| map[string]string -| false - -| conditions -| Conditions -| condition.Conditions -| false - -| readyCount -| ReadyCount defines the number of replicas ready from NovaCompute -| int32 -| false - -| networkAttachments -| NetworkAttachments status of the deployment pods -| map[string][]string -| false +| RAM +| +| int +| true -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) -| int64 -| false +| disk +| +| int +| true -| lastAppliedTopology -| LastAppliedTopology - the last applied Topology -| *topologyv1.TopoRef -| false +| RxTxFactor +| +| string +| true |=== <> -[#novacomputetemplate] -==== NovaComputeTemplate +[#octavialbmgmtnetworks] +==== OctaviaLbMgmtNetworks -NovaComputeTemplate defines the input parameters specified by the user to create a NovaCompute via higher level CRDs. +OctaviaLbMgmtNetworks Settings for Octavia management networks |=== | Field | Description | Scheme | Required -| replicas -| Replicas of the service to run. For ironic.IronicDriver the max replica is 1 -| *int32 +| manageLbMgmtNetworks +| ManageLbMgmtNetworks - when True, octavia-operator creates the Neutron resources needed for its Management Network +| bool | true -| nodeSelector -| NodeSelector to target subset of worker nodes running this service. Setting here overrides any global NodeSelector settings within the Nova CR. -| *map[string]string -| false +| createDefaultLbMgmtNetwork +| CreateDefaultLbMgmtNetwork - when True, octavia-operator creates a Management Network for the default Availability Zone of the control plane. Can be set to false when deploying OpenStack in DCN mode. +| bool +| true -| topologyRef -| TopologyRef to apply the Topology defined by the associated CR referenced by name -| *topologyv1.TopoRef +| lbMgmtRouterGateway +| LbMgmtRouterGateway is the IP address of the Octavia router on the Provider network, it's optional and used only when the routing informations are not passed through the Network Attachment Definition +| string | false -| customServiceConfig -| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ -| string -| true +| availabilityZones +| Availability zones for the octavia management network resources +| []string +| false -| defaultConfigOverwrite -| DefaultConfigOverwrite - interface to overwrite default config files like e.g. provider.yaml +| availabilityZoneCIDRs +| AvailabilityZoneCIDRs are the CIDRs of each management network associated with an Availability Zone (ex: {"az":"172.34.0.0/24", ...}) | map[string]string | false -| resources -| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ -| corev1.ResourceRequirements +| providerNetworkType +| ProviderNetworkType is the Neutron provider network type for the Octavia provider network. "flat" (default) preserves the in-cluster behaviour; "vlan" creates a VLAN provider network, e.g. to route the management network through dedicated Networker nodes. +| string | false -| networkAttachments -| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network -| []string +| providerPhysicalNetwork +| ProviderPhysicalNetwork is the Neutron physical network name backing the Octavia provider network. Defaults to "octavia" (the in-cluster NIC mapping); set it to the datacentre physnet when using a VLAN provider network extended to Networker nodes. +| string | false -| computeDriver -| ComputeDriver - defines which driver to use for controlling virtualization -| string -| true +| providerSegmentationID +| ProviderSegmentationID is the VLAN ID for the Octavia provider network. Required when ProviderNetworkType is "vlan"; ignored when "flat". +| int +| false |=== <> -[#novaconductor] -==== NovaConductor +[#octavialist] +==== OctaviaList -NovaConductor is the Schema for the novaconductors API +OctaviaList contains a list of Octavia |=== | Field | Description | Scheme | Required | metadata | -| metav1.ObjectMeta -| false - -| spec -| -| <> +| metav1.ListMeta | false -| status +| items | -| <> -| false +| []<> +| true |=== <> -[#novaconductorlist] -==== NovaConductorList +[#octaviaspec] +==== OctaviaSpec -NovaConductorList contains a list of NovaConductor +OctaviaSpec defines the desired state of Octavia |=== | Field | Description | Scheme | Required -| metadata -| -| metav1.ListMeta -| false +| octaviaAPI +| OctaviaAPI - Spec definition for the API service of the Octavia deployment +| <> +| true -| items -| -| []<> +| octaviaHousekeeping +| OctaviaHousekeeping - Spec definition for the Octavia Housekeeping agent for the Octavia deployment +| <> +| true + +| octaviaHealthManager +| OctaviaHousekeeping - Spec definition for the Octavia Housekeeping agent for the Octavia deployment +| <> +| true + +| octaviaWorker +| OctaviaHousekeeping - Spec definition for the Octavia Housekeeping agent for the Octavia deployment +| <> +| true + +| octaviaRsyslog +| OctaviaRsyslog - Spec definition for the Octavia Rsyslog agent for the Octavia deployment +| <> | true |=== <> -[#novaconductorspec] -==== NovaConductorSpec +[#octaviaspecbase] +==== OctaviaSpecBase -NovaConductorSpec defines the desired state of NovaConductor +OctaviaSpecBase - |=== | Field | Description | Scheme | Required -| cellName -| CellName is the name of the Nova Cell this conductor belongs to. +| databaseInstance +| MariaDB instance name Right now required by the maridb-operator to get the credentials from the instance to create the DB Might not be required in future | string | true -| secret -| Secret is the name of the Secret instance containing password information for the nova-conductor service. This secret is expected to be generated by the nova-operator based on the information passed to the Nova CR. +| databaseAccount +| DatabaseAccount - name of MariaDBAccount which will be used to connect for the main octavia database +| string +| true + +| persistenceDatabaseAccount +| PersistenceDatabaseAccount - name of MariaDBAccount which will be used to connect for the persistence database | string | true +| rabbitMqClusterName +| RabbitMQ instance name Needed to request a transportURL that is created and used in Octavia Deprecated: Use MessagingBus.Cluster instead +| string +| false + +| messagingBus +| MessagingBus configuration (cluster, username, and vhost) +| rabbitmqv1.RabbitMqConfig +| false + +| notificationsBus +| NotificationsBus configuration (cluster, username, and vhost) for a dedicated notifications RabbitMQ cluster +| *rabbitmqv1.RabbitMqConfig +| false + | serviceUser -| ServiceUser - optional username used for this service to register in keystone +| ServiceUser - service user name | string | true -| keystoneAuthURL -| KeystoneAuthURL - the URL that the nova-conductor service can use to talk to keystone +| secret +| Secret containing OpenStack password information for octavia's keystone password; no longer used for database password | string | true -| apiDatabaseAccount -| APIDatabaseAccount - MariaDBAccount to use when accessing the API DB +| passwordSelectors +| PasswordSelectors - Selectors to identify the DB and ServiceUser password from the Secret +| <> +| false + +| nodeSelector +| NodeSelector to target subset of worker nodes running this service +| *map[string]string +| false + +| preserveJobs +| PreserveJobs - do not delete jobs after they finished e.g. to check logs +| bool +| false + +| customServiceConfig +| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to /etc/++++++/++++++.conf.d as a priority-ordered config file.++++++++++++ +| string +| false + +| defaultConfigOverwrite +| ConfigOverwrite - interface to overwrite default config files like e.g. logging.conf or policy.json. But can also be used to add additional files. Those get added to the service config dir in /etc/++++++.++++++ +| map[string]string +| false + +| tenantName +| TenantName - the name of the OpenStack tenant that controls the Octavia resources | string | true -| apiDatabaseHostname -| APIDatabaseHostname - hostname to use when accessing the API DB. If not provided then up-calls will be disabled. This filed is Required for cell0. +| tenantDomainName +| TenantDomainName - the name of the OpenStack domain associated with the tenant | string | true -| cellDatabaseAccount -| CellDatabaseAccount - MariaDBAccount to use when accessing the cell DB +| lbMgmtNetwork +| +| <> +| true + +| sshPubkey +| LoadBalancerSSHPubKey - The name of the ConfigMap containing the pubilc key for connecting to the amphorae via SSH +| string +| false + +| sshPrivkeySecret +| LoadBalancerSSHPrivKey - The name of the secret that will be used to store the private key for connecting to amphorae via SSH +| string +| false + +| amphoraCustomFlavors +| AmphoraCustomFlavors - User-defined flavors for Octavia +| []<> +| false + +| createFlavors +| CreateFlavors - when enabled or empty (default), octavia-operator creates Octavia flavors and flavor profiles. Set to disabled to manage Octavia flavors externally. Note: Nova compute flavors for amphorae are always created regardless of this setting. +| string +| false + +| resources +| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ +| corev1.ResourceRequirements +| false + +| amphoraImageContainerImage +| Octavia Container Image URL +| string +| true + +| apacheContainerImage +| Apache Container Image URL +| string +| true + +| apiTimeout +| Octavia API timeout +| int +| true + +| octaviaNetworkAttachment +| OctaviaNetworkAttachment is a NetworkAttachment resource name for the Octavia Management Network +| string +| true + +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name +| *topologyv1.TopoRef +| false + +| redisServiceName +| Name of the Redis database for Jobboard | string | true -| cellDatabaseHostname -| NOTE(gibi): This should be Required, see notes in KeystoneAuthURL CellDatabaseHostname - hostname to use when accessing the cell DB -| string -| true +| auth +| Auth - Parameters related to authentication (shared by all Octavia components) +| <> +| false +|=== + +<> + +[#octaviaspeccore] +==== OctaviaSpecCore + +OctaviaSpecCore - this version has no containerImages and is used by OpenStackControlplane + +|=== +| Field | Description | Scheme | Required -| preserveJobs -| PreserveJobs - do not delete jobs after they finished e.g. to check logs -| bool +| octaviaAPI +| OctaviaAPI - Spec definition for the API service of the Octavia deployment +| <> | true -| serviceAccount -| ServiceAccount - service account name used internally to provide Nova services the default SA name -| string +| octaviaHousekeeping +| OctaviaHousekeeping - Spec definition for the Octavia Housekeeping agent for the Octavia deployment +| <> | true -| tls -| TLS - Parameters related to the TLS -| tls.Ca -| false +| octaviaHealthManager +| OctaviaHousekeeping - Spec definition for the Octavia Housekeeping agent for the Octavia deployment +| <> +| true -| memcachedInstance -| MemcachedInstance is the name of the Memcached CR that all nova service will use. -| string +| octaviaWorker +| OctaviaHousekeeping - Spec definition for the Octavia Housekeeping agent for the Octavia deployment +| <> | true -| dbPurge -| DBPurge defines the parameters for the DB archiving and purging cron job -| <> +| octaviaRsyslog +| OctaviaRsyslog - Spec definition for the Octavia Rsyslog agent for the Octavia deployment +| <> | true |=== <> -[#novaconductorstatus] -==== NovaConductorStatus +[#octaviastatus] +==== OctaviaStatus -NovaConductorStatus defines the observed state of NovaConductor +OctaviaStatus defines the observed state of Octavia |=== | Field | Description | Scheme | Required @@ -12210,90 +16587,116 @@ NovaConductorStatus defines the observed state of NovaConductor | condition.Conditions | false -| readyCount -| ReadyCount defines the number of replicas ready from nova-conductor +| databaseHostname +| Octavia Database Hostname +| string +| false + +| transportURLSecret +| TransportURLSecret - Secret containing RabbitMQ transportURL +| string +| false + +| notificationsTransportURLSecret +| NotificationsTransportURLSecret - Secret containing RabbitMQ notifications transportURL +| string +| false + +| apireadyCount +| ReadyCount of octavia API instances | int32 | false -| networkAttachments -| NetworkAttachments status of the deployment pods -| map[string][]string +| workerreadyCount +| ReadyCount of octavia Worker instances +| int32 | false -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) -| int64 +| housekeepingreadyCount +| ReadyCount of octavia Housekeeping instances +| int32 | false -| lastAppliedTopology -| LastAppliedTopology - the last applied Topology -| *topologyv1.TopoRef +| healthmanagerreadyCount +| ReadyCount of octavia HealthManager instances +| int32 +| false + +| rsyslogreadyCount +| ReadyCount of octavia Rsyslog instances +| int32 +| false + +| redisHosts +| List of Redis Hosts +| []string +| false + +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) +| int64 | false |=== <> -[#novaconductortemplate] -==== NovaConductorTemplate +[#passwordselector-2] +==== PasswordSelector -NovaConductorTemplate defines the input parameters specified by the user to create a NovaConductor via higher level CRDs. +PasswordSelector to identify the DB and AdminUser password from the Secret |=== | Field | Description | Scheme | Required -| replicas -| Replicas of the service to run -| *int32 -| true - -| nodeSelector -| NodeSelector to target subset of worker nodes running this service. Setting here overrides any global NodeSelector settings within the Nova CR. -| *map[string]string +| database +| Database - Selector to get the octavia Database user password from the Secret +| string | false -| customServiceConfig -| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ +| service +| Service - Selector to get the service user password from the Secret | string -| true - -| resources -| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ -| corev1.ResourceRequirements | false +|=== -| networkAttachments -| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network -| []string -| false +<> -| topologyRef -| TopologyRef to apply the Topology defined by the associated CR referenced by name -| *topologyv1.TopoRef +[#apioverridespec-2] +==== APIOverrideSpec + +APIOverrideSpec to override the generated manifest of several child resources. + +|=== +| Field | Description | Scheme | Required + +| service +| Override configuration for the Service created to serve traffic to the cluster. The key must be the endpoint type (public, internal) +| map[service.Endpoint]service.RoutedOverrideSpec | false |=== <> -[#metadataoverridespec] -==== MetadataOverrideSpec +[#authspec-2] +==== AuthSpec -MetadataOverrideSpec to override the generated manifest of several child resources. +AuthSpec defines authentication parameters |=== | Field | Description | Scheme | Required -| service -| Override configuration for the Service created to serve traffic to the cluster for internal communication. -| *service.OverrideSpec +| applicationCredentialSecret +| ApplicationCredentialSecret - Secret containing Application Credential ID and Secret +| string | false |=== <> -[#novametadata] -==== NovaMetadata +[#octaviaapi] +==== OctaviaAPI -NovaMetadata is the Schema for the novametadata API +OctaviaAPI is the Schema for the octaviaapis API |=== | Field | Description | Scheme | Required @@ -12305,21 +16708,21 @@ NovaMetadata is the Schema for the novametadata API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#novametadatalist] -==== NovaMetadataList +[#octaviaapilist] +==== OctaviaAPIList -NovaMetadataList contains a list of NovaMetadata +OctaviaAPIList contains a list of OctaviaAPI |=== | Field | Description | Scheme | Required @@ -12331,106 +16734,172 @@ NovaMetadataList contains a list of NovaMetadata | items | -| []<> +| []<> | true |=== <> -[#novametadataspec] -==== NovaMetadataSpec +[#octaviaapispec] +==== OctaviaAPISpec -NovaMetadataSpec defines the desired state of NovaMetadata +OctaviaAPISpec defines the desired state of OctaviaAPI |=== | Field | Description | Scheme | Required -| cellName -| CellName is the name of the Nova Cell this metadata service belongs to. If not provided then the metadata serving every cells in the deployment +| containerImage +| Octavia Container Image URL | string -| false - -| apiTimeout -| APITimeout for Route and Apache -| int | true +|=== -| secret -| Secret is the name of the Secret instance containing password information for the nova-conductor service. This secret is expected to be generated by the nova-operator based on the information passed to the Nova CR. +<> + +[#octaviaapispeccore] +==== OctaviaAPISpecCore + +OctaviaAPISpecCore - + +|=== +| Field | Description | Scheme | Required + +| databaseInstance +| MariaDB instance name Right now required by the maridb-operator to get the credentials from the instance to create the DB Might not be required in future | string | true -| serviceUser -| ServiceUser - optional username used for this service to register in keystone +| databaseAccount +| DatabaseAccount - name of MariaDBAccount which will be used to connect for the main octavia database | string | true -| keystoneAuthURL -| KeystoneAuthURL - the URL that the nova-metadata service can use to talk to keystone +| persistenceDatabaseAccount +| PersistenceDatabaseAccount - name of MariaDBAccount which will be used to connect for the persistence database | string | true -| apiDatabaseAccount -| APIDatabaseAccount - MariaDBAccount to use when accessing the API DB +| databaseHostname +| DatabaseHostname - Octavia DB hostname +| string +| false + +| serviceUser +| ServiceUser - service user name | string | true -| apiDatabaseHostname -| APIDatabaseHostname - hostname to use when accessing the API DB. This filed is Required if the CellName is not provided +| serviceAccount +| ServiceAccount - service account name used internally to provide Octavia services the default SA name | string | true -| cellDatabaseAccount -| CellDatabaseAccount - MariaDBAccount to use when accessing the cell DB +| replicas +| Replicas of octavia API to run +| *int32 +| true + +| secret +| Secret containing OpenStack password information for octavia OctaviaDatabasePassword, AdminPassword | string | true -| cellDatabaseHostname -| CellDatabaseHostname - hostname to use when accessing the cell DB This is unused if CellName is not provided. But if it is provided then CellDatabaseHostName is also Required. +| passwordSelectors +| PasswordSelectors - Selectors to identify the DB and ServiceUser password from the Secret +| <> +| false + +| nodeSelector +| NodeSelector to target subset of worker nodes running this service +| *map[string]string +| false + +| preserveJobs +| PreserveJobs - do not delete jobs after they finished e.g. to check logs +| bool +| false + +| customServiceConfig +| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to /etc/++++++/++++++.conf.d as a priority-ordered config file.++++++++++++ +| string +| false + +| defaultConfigOverwrite +| ConfigOverwrite - interface to overwrite default config files like e.g. logging.conf or policy.json. But can also be used to add additional files. Those get added to the service config dir in /etc/++++++.++++++ +| map[string]string +| false + +| transportURLSecret +| TransportURLSecret - Secret containing RabbitMQ transportURL +| string +| false + +| notificationsTransportURLSecret +| NotificationsTransportURLSecret - Secret containing RabbitMQ notifications transportURL | string -| true +| false + +| resources +| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ +| corev1.ResourceRequirements +| false | override | Override, provides the ability to override the generated manifest of several child resources. -| <> +| <> | false -| serviceAccount -| ServiceAccount - service account name used internally to provide Nova services the default SA name +| networkAttachments +| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network +| []string +| false + +| tenantName +| TenantName - the name of the OpenStack tenant that controls the Octavia resources | string | true -| registeredCells -| RegisteredCells is a map keyed by cell names that are registered in the nova_api database with a value that is the hash of the given cell configuration. This is used to detect when a new cell is added or an existing cell is reconfigured to trigger refresh of the in memory cell caches of the service. This is empty for the case when nova-metadata runs within the cell. -| map[string]string -| false +| tenantDomainName +| TenantDomainName - the name of the OpenStack domain associated with the tenant +| string +| true | tls | TLS - Parameters related to the TLS -| tls.SimpleService +| <> | false -| defaultConfigOverwrite -| DefaultConfigOverwrite - interface to overwrite default config files like e.g. api-paste.ini. -| map[string]string +| auth +| Auth - Parameters related to authentication +| <> | false -| memcachedInstance -| MemcachedInstance is the name of the Memcached CR that all nova service will use. -| string +| apiTimeout +| APITimeout for HAProxy and Apache defaults to OctaviaSpecCore APITimeout (seconds) +| int | true + +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name +| *topologyv1.TopoRef +| false |=== <> -[#novametadatastatus] -==== NovaMetadataStatus +[#octaviaapistatus] +==== OctaviaAPIStatus -NovaMetadataStatus defines the observed state of NovaMetadata +OctaviaAPIStatus defines the observed state of OctaviaAPI |=== | Field | Description | Scheme | Required +| readyCount +| ReadyCount of octavia API instances +| int32 +| false + | hash | Map of hashes to track e.g. job status | map[string]string @@ -12441,18 +16910,23 @@ NovaMetadataStatus defines the observed state of NovaMetadata | condition.Conditions | false -| readyCount -| ReadyCount defines the number of replicas ready from nova-metadata -| int32 -| false - | networkAttachments -| NetworkAttachments status of the deployment pods +| NetworkAttachment status of the deployment pods | map[string][]string | false +| applicationCredentialSecret +| ApplicationCredentialSecret - the AC secret OctaviaAPI is currently consuming and protecting with the openstack.org/octaviaapi-ac-consumer finalizer. Tracked so the controller can remove its finalizer from the old secret when the openstack-operator rotates the reference. +| string +| false + +| appliedInputSecretHash +| AppliedInputSecretHash - hash of the input secret names that have been fully rolled out. The parent controller uses this to gate condition mirroring and secret rotation finalization. +| string +| false + | observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) | int64 | false @@ -12464,71 +16938,29 @@ NovaMetadataStatus defines the observed state of NovaMetadata <> -[#novametadatatemplate] -==== NovaMetadataTemplate - -NovaMetadataTemplate defines the input parameters specified by the user to create a NovaMetadata via higher level CRDs. +[#octaviaapitls] +==== OctaviaApiTLS |=== | Field | Description | Scheme | Required -| enabled -| Enabled - Whether NovaMetadata services should be deployed and managed. If it is set to false then the related NovaMetadata CR will be deleted if exists and owned by a higher level nova CR (Nova or NovaCell). If it exist but not owned by a higher level nova CR then the NovaMetadata CR will not be touched. If it is set to true the a NovaMetadata CR will be created. If there is already a manually created NovaMetadata CR with the relevant name then this operator will not try to update that CR, instead the higher level nova CR will be in error state until the manually create NovaMetadata CR is deleted manually. -| *bool -| true - -| replicas -| Replicas of the service to run -| *int32 -| true - -| nodeSelector -| NodeSelector to target subset of worker nodes running this service. Setting here overrides any global NodeSelector settings within the Nova CR. -| *map[string]string -| false - -| customServiceConfig -| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ -| string -| true - -| defaultConfigOverwrite -| DefaultConfigOverwrite - interface to overwrite default config files like e.g. api-paste.ini. -| map[string]string -| false - -| resources -| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ -| corev1.ResourceRequirements -| false - -| networkAttachments -| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network -| []string -| false - -| override -| Override, provides the ability to override the generated manifest of several child resources. -| <> -| false - -| tls -| TLS - Parameters related to the TLS -| tls.SimpleService +| api +| API tls type which encapsulates for API services +| tls.APIService | false -| topologyRef -| TopologyRef to apply the Topology defined by the associated CR referenced by name -| *topologyv1.TopoRef +| ovn +| Ovn GenericService - holds the secret for the OvnDb client cert +| tls.GenericService | false |=== <> -[#novanovncproxy] -==== NovaNoVNCProxy +[#octaviarsyslog] +==== OctaviaRsyslog -NovaNoVNCProxy is the Schema for the novanovncproxies API +OctaviaRsyslog is the Schema for the octaviaworkers API |=== | Field | Description | Scheme | Required @@ -12540,21 +16972,21 @@ NovaNoVNCProxy is the Schema for the novanovncproxies API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#novanovncproxylist] -==== NovaNoVNCProxyList +[#octaviarsysloglist] +==== OctaviaRsyslogList -NovaNoVNCProxyList contains a list of NovaNoVNCProxy +OctaviaRsyslogList contains a list of OctaviaWorker |=== | Field | Description | Scheme | Required @@ -12566,81 +16998,122 @@ NovaNoVNCProxyList contains a list of NovaNoVNCProxy | items | -| []<> +| []<> | true |=== <> -[#novanovncproxyspec] -==== NovaNoVNCProxySpec +[#octaviarsyslogspec] +==== OctaviaRsyslogSpec -NovaNoVNCProxySpec defines the desired state of NovaNoVNCProxy +OctaviaRsyslogSpec defines common state for all Octavia Amphora Controllers |=== | Field | Description | Scheme | Required -| cellName -| CellName is the name of the Nova Cell this novncproxy belongs to. +| containerImage +| ContainerImage - Rsyslog Container Image URL | string -| true +| false -| secret -| Secret is the name of the Secret instance containing password information for the nova-novncproxy service. This secret is expected to be generated by the nova-operator based on the information passed to the Nova CR. +| initContainerImage +| InitContainerImage - Rsyslog init Container Image URL for | string -| true +| false +|=== + +<> + +[#octaviarsyslogspeccore] +==== OctaviaRsyslogSpecCore + +OctaviaRsyslogSpecCore - + +|=== +| Field | Description | Scheme | Required | serviceUser -| ServiceUser - optional username used for this service to register in keystone +| ServiceUser - service user name (TODO: beagles, do we need this at all) | string | true -| keystoneAuthURL -| KeystoneAuthURL - the URL that the nova-novncproxy service can use to talk to keystone +| serviceAccount +| ServiceAccount - service account name used internally to provide Octavia services the default SA name | string | true -| cellDatabaseAccount -| CellDatabaseAccount - MariaDBAccount to use when accessing the cell DB -| string -| true +| nodeSelector +| NodeSelector to target subset of worker nodes running this service +| *map[string]string +| false -| cellDatabaseHostname -| CellDatabaseHostname - hostname to use when accessing the cell DB -| string -| true +| defaultConfigOverwrite +| ConfigOverwrite - interface to overwrite default config files like e.g. logging.conf or policy.json. But can also be used to add additional files. Those get added to the service config dir in /etc/++++++.++++++ +| map[string]string +| false -| override -| Override, provides the ability to override the generated manifest of several child resources. -| <> +| resources +| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ +| corev1.ResourceRequirements | false -| serviceAccount -| ServiceAccount - service account name used internally to provide Nova services the default SA name -| string -| true +| networkAttachments +| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network +| []string +| false -| tls -| TLS - Parameters related to the TLS -| <> +| adminLogTargets +| AdminLogTargets is a list of OctaviaRsyslogTarget, the admin logs are forwarded to those targets. Use only when forwarding to an external Rsyslog server. +| []<> +| false + +| tenantLogTargets +| TenantLogTargets is a list of OctaviaRsyslogTarget, the tenant logs are forwarded to those targets. Use only when forwarding to an external Rsyslog server. +| []<> +| false + +| octaviaProviderSubnetGateway +| OctaviaProviderSubnetGateway - +| string | true -| memcachedInstance -| MemcachedInstance is the name of the Memcached CR that all nova service will use. +| octaviaProviderSubnetCIDR +| OctaviaProviderSubnetCIDR - | string | true + +| octaviaProviderSubnetExtraCIDRs +| OctaviaProviderSubnetExtraCIDRs - +| []string +| false + +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name +| *topologyv1.TopoRef +| false |=== <> -[#novanovncproxystatus] -==== NovaNoVNCProxyStatus +[#octaviarsyslogstatus] +==== OctaviaRsyslogStatus -NovaNoVNCProxyStatus defines the observed state of NovaNoVNCProxy +OctaviaRsyslogStatus defines the observed state of the Octavia Amphora Controller |=== | Field | Description | Scheme | Required +| readyCount +| ReadyCount of Octavia Amphora Controllers +| int32 +| false + +| desiredNumberScheduled +| DesiredNumberScheduled - total number of the nodes which should be running Daemon +| int32 +| false + | hash | Map of hashes to track e.g. job status | map[string]string @@ -12651,18 +17124,13 @@ NovaNoVNCProxyStatus defines the observed state of NovaNoVNCProxy | condition.Conditions | false -| readyCount -| ReadyCount defines the number of replicas ready from nova-novncproxy -| int32 -| false - | networkAttachments -| NetworkAttachments status of the deployment pods +| NetworkAttachment status of the deployment pods | map[string][]string | false | observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) | int64 | false @@ -12674,298 +17142,357 @@ NovaNoVNCProxyStatus defines the observed state of NovaNoVNCProxy <> -[#novanovncproxytemplate] -==== NovaNoVNCProxyTemplate - -NovaNoVNCProxyTemplate defines the input parameters specified by the user to create a NovaNoVNCProxy via higher level CRDs. +[#octaviarsyslogtarget] +==== OctaviaRsyslogTarget |=== | Field | Description | Scheme | Required -| enabled -| Enabled - Whether NovaNoVNCProxy services should be deployed and managed. If it is set to false then the related NovaNoVNCProxy CR will be deleted if exists and owned by the NovaCell. If it exist but not owned by the NovaCell then the NovaNoVNCProxy will not be touched. If it is set to true the a NovaNoVNCProxy CR will be created. If there is already a manually created NovaNoVNCProxy CR with the relevant name then the cell will not try to update that CR, instead the NovaCell be in error state until the manually create NovaNoVNCProxy CR is deleted by the operator. -| *bool +| host +| +| string | true -| replicas -| Replicas of the service to run -| *int32 +| port +| +| int | true -| nodeSelector -| NodeSelector to target subset of worker nodes running this service -| *map[string]string -| false - -| customServiceConfig -| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ +| protocol +| | string | true +|=== -| resources -| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ -| corev1.ResourceRequirements -| false +<> -| networkAttachments -| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network +[#bondconfig] +==== BondConfig + +BondConfig defines the bonding configuration for network interfaces + +|=== +| Field | Description | Scheme | Required + +| bondInterfaces +| BondInterfaces - List of physical interfaces to bond | []string +| true + +| bondMode +| BondMode - Bonding mode (e.g., active-backup, 802.3ad) +| string | false -| override -| Override, provides the ability to override the generated manifest of several child resources. -| <> +| bondOptions +| BondOptions - Additional bonding options as key-value pairs +| map[string]string | false +|=== -| tls -| TLS - Parameters related to the TLS -| <> -| true +<> -| topologyRef -| TopologyRef to apply the Topology defined by the associated CR referenced by name -| *topologyv1.TopoRef +[#cpucountreq] +==== CPUCountReq + +CPUCountReq defines a specific hardware request for CPU core count + +|=== +| Field | Description | Scheme | Required + +| count +| +| int +| false + +| exactMatch +| If ExactMatch == false, actual count > Count will match +| bool | false |=== <> -[#tlssection-2] -==== TLSSection +[#cpumhzreq] +==== CPUMhzReq -TLSSection defines the desired state of TLS configuration +CPUMhzReq defines a specific hardware request for CPU clock speed |=== | Field | Description | Scheme | Required -| service -| Service - Cert secret used for the nova novnc service endpoint -| tls.GenericService +| mhz +| +| int | false -| vencrypt -| Vencrypt - cert secret containing the x509 certificate to be presented to the VNC server. The CommonName field should match the primary hostname of the controller node. If using a HA deployment, the Organization field can also be configured to a value that is common across all console proxy instances in the deployment. https://docs.openstack.org/nova/latest/admin/remote-console-access.html#novnc-proxy-server-configuration -| tls.GenericService +| exactMatch +| If ExactMatch == false, actual mhz > Mhz will match +| bool | false |=== <> -[#vncproxyoverridespec] -==== VNCProxyOverrideSpec +[#cpureqs] +==== CPUReqs -VNCProxyOverrideSpec to override the generated manifest of several child resources. +CPUReqs defines specific CPU hardware requests |=== | Field | Description | Scheme | Required -| service -| Override configuration for the Service created to serve traffic to the cluster. -| *service.RoutedOverrideSpec +| arch +| Arch is a scalar (string) because it wouldn't make sense to give it an "exact-match" option Can be either "x86_64" or "ppc64le" if included +| string +| false + +| countReq +| +| <> +| false + +| mhzReq +| +| <> | false |=== <> -[#novascheduler] -==== NovaScheduler +[#diskgbreq] +==== DiskGbReq -NovaScheduler is the Schema for the novaschedulers API +DiskGbReq defines a specific hardware request for disk size |=== | Field | Description | Scheme | Required -| metadata +| gb | -| metav1.ObjectMeta +| int | false -| spec +| exactMatch +| If ExactMatch == false, actual GB > Gb will match +| bool +| false +|=== + +<> + +[#diskreqs] +==== DiskReqs + +DiskReqs defines specific disk hardware requests + +|=== +| Field | Description | Scheme | Required + +| gbReq | -| <> +| <> | false -| status +| ssdReq +| SSD is scalar (bool) because it wouldn't make sense to give it an "exact-match" option +| <> +| false +|=== + +<> + +[#diskssdreq] +==== DiskSSDReq + +DiskSSDReq defines a specific hardware request for disk of type SSD (true) or rotational (false) + +|=== +| Field | Description | Scheme | Required + +| ssd | -| <> +| bool +| false + +| exactMatch +| We only actually care about SSD flag if it is true or ExactMatch is set to true. This second flag is necessary as SSD's bool zero-value (false) is indistinguishable from it being explicitly set to false +| bool | false |=== <> -[#novaschedulerlist] -==== NovaSchedulerList +[#hardwarereqs] +==== HardwareReqs -NovaSchedulerList contains a list of NovaScheduler +HardwareReqs defines request hardware attributes for the BaremetalHost replicas |=== | Field | Description | Scheme | Required -| metadata +| cpuReqs | -| metav1.ListMeta +| <> | false -| items +| memReqs | -| []<> -| true +| <> +| false + +| diskReqs +| +| <> +| false |=== <> -[#novaschedulerspec] -==== NovaSchedulerSpec +[#hoststatus] +==== HostStatus -NovaSchedulerSpec defines the desired state of NovaScheduler +HostStatus represents the IPStatus and provisioning state + deployment information |=== | Field | Description | Scheme | Required -| secret -| Secret is the name of the Secret instance containing password information for the nova-scheduler service. This secret is expected to be generated by the nova-operator based on the information passed to the Nova CR. -| string +| provisioningState +| +| ProvisioningState | true -| serviceUser -| ServiceUser - optional username used for this service to register in keystone -| string +| annotatedForDeletion +| Host annotated for deletion +| bool | true -| keystoneAuthURL -| KeystoneAuthURL - the URL that the nova-scheduler service can use to talk to keystone +| userDataSecretName +| | string | true -| apiDatabaseAccount -| APIDatabaseAccount - MariaDBAccount to use when accessing the API DB +| networkDataSecretName +| | string | true +|=== -| apiDatabaseHostname -| APIDatabaseHostname - hostname to use when accessing the API DB -| string -| true +<> -| cell0DatabaseAccount -| Cell0DatabaseAccount - MariaDBAccount to use when accessing the cell0 DB -| string -| true +[#ipstatus] +==== IPStatus -| cell0DatabaseHostname -| Cell0DatabaseHostname - hostname to use when accessing the cell0 DB +IPStatus represents the hostname and IP info for a specific host + +|=== +| Field | Description | Scheme | Required + +| hostname +| | string | true -| serviceAccount -| ServiceAccount - service account name used internally to provide Nova services the default SA name +| bmhRef +| | string | true -| registeredCells -| RegisteredCells is a map keyed by cell names that are registered in the nova_api database with a value that is the hash of the given cell configuration. This is used to detect when a new cell is added or an existing cell is reconfigured to trigger refresh of the in memory cell caches of the service. +| ipAddresses +| | map[string]string | true - -| tls -| TLS - Parameters related to the TLS -| tls.Ca -| false - -| memcachedInstance -| MemcachedInstance is the name of the Memcached CR that all nova service will use. -| string -| true |=== <> -[#novaschedulerstatus] -==== NovaSchedulerStatus +[#instancespec] +==== InstanceSpec -NovaSchedulerStatus defines the observed state of NovaScheduler +InstanceSpec Instance specific attributes |=== | Field | Description | Scheme | Required -| hash -| INSERT ADDITIONAL STATUS FIELD - define observed state of cluster Important: Run "make" to regenerate code after modifying this file Map of hashes to track e.g. job status +| bmhLabelSelector +| BmhLabelSelector allows for the selection of a particular BaremetalHost based on arbitrary labels | map[string]string | false -| conditions -| Conditions -| condition.Conditions +| ctlPlaneIP +| CtlPlaneIP - Control Plane IP in CIDR notation +| string | false -| readyCount -| ReadyCount defines the number of replicas ready from nova-scheduler -| int32 +| ctlplaneGateway +| CtlplaneGateway - IP of gateway for ctrlplane network (TODO: acquire this is another manner?) +| string | false -| networkAttachments -| NetworkAttachments status of the deployment pods -| map[string][]string +| ctlplaneInterface +| CtlplaneInterface - Interface on the provisioned nodes to use for ctlplane network +| string | false -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) -| int64 +| ctlplaneVlan +| CtlplaneVlan - Vlan for ctlplane network +| *int | false -| lastAppliedTopology -| LastAppliedTopology - the last applied Topology -| *topologyv1.TopoRef +| userData +| UserData - Host User Data +| *corev1.SecretReference +| false + +| networkData +| NetworkData - Host Network Data +| *corev1.SecretReference | false |=== <> -[#novaschedulertemplate] -==== NovaSchedulerTemplate +[#memgbreq] +==== MemGbReq -NovaSchedulerTemplate defines the input parameters specified by the user to create a NovaScheduler via higher level CRDs. +MemGbReq defines a specific hardware request for memory size |=== | Field | Description | Scheme | Required -| replicas -| Replicas of the service to run -| *int32 -| true +| gb +| +| int +| false -| nodeSelector -| NodeSelector to target subset of worker nodes running this service. Setting here overrides any global NodeSelector settings within the Nova CR. -| *map[string]string +| exactMatch +| If ExactMatch == false, actual GB > Gb will match +| bool | false +|=== -| customServiceConfig -| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ -| string -| true +<> -| resources -| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ -| corev1.ResourceRequirements -| false +[#memreqs] +==== MemReqs -| networkAttachments -| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network -| []string -| false +MemReqs defines specific memory hardware requests -| topologyRef -| TopologyRef to apply the Topology defined by the associated CR referenced by name -| *topologyv1.TopoRef +|=== +| Field | Description | Scheme | Required + +| gbReq +| +| <> | false |=== <> -[#nova] -==== Nova +[#openstackbaremetalset] +==== OpenStackBaremetalSet -Nova is the Schema for the nova API +OpenStackBaremetalSet is the Schema for the openstackbaremetalsets API |=== | Field | Description | Scheme | Required @@ -12977,21 +17504,21 @@ Nova is the Schema for the nova API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#novalist] -==== NovaList +[#openstackbaremetalsetlist] +==== OpenStackBaremetalSetList -NovaList contains a list of Nova +OpenStackBaremetalSetList contains a list of OpenStackBaremetalSet |=== | Field | Description | Scheme | Required @@ -13003,158 +17530,182 @@ NovaList contains a list of Nova | items | -| []<> +| []<> | true |=== <> -[#novaspeccore] -==== NovaSpecCore +[#openstackbaremetalsetspec] +==== OpenStackBaremetalSetSpec -NovaSpecCore defines the template for NovaSpec used in OpenStackControlPlane +OpenStackBaremetalSetSpec defines the desired state of OpenStackBaremetalSet |=== | Field | Description | Scheme | Required -| keystoneInstance -| KeystoneInstance to name of the KeystoneAPI CR to select the Service instance used by the Nova services to authenticate. -| string -| true +| baremetalHosts +| BaremetalHosts - Map of hostname to Instance Spec for all nodes to provision +| map[string]<> +| false -| apiDatabaseInstance -| APIDatabaseInstance is the name of the MariaDB CR to select the DB Service instance used for the Nova API DB. +| ctlplaneGateway +| CtlplaneGateway - IP of gateway for ctrlplane network (TODO: acquire this is another manner?) | string -| true +| false -| apiMessageBusInstance -| APIMessageBusInstance is the name of the RabbitMqCluster CR to select the Message Bus Service instance used by the Nova top level services to communicate. -| string -| true +| ctlplaneVlan +| CtlplaneVlan - Vlan for ctlplane network +| *int +| false -| cellTemplates -| Cells is a mapping of cell names to NovaCellTemplate objects defining the cells in the deployment. The "cell0" cell is a mandatory cell in every deployment. Moreover any real deployment needs at least one additional normal cell as "cell0" cannot have any computes. -| map[string]<> -| true +| bootstrapDns +| BootstrapDNS - initial DNS nameserver values to set on the BaremetalHosts when they are provisioned. Note that subsequent deployment will overwrite these values +| []string +| false -| serviceUser -| ServiceUser - optional username used for this service to register in keystone -| string -| true +| dnsSearchDomains +| DNSSearchDomains - initial DNS nameserver values to set on the BaremetalHosts when they are provisioned. Note that subsequent deployment will overwrite these values +| []string +| false +|=== -| apiDatabaseAccount -| APIDatabaseAccount - MariaDBAccount to use when accessing the API DB -| string -| true +<> -| apiTimeout -| APITimeout for Route and Apache -| int -| true +[#openstackbaremetalsetstatus] +==== OpenStackBaremetalSetStatus -| secret -| Secret is the name of the Secret instance containing password information for nova like the keystone service password and DB passwords -| string -| true +OpenStackBaremetalSetStatus defines the observed state of OpenStackBaremetalSet -| passwordSelectors -| PasswordSelectors - Selectors to identify the DB and ServiceUser passwords from the Secret -| <> -| true +|=== +| Field | Description | Scheme | Required -| nodeSelector -| NodeSelector to target subset of worker nodes running this service. Setting NodeSelector here acts as a default value and can be overridden by service specific NodeSelector Settings. -| *map[string]string +| conditions +| Conditions +| condition.Conditions | false -| preserveJobs -| PreserveJobs - do not delete jobs after they finished e.g. to check logs -| bool -| true +| hash +| Map of hashes to track e.g. job status +| map[string]string +| false -| apiServiceTemplate -| APIServiceTemplate - define the nova-api service -| <> -| true +| baremetalHosts +| BaremetalHosts that are being processed or have been processed for this OpenStackBaremetalSet +| map[string]<> +| false -| schedulerServiceTemplate -| SchedulerServiceTemplate- define the nova-scheduler service -| <> -| true +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) +| int64 +| false +|=== -| metadataServiceTemplate -| MetadataServiceTemplate - defines the metadata service that is global for the deployment serving all the cells. Note that if you want to deploy metadata per cell then the metadata service should be disabled here and enabled in the cellTemplates instead. -| <> +<> + +[#openstackbaremetalsettemplatespec] +==== OpenStackBaremetalSetTemplateSpec + +|=== +| Field | Description | Scheme | Required + +| osImage +| OSImage - OS qcow2 image Name. Ignored when osImageDeploymentType is PassThrough. +| string | true -| memcachedInstance -| MemcachedInstance is the name of the Memcached CR that all nova service will use. +| osContainerImageUrl +| OSContainerImageURL - When osImageDeploymentType is SelfExtracting, container image URL for init with the OS qcow2 image (osImage). When osImageDeploymentType is PassThrough this can be any image URL which the underlying Metal3 instance supports. | string +| false + +| osImageDeploymentType +| OSImageDeploymentType - Whether the OS image deployment is self-extracting or pass-through based +| OSImageDeploymentType | true -| topologyRef -| TopologyRef to apply the Topology defined by the associated CR referenced by name -| *topologyv1.TopoRef +| apacheImageUrl +| ApacheImageURL - Container image URL for the main container that serves the downloaded OS qcow2 image (osImage). Ignored when osImageDeploymentType is PassThrough. +| string | false -| notificationsBusInstance -| NotificationsBusInstance is the name of the RabbitMqCluster CR to select the Message Bus Service instance used by the Nova top level services and all cells to publish notifications. If undefined, the value will be inherited from OpenStackControlPlane. An empty value "" leaves the notification drivers unconfigured and emitting no notifications at all. Avoid colocating it with RabbitMqClusterName, APIMessageBusInstance or CellMessageBusInstance used for RPC. For particular Nova cells, notifications cannot be disabled, nor configured differently. -| *string +| agentImageUrl +| AgentImageURL - Container image URL for the sidecar container that discovers provisioning network IPs. Ignored when osImageDeploymentType is PassThrough. +| string +| false + +| automatedCleaningMode +| When set to disabled, automated cleaning will be avoided during provisioning and deprovisioning. +| AutomatedCleaningMode +| true + +| provisionServerName +| ProvisionServerName - Optional. Existing OpenStackProvisionServer to use, else one would be created. Ignored when osImageDeploymentType is PassThrough. +| string | false -|=== -<> +| provisionServerNodeSelector +| ProvisonServerNodeSelector to target subset of worker nodes running provision server, ignored when osImageDeploymentType is PassThrough. +| map[string]string +| false -[#novastatus] -==== NovaStatus +| provisioningInterface +| ProvisioningInterface - Optional. If not provided along with ProvisionServerName, it would be discovered from CBO. This is the provisioning interface on the OCP masters/workers. Ignored when osImageDeploymentType is PassThrough. +| string +| false -NovaStatus defines the observed state of Nova +| deploymentSSHSecret +| DeploymentSSHSecret - Name of a secret with an "authorized_keys" data entry holding the SSH public key(s) authorized for the provisioned user (see CloudUserName). A single key or multiple newline-separated keys are both supported. +| string +| true -|=== -| Field | Description | Scheme | Required +| ctlplaneInterface +| CtlplaneInterface - Interface on the provisioned nodes to use for ctlplane network +| string +| true -| conditions -| Conditions -| condition.Conditions +| ctlplaneBond +| CtlplaneBond - Bonding configuration for ctlplane network +| *<> | false -| apiServiceReadyCount -| APIServiceReadyCount defines the number or replicas ready from nova-api -| int32 -| false +| bmhNamespace +| BmhNamespace Namespace to look for BaremetalHosts(default: openshift-machine-api) +| string +| true -| schedulerServiceReadyCount -| SchedulerServiceReadyCount defines the number or replicas ready from nova-scheduler -| int32 +| bmhLabelSelector +| BmhLabelSelector allows for a sub-selection of BaremetalHosts based on arbitrary labels +| map[string]string | false -| metadataServiceReadyCount -| MetadataReadyCount defines the number of replicas ready from nova-metadata service -| int32 +| hardwareReqs +| Hardware requests for sub-selection of BaremetalHosts with certain hardware specs +| <> | false -| registeredCells -| RegisteredCells is a map keyed by cell names that are registered in the nova_api database with a value that is the hash of the given cell configuration. -| map[string]string +| passwordSecret +| PasswordSecret the name of the secret used to optionally set the root pwd by adding NodeRootPassword: ++++++to the secret data++++++ +| *corev1.SecretReference | false -| discoveredCells -| DiscoveredCells is a map keyed by cell names that have discovered all kubernetes managed computes in cell value is a hash of config from all kubernetes managed computes in cell -| map[string]string -| false +| cloudUserName +| CloudUser to be configured for remote access +| string +| true -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes. -| int64 +| domainName +| DomainName is the domain name that will be set on the underlying Metal3 BaremetalHosts (TODO: acquire this is another manner?) +| string | false |=== <> -[#octaviaamphoracontroller] -==== OctaviaAmphoraController +[#openstackprovisionserver] +==== OpenStackProvisionServer -OctaviaAmphoraController is the Schema for the octaviaworkers API +OpenStackProvisionServer used to serve custom images for baremetal provisioning with Metal3 |=== | Field | Description | Scheme | Required @@ -13166,216 +17717,146 @@ OctaviaAmphoraController is the Schema for the octaviaworkers API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#octaviaamphoracontrollerlist] -==== OctaviaAmphoraControllerList +[#openstackprovisionserverdefaults] +==== OpenStackProvisionServerDefaults -OctaviaAmphoraControllerList contains a list of OctaviaWorker +OpenStackProvisionServerDefaults - |=== | Field | Description | Scheme | Required -| metadata +| OSContainerImageURL | -| metav1.ListMeta +| string | false -| items +| AgentImageURL | -| []<> -| true +| string +| false + +| ApacheImageURL +| +| string +| false + +| OSImage +| +| string +| false |=== <> -[#octaviaamphoracontrollerspec] -==== OctaviaAmphoraControllerSpec +[#openstackprovisionserverlist] +==== OpenStackProvisionServerList -OctaviaAmphoraControllerSpec defines common state for all Octavia Amphora Controllers +OpenStackProvisionServerList contains a list of OpenStackProvisionServer |=== | Field | Description | Scheme | Required -| containerImage -| ContainerImage - Amphora Controller Container Image URL -| string +| metadata +| +| metav1.ListMeta | false + +| items +| +| []<> +| true |=== <> -[#octaviaamphoracontrollerspeccore] -==== OctaviaAmphoraControllerSpecCore +[#openstackprovisionserverspec] +==== OpenStackProvisionServerSpec -OctaviaAmphoraControllerSpecCore - +OpenStackProvisionServerSpec defines the desired state of OpenStackProvisionServer |=== | Field | Description | Scheme | Required -| databaseInstance -| MariaDB instance name Right now required by the maridb-operator to get the credentials from the instance to create the DB Might not be required in future -| string +| port +| Port - The port on which the Apache server should listen +| int32 | true -| databaseAccount -| DatabaseAccount - name of MariaDBAccount which will be used to connect for the main octavia database +| interface +| Interface - An optional interface to use instead of the cluster's default provisioning interface (if any) | string -| true +| false -| persistenceDatabaseAccount -| PersistenceDatabaseAccount - name of MariaDBAccount which will be used to connect for the persistence database +| osImage +| OSImage - OS qcow2 image (compressed as gz, or uncompressed) | string | true -| databaseHostname -| DatabaseHostname - Octavia DB hostname -| string -| false - -| serviceUser -| ServiceUser - service user name (TODO: beagles, do we need this at all) -| string +| osImageDir +| OSImageDir - Directory on the container which holds the OS qcow2 image and checksum +| *string | true -| serviceAccount -| ServiceAccount - service account name used internally to provide Octavia services the default SA name +| osContainerImageUrl +| OSContainerImageURL - Container image URL for init with the OS qcow2 image (osImage) | string | true -| role -| Role - the role for the controller (one of worker, housekeeping, healthmanager) +| apacheImageUrl +| ApacheImageURL - Container image URL for the main container that serves the downloaded OS qcow2 image (osImage) | string | true -| secret -| Secret containing OpenStack password information for octavia OctaviaDatabasePassword, AdminPassword +| agentImageUrl +| AgentImageURL - Container image URL for the sidecar container that discovers provisioning network IPs | string | true -| passwordSelectors -| PasswordSelectors - Selectors to identify the AdminUser password from the Secret -| <> -| false - | nodeSelector -| NodeSelector to target subset of worker nodes running this service -| *map[string]string -| false - -| customServiceConfig -| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ -| string -| false - -| defaultConfigOverwrite -| ConfigOverwrite - interface to overwrite default config files like e.g. logging.conf or policy.json. But can also be used to add additional files. Those get added to the service config dir in /etc/++++++.++++++ +| NodeSelector to target subset of worker nodes running this provision server | map[string]string | false -| transportURLSecret -| TransportURLSecret - Secret containing RabbitMQ transportURL -| string -| false - | resources -| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ +| Resources - Compute Resources required by this provision server (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | corev1.ResourceRequirements | false -| networkAttachments -| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network -| []string -| false - -| tenantName -| TenantName - the name of the OpenStack tenant that controls the Octavia resources -| string -| true - -| tenantDomainName -| TenantDomainName - the name of the OpenStack domain associated with the tenant -| string -| true - -| lbMgmtNetworkID -| -| string -| true - -| lbSecurityGroupID -| -| string -| true - -| amphoraCustomFlavors -| AmphoraCustomFlavors - User-defined flavors for Octavia -| []<> -| false - -| amphoraImageOwnerID -| -| string -| false - -| redisHosts -| List of Redis Hosts -| []string -| false - -| tls -| TLS - Parameters related to the TLS -| tls.Ca -| false - -| octaviaProviderSubnetGateway -| OctaviaProviderSubnetGateway - -| string -| true - -| octaviaProviderSubnetCIDR -| OctaviaProviderSubnetCIDR - -| string +| preserveJobs +| PreserveJobs - do not delete jobs after they finished e.g. to check logs +| bool | true - -| octaviaProviderSubnetExtraCIDRs -| OctaviaProviderSubnetExtraCIDRs - -| []string -| false - -| topologyRef -| TopologyRef to apply the Topology defined by the associated CR referenced by name -| *topologyv1.TopoRef -| false |=== <> -[#octaviaamphoracontrollerstatus] -==== OctaviaAmphoraControllerStatus - -OctaviaAmphoraControllerStatus defines the observed state of the Octavia Amphora Controller +[#openstackprovisionserverstatus] +==== OpenStackProvisionServerStatus + +OpenStackProvisionServerStatus defines the observed state of OpenStackProvisionServer |=== | Field | Description | Scheme | Required | readyCount -| ReadyCount of Octavia Amphora Controllers +| ReadyCount of provision server Apache instances | int32 | false -| desiredNumberScheduled -| DesiredNumberScheduled - total number of the nodes which should be running Daemon -| int32 +| conditions +| Conditions +| condition.Conditions | false | hash @@ -13383,49 +17864,69 @@ OctaviaAmphoraControllerStatus defines the observed state of the Octavia Amphora | map[string]string | false -| conditions -| Conditions -| condition.Conditions +| provisionIp +| IP of the provisioning interface on the node running the ProvisionServer pod +| string | false -| networkAttachments -| NetworkAttachment status of the deployment pods -| map[string][]string +| provisionIpError +| Any error reported by the provisioning agent during provisioning IP acquisition +| string | false -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) -| int64 +| localImageUrl +| URL of provisioning image on underlying Apache web server +| string | false -| lastAppliedTopology -| LastAppliedTopology - the last applied Topology -| *topologyv1.TopoRef +| osImageChecksumFilename +| Filename of OSImage checksum +| string +| false + +| osImageChecksumType +| OSImage checksum type +| metal3v1.ChecksumType +| false + +| localImageChecksumUrl +| URL of provisioning image checksum on underlying Apache web server +| string | false |=== <> -[#apioverridespec-2] -==== APIOverrideSpec +[#bond] +==== Bond -APIOverrideSpec to override the generated manifest of several child resources. +Bond defines the configuration of each bond interface in the deployment |=== | Field | Description | Scheme | Required -| service -| Override configuration for the Service created to serve traffic to the cluster. The key must be the endpoint type (public, internal) -| map[service.Endpoint]service.RoutedOverrideSpec +| mode +| +| string +| false + +| mtu +| +| int32 | false + +| links +| +| []string +| true |=== <> -[#octaviaapi] -==== OctaviaAPI +[#ovncontroller] +==== OVNController -OctaviaAPI is the Schema for the octaviaapis API +OVNController is the Schema for the ovncontrollers API |=== | Field | Description | Scheme | Required @@ -13437,21 +17938,21 @@ OctaviaAPI is the Schema for the octaviaapis API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#octaviaapilist] -==== OctaviaAPIList +[#ovncontrollerlist] +==== OVNControllerList -OctaviaAPIList contains a list of OctaviaAPI +OVNControllerList contains a list of OVNController |=== | Field | Description | Scheme | Required @@ -13463,104 +17964,59 @@ OctaviaAPIList contains a list of OctaviaAPI | items | -| []<> -| true -|=== - -<> - -[#octaviaapispec] -==== OctaviaAPISpec - -OctaviaAPISpec defines the desired state of OctaviaAPI - -|=== -| Field | Description | Scheme | Required - -| containerImage -| Octavia Container Image URL -| string +| []<> | true |=== <> -[#octaviaapispeccore] -==== OctaviaAPISpecCore +[#ovncontrollerspec] +==== OVNControllerSpec -OctaviaAPISpecCore - +OVNControllerSpec defines the desired state of OVNController |=== | Field | Description | Scheme | Required -| databaseInstance -| MariaDB instance name Right now required by the maridb-operator to get the credentials from the instance to create the DB Might not be required in future -| string -| true - -| databaseAccount -| DatabaseAccount - name of MariaDBAccount which will be used to connect for the main octavia database +| ovsContainerImage +| Image used for the ovsdb-server and ovs-vswitchd containers (will be set to environmental default if empty) | string | true -| persistenceDatabaseAccount -| PersistenceDatabaseAccount - name of MariaDBAccount which will be used to connect for the persistence database +| ovnContainerImage +| Image used for the ovn-controller container (will be set to environmental default if empty) | string | true -| databaseHostname -| DatabaseHostname - Octavia DB hostname +| exporterImage +| ExporterImage - Container Image URL for the openstack-network-exporter metrics daemonset (will be set to environmental default if empty) | string | false +|=== -| serviceUser -| ServiceUser - service user name -| string -| true - -| serviceAccount -| ServiceAccount - service account name used internally to provide Octavia services the default SA name -| string -| true - -| replicas -| Replicas of octavia API to run -| *int32 -| true - -| secret -| Secret containing OpenStack password information for octavia OctaviaDatabasePassword, AdminPassword -| string -| true +<> -| passwordSelectors -| PasswordSelectors - Selectors to identify the DB and ServiceUser password from the Secret -| <> -| false +[#ovncontrollerspeccore] +==== OVNControllerSpecCore -| nodeSelector -| NodeSelector to target subset of worker nodes running this service -| *map[string]string -| false +OVNControllerSpecCore - -| preserveJobs -| PreserveJobs - do not delete jobs after they finished e.g. to check logs -| bool -| false +|=== +| Field | Description | Scheme | Required -| customServiceConfig -| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ -| string -| false +| external-ids +| +| <> +| true -| defaultConfigOverwrite -| ConfigOverwrite - interface to overwrite default config files like e.g. logging.conf or policy.json. But can also be used to add additional files. Those get added to the service config dir in /etc/++++++.++++++ +| nicMappings +| | map[string]string | false -| transportURLSecret -| TransportURLSecret - Secret containing RabbitMQ transportURL -| string +| bondConfiguration +| Map of bond names to their configuration +| map[string]<> | false | resources @@ -13568,60 +18024,75 @@ OctaviaAPISpecCore - | corev1.ResourceRequirements | false -| override -| Override, provides the ability to override the generated manifest of several child resources. -| <> -| false - -| networkAttachments -| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network -| []string +| nodeSelector +| NodeSelector to target subset of worker nodes running this service +| *map[string]string | false -| tenantName -| TenantName - the name of the OpenStack tenant that controls the Octavia resources +| networkAttachment +| NetworkAttachment is a NetworkAttachment resource name to expose the service to the given network. If specified the IP address of this network is used as the OVNEncapIP. | string | true -| tenantDomainName -| TenantDomainName - the name of the OpenStack domain associated with the tenant +| ovnLogLevel +| OVNLogLevel - Set log level off, emer, err, warn, info or dbg. Default is info. | string -| true +| false -| tls -| TLS - Parameters related to the TLS -| <> +| ovsLogLevel +| OVSLogLevel - Set log level off, emer, err, warn, info or dbg. Default is info. +| string | false -| apiTimeout -| APITimeout for HAProxy and Apache defaults to OctaviaSpecCore APITimeout (seconds) -| int -| true +| tls +| TLS - Parameters related to TLS +| tls.SimpleService +| false | topologyRef | TopologyRef to apply the Topology defined by the associated CR referenced by name | *topologyv1.TopoRef | false + +| metricsEnabled +| MetricsEnabled enables the metrics daemonset for collecting OVN metrics +| *bool +| false + +| metricsTLS +| MetricsTLS - Parameters related to TLS for metrics daemonset +| tls.SimpleService +| false |=== <> -[#octaviaapistatus] -==== OctaviaAPIStatus +[#ovncontrollerstatus] +==== OVNControllerStatus -OctaviaAPIStatus defines the observed state of OctaviaAPI +OVNControllerStatus defines the observed state of OVNController |=== | Field | Description | Scheme | Required -| readyCount -| ReadyCount of octavia API instances +| numberReady +| NumberReady of the OVNController instances | int32 | false -| hash -| Map of hashes to track e.g. job status -| map[string]string +| ovsNumberReady +| ovsNumberReady of ovs instances +| int32 +| false + +| metricsNumberReady +| MetricsNumberReady of metrics instances +| int32 +| false + +| desiredNumberScheduled +| DesiredNumberScheduled - total number of the nodes which should be running Daemon +| int32 | false | conditions @@ -13629,13 +18100,18 @@ OctaviaAPIStatus defines the observed state of OctaviaAPI | condition.Conditions | false +| hash +| Map of hashes to track e.g. job status +| map[string]string +| false + | networkAttachments -| NetworkAttachment status of the deployment pods +| NetworkAttachments status of the deployment pods | map[string][]string | false | observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes. | int64 | false @@ -13647,29 +18123,56 @@ OctaviaAPIStatus defines the observed state of OctaviaAPI <> -[#octaviaapitls] -==== OctaviaApiTLS +[#ovsexternalids] +==== OVSExternalIDs + +OVSExternalIDs is a set of configuration options for OVS external-ids table |=== | Field | Description | Scheme | Required -| api -| API tls type which encapsulates for API services -| tls.APIService +| system-id +| +| string | false -| ovn -| Ovn GenericService - holds the secret for the OvnDb client cert -| tls.GenericService +| ovn-bridge +| +| string +| false + +| ovn-encap-type +| +| string +| false + +| ovn-encap-tos +| +| string +| false + +| ovn-remote-probe-interval +| +| int +| false + +| availability-zones +| +| []string | false + +| enable-chassis-as-gateway +| DEPRECATED: To be removed in the next API version Any value set to this field is ignored +| *bool +| true |=== <> -[#octaviarsyslog] -==== OctaviaRsyslog +[#ovndbcluster] +==== OVNDBCluster -OctaviaRsyslog is the Schema for the octaviaworkers API +OVNDBCluster is the Schema for the ovndbclusters API |=== | Field | Description | Scheme | Required @@ -13681,21 +18184,21 @@ OctaviaRsyslog is the Schema for the octaviaworkers API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#octaviarsysloglist] -==== OctaviaRsyslogList +[#ovndbclusterlist] +==== OVNDBClusterList -OctaviaRsyslogList contains a list of OctaviaWorker +OVNDBClusterList contains a list of OVNDBCluster |=== | Field | Description | Scheme | Required @@ -13707,49 +18210,65 @@ OctaviaRsyslogList contains a list of OctaviaWorker | items | -| []<> +| []<> | true |=== <> -[#octaviarsyslogspec] -==== OctaviaRsyslogSpec +[#ovndbclusteroverridespec] +==== OVNDBClusterOverrideSpec -OctaviaRsyslogSpec defines common state for all Octavia Amphora Controllers +OVNDBClusterOverrideSpec to override the generated manifest of several child resources. + +|=== +| Field | Description | Scheme | Required + +| service +| Override configuration for the Service created to serve traffic to the cluster. +| *service.OverrideSpec +| false +|=== + +<> + +[#ovndbclusterspec] +==== OVNDBClusterSpec + +OVNDBClusterSpec defines the desired state of OVNDBCluster |=== | Field | Description | Scheme | Required | containerImage -| ContainerImage - Rsyslog Container Image URL +| ContainerImage - Container Image URL (will be set to environmental default if empty) | string -| false +| true -| initContainerImage -| InitContainerImage - Rsyslog init Container Image URL for +| exporterImage +| ExporterImage - Container Image URL for the openstack-network-exporter metrics sidecar (will be set to environmental default if empty) | string | false |=== <> -[#octaviarsyslogspeccore] -==== OctaviaRsyslogSpecCore +[#ovndbclusterspeccore] +==== OVNDBClusterSpecCore -OctaviaRsyslogSpecCore - +OVNDBClusterSpecCore - |=== | Field | Description | Scheme | Required -| serviceUser -| ServiceUser - service user name (TODO: beagles, do we need this at all) +| dbType +| DBType - NB or SB | string | true -| serviceAccount -| ServiceAccount - service account name used internally to provide Octavia services the default SA name -| string +| replicas +| Replicas of OVN DBCluster to run +| *int32 | true | nodeSelector @@ -13757,69 +18276,84 @@ OctaviaRsyslogSpecCore - | *map[string]string | false -| defaultConfigOverwrite -| ConfigOverwrite - interface to overwrite default config files like e.g. logging.conf or policy.json. But can also be used to add additional files. Those get added to the service config dir in /etc/++++++.++++++ -| map[string]string +| logLevel +| LogLevel - Set log level off, emer, err, warn, info or dbg. Default is info. +| string | false +| electionTimer +| OVN Northbound and Southbound RAFT db election timer to use on db creation (in milliseconds) +| int32 +| true + +| inactivityProbe +| Probe interval for the OVSDB session (in milliseconds) +| int32 +| true + +| probeIntervalToActive +| DEPRECATED: ProbeIntervalToActive is only relevant for active/standby ovsdb configurations. This parameter is not used in RAFT clustered deployments and will be ignored. Active probe interval from standby to active ovsdb-server remote +| int32 +| true + | resources | Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | corev1.ResourceRequirements | false -| networkAttachments -| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network -| []string -| false - -| adminLogTargets -| AdminLogTargets is a list of OctaviaRsyslogTarget, the admin logs are forwarded to those targets. Use only when forwarding to an external Rsyslog server. -| []<> -| false - -| tenantLogTargets -| TenantLogTargets is a list of OctaviaRsyslogTarget, the tenant logs are forwarded to those targets. Use only when forwarding to an external Rsyslog server. -| []<> +| storageClass +| StorageClass +| string | false -| octaviaProviderSubnetGateway -| OctaviaProviderSubnetGateway - +| storageRequest +| StorageRequest | string | true -| octaviaProviderSubnetCIDR -| OctaviaProviderSubnetCIDR - +| networkAttachment +| NetworkAttachment is a NetworkAttachment resource name to expose the service to the given network. If specified the IP address of this network is used as the dbAddress connection. | string | true -| octaviaProviderSubnetExtraCIDRs -| OctaviaProviderSubnetExtraCIDRs - -| []string +| tls +| TLS - Parameters related to TLS +| tls.SimpleService +| false + +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> | false | topologyRef | TopologyRef to apply the Topology defined by the associated CR referenced by name | *topologyv1.TopoRef | false + +| metricsEnabled +| MetricsEnabled enables the metrics sidecar container for collecting OVN DB metrics +| *bool +| false + +| metricsTLS +| MetricsTLS - Parameters related to TLS for metrics sidecar +| tls.SimpleService +| false |=== <> -[#octaviarsyslogstatus] -==== OctaviaRsyslogStatus +[#ovndbclusterstatus] +==== OVNDBClusterStatus -OctaviaRsyslogStatus defines the observed state of the Octavia Amphora Controller +OVNDBClusterStatus defines the observed state of OVNDBCluster |=== | Field | Description | Scheme | Required | readyCount -| ReadyCount of Octavia Amphora Controllers -| int32 -| false - -| desiredNumberScheduled -| DesiredNumberScheduled - total number of the nodes which should be running Daemon +| ReadyCount of OVN DBCluster instances | int32 | false @@ -13833,13 +18367,23 @@ OctaviaRsyslogStatus defines the observed state of the Octavia Amphora Controlle | condition.Conditions | false +| dbAddress +| DBAddress - DB IP address used by external nodes +| string +| false + +| internalDbAddress +| InternalDBAddress - DB IP address used by other Pods in the cluster +| string +| false + | networkAttachments -| NetworkAttachment status of the deployment pods +| NetworkAttachments status of the deployment pods | map[string][]string | false | observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes. | int64 | false @@ -13851,771 +18395,768 @@ OctaviaRsyslogStatus defines the observed state of the Octavia Amphora Controlle <> -[#octaviarsyslogtarget] -==== OctaviaRsyslogTarget +[#ovnnorthd] +==== OVNNorthd + +OVNNorthd is the Schema for the ovnnorthds API |=== | Field | Description | Scheme | Required -| host +| metadata | -| string -| true +| metav1.ObjectMeta +| false -| port +| spec | -| int -| true +| <> +| false -| protocol +| status | -| string -| true +| <> +| false |=== <> -[#octavia] -==== Octavia +[#ovnnorthdlist] +==== OVNNorthdList -Octavia is the Schema for the octavia API +OVNNorthdList contains a list of OVNNorthd |=== | Field | Description | Scheme | Required | metadata | -| metav1.ObjectMeta +| metav1.ListMeta | false -| spec +| items | -| <> -| false +| []<> +| true +|=== -| status -| -| <> +<> + +[#ovnnorthdspec] +==== OVNNorthdSpec + +OVNNorthdSpec defines the desired state of OVNNorthd + +|=== +| Field | Description | Scheme | Required + +| containerImage +| ContainerImage - Container Image URL (will be set to environmental default if empty) +| string +| true + +| exporterImage +| ExporterImage - Container Image URL for the openstack-network-exporter metrics sidecar (will be set to environmental default if empty) +| string | false |=== <> -[#octaviaamphoraflavor] -==== OctaviaAmphoraFlavor +[#ovnnorthdspeccore] +==== OVNNorthdSpecCore -OctaviaAmphoraFlavor Settings for custom Amphora flavors +OVNNorthdSpecCore - |=== | Field | Description | Scheme | Required -| name -| -| string +| replicas +| Replicas of OVN Northd to run +| *int32 | true -| description -| +| nodeSelector +| NodeSelector to target subset of worker nodes running this service +| *map[string]string +| false + +| logLevel +| LogLevel - Set log level off, emer, err, warn, info or dbg. Default is info. | string -| true +| false -| VCPUs -| -| int -| true +| resources +| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ +| corev1.ResourceRequirements +| false -| RAM -| -| int -| true +| tls +| TLS - Parameters related to TLS +| tls.SimpleService +| false -| disk -| -| int +| nThreads +| NThreads sets number of threads used for building logical flows +| *int32 | true -| RxTxFactor -| -| string -| true +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name +| *topologyv1.TopoRef +| false + +| metricsEnabled +| MetricsEnabled enables the metrics sidecar container for collecting OVN metrics +| *bool +| false + +| metricsTLS +| MetricsTLS - Parameters related to TLS for metrics sidecar +| tls.SimpleService +| false |=== <> -[#octavialbmgmtnetworks] -==== OctaviaLbMgmtNetworks +[#ovnnorthdstatus] +==== OVNNorthdStatus -OctaviaLbMgmtNetworks Settings for Octavia management networks +OVNNorthdStatus defines the observed state of OVNNorthd |=== | Field | Description | Scheme | Required -| manageLbMgmtNetworks -| ManageLbMgmtNetworks - when True, octavia-operator creates the Neutron resources needed for its Management Network -| bool -| true +| readyCount +| ReadyCount of OVN Northd instances +| int32 +| false -| createDefaultLbMgmtNetwork -| CreateDefaultLbMgmtNetwork - when True, octavia-operator creates a Management Network for the default Availability Zone of the control plane. Can be set to false when deploying OpenStack in DCN mode. -| bool -| true +| conditions +| Conditions +| condition.Conditions +| false -| lbMgmtRouterGateway -| LbMgmtRouterGateway is the IP address of the Octavia router on the Provider network, it's optional and used only when the routing informations are not passed through the Network Attachment Definition -| string +| hash +| Map of hashes to track e.g. job status +| map[string]string | false -| availabilityZones -| Availability zones for the octavia management network resources -| []string +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes. +| int64 | false -| availabilityZoneCIDRs -| AvailabilityZoneCIDRs are the CIDRs of each management network associated with an Availability Zone (ex: {"az":"172.34.0.0/24", ...}) -| map[string]string +| lastAppliedTopology +| LastAppliedTopology - the last applied Topology +| *topologyv1.TopoRef | false |=== <> -[#octavialist] -==== OctaviaList +[#swift] +==== Swift -OctaviaList contains a list of Octavia +Swift is the Schema for the swifts API |=== | Field | Description | Scheme | Required | metadata | -| metav1.ListMeta +| metav1.ObjectMeta | false -| items +| spec | -| []<> -| true +| <> +| false + +| status +| +| <> +| false |=== <> -[#octaviaspec] -==== OctaviaSpec +[#swiftlist] +==== SwiftList -OctaviaSpec defines the desired state of Octavia +SwiftList contains a list of Swift |=== | Field | Description | Scheme | Required -| octaviaAPI -| OctaviaAPI - Spec definition for the API service of the Octavia deployment -| <> -| true - -| octaviaHousekeeping -| OctaviaHousekeeping - Spec definition for the Octavia Housekeeping agent for the Octavia deployment -| <> -| true - -| octaviaHealthManager -| OctaviaHousekeeping - Spec definition for the Octavia Housekeeping agent for the Octavia deployment -| <> -| true - -| octaviaWorker -| OctaviaHousekeeping - Spec definition for the Octavia Housekeeping agent for the Octavia deployment -| <> -| true +| metadata +| +| metav1.ListMeta +| false -| octaviaRsyslog -| OctaviaRsyslog - Spec definition for the Octavia Rsyslog agent for the Octavia deployment -| <> +| items +| +| []<> | true |=== <> -[#octaviaspecbase] -==== OctaviaSpecBase +[#swiftspec] +==== SwiftSpec -OctaviaSpecBase - +SwiftSpec defines the desired state of Swift |=== | Field | Description | Scheme | Required -| databaseInstance -| MariaDB instance name Right now required by the maridb-operator to get the credentials from the instance to create the DB Might not be required in future -| string -| true - -| databaseAccount -| DatabaseAccount - name of MariaDBAccount which will be used to connect for the main octavia database -| string -| true - -| persistenceDatabaseAccount -| PersistenceDatabaseAccount - name of MariaDBAccount which will be used to connect for the persistence database -| string -| true - -| rabbitMqClusterName -| RabbitMQ instance name Needed to request a transportURL that is created and used in Octavia -| string -| true - -| serviceUser -| ServiceUser - service user name -| string -| true - -| secret -| Secret containing OpenStack password information for octavia's keystone password; no longer used for database password -| string -| true - -| passwordSelectors -| PasswordSelectors - Selectors to identify the DB and ServiceUser password from the Secret -| <> -| false - -| nodeSelector -| NodeSelector to target subset of worker nodes running this service -| *map[string]string -| false - -| preserveJobs -| PreserveJobs - do not delete jobs after they finished e.g. to check logs -| bool -| false - -| customServiceConfig -| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ -| string -| false - -| defaultConfigOverwrite -| ConfigOverwrite - interface to overwrite default config files like e.g. logging.conf or policy.json. But can also be used to add additional files. Those get added to the service config dir in /etc/++++++.++++++ -| map[string]string -| false - -| tenantName -| TenantName - the name of the OpenStack tenant that controls the Octavia resources -| string +| swiftRing +| SwiftRing - Spec definition for the Ring service of this Swift deployment +| <> | true -| tenantDomainName -| TenantDomainName - the name of the OpenStack domain associated with the tenant -| string +| swiftStorage +| SwiftStorage - Spec definition for the Storage service of this Swift deployment +| <> | true -| lbMgmtNetwork -| -| <> +| swiftProxy +| SwiftProxy - Spec definition for the Proxy service of this Swift deployment +| <> | true +|=== -| sshPubkey -| LoadBalancerSSHPubKey - The name of the ConfigMap containing the pubilc key for connecting to the amphorae via SSH -| string -| false - -| sshPrivkeySecret -| LoadBalancerSSHPrivKey - The name of the secret that will be used to store the private key for connecting to amphorae via SSH -| string -| false +<> -| amphoraCustomFlavors -| AmphoraCustomFlavors - User-defined flavors for Octavia -| []<> -| false +[#swiftspecbase] +==== SwiftSpecBase -| resources -| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ -| corev1.ResourceRequirements -| false +SwiftSpecBase - -| amphoraImageContainerImage -| Octavia Container Image URL -| string -| true +|=== +| Field | Description | Scheme | Required -| apacheContainerImage -| Apache Container Image URL +| storageClass +| Storage class. This is passed to SwiftStorage unless storageClass is explicitly set for the SwiftStorage. | string | true -| apiTimeout -| Octavia API timeout -| int -| true +| networkAttachments +| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network +| []string +| false -| octaviaNetworkAttachment -| OctaviaNetworkAttachment is a NetworkAttachment resource name for the Octavia Management Network +| memcachedInstance +| Memcached instance name. | string | true +| nodeSelector +| NodeSelector to target subset of worker nodes running this service +| *map[string]string +| false + | topologyRef | TopologyRef to apply the Topology defined by the associated CR referenced by name | *topologyv1.TopoRef | false -| redisServiceName -| Name of the Redis database for Jobboard -| string +| ringConfigMaps +| List of ring ConfigMaps +| []string | true |=== <> -[#octaviaspeccore] -==== OctaviaSpecCore +[#swiftspeccore] +==== SwiftSpecCore -OctaviaSpecCore - this version has no containerImages and is used by OpenStackControlplane +SwiftSpecCore defines the desired state of Swift (this version is used by OpenStackControlplane) |=== | Field | Description | Scheme | Required -| octaviaAPI -| OctaviaAPI - Spec definition for the API service of the Octavia deployment -| <> -| true - -| octaviaHousekeeping -| OctaviaHousekeeping - Spec definition for the Octavia Housekeeping agent for the Octavia deployment -| <> -| true - -| octaviaHealthManager -| OctaviaHousekeeping - Spec definition for the Octavia Housekeeping agent for the Octavia deployment -| <> +| swiftRing +| SwiftRing - Spec definition for the Ring service of this Swift deployment +| <> | true -| octaviaWorker -| OctaviaHousekeeping - Spec definition for the Octavia Housekeeping agent for the Octavia deployment -| <> +| swiftStorage +| SwiftStorage - Spec definition for the Storage service of this Swift deployment +| <> | true -| octaviaRsyslog -| OctaviaRsyslog - Spec definition for the Octavia Rsyslog agent for the Octavia deployment -| <> +| swiftProxy +| SwiftProxy - Spec definition for the Proxy service of this Swift deployment +| <> | true |=== <> -[#octaviastatus] -==== OctaviaStatus +[#swiftstatus] +==== SwiftStatus -OctaviaStatus defines the observed state of Octavia +SwiftStatus defines the observed state of Swift |=== | Field | Description | Scheme | Required -| hash -| Map of hashes to track e.g. job status -| map[string]string -| false - | conditions | Conditions | condition.Conditions | false -| databaseHostname -| Octavia Database Hostname -| string +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) +| int64 | false +|=== -| transportURLSecret -| TransportURLSecret - Secret containing RabbitMQ transportURL +<> + +[#authspec-2] +==== AuthSpec + +AuthSpec defines authentication parameters + +|=== +| Field | Description | Scheme | Required + +| applicationCredentialSecret +| ApplicationCredentialSecret - Secret containing Application Credential ID and Secret | string | false +|=== -| apireadyCount -| ReadyCount of octavia API instances -| int32 -| false +<> -| workerreadyCount -| ReadyCount of octavia Worker instances -| int32 -| false +[#passwordselector-2] +==== PasswordSelector -| housekeepingreadyCount -| ReadyCount of octavia Housekeeping instances -| int32 -| false +PasswordSelector to identify the AdminUser password from the Secret -| healthmanagerreadyCount -| ReadyCount of octavia HealthManager instances -| int32 +|=== +| Field | Description | Scheme | Required + +| service +| Service - Selector to get the Swift service password from the Secret +| string +| true +|=== + +<> + +[#proxyoverridespec] +==== ProxyOverrideSpec + +ProxyOverrideSpec to override the generated manifest of several child resources. + +|=== +| Field | Description | Scheme | Required + +| service +| Override configuration for the Service created to serve traffic to the cluster. The key must be the endpoint type (public, internal) +| map[service.Endpoint]service.RoutedOverrideSpec | false +|=== -| rsyslogreadyCount -| ReadyCount of octavia Rsyslog instances -| int32 +<> + +[#swiftproxy] +==== SwiftProxy + +SwiftProxy is the Schema for the swiftproxies API + +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ObjectMeta | false -| redisHosts -| List of Redis Hosts -| []string +| spec +| +| <> | false -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) -| int64 +| status +| +| <> | false |=== <> -[#passwordselector-2] -==== PasswordSelector +[#swiftproxylist] +==== SwiftProxyList -PasswordSelector to identify the DB and AdminUser password from the Secret +SwiftProxyList contains a list of SwiftProxy |=== | Field | Description | Scheme | Required -| database -| Database - Selector to get the octavia Database user password from the Secret -| string +| metadata +| +| metav1.ListMeta | false -| service -| Service - Selector to get the service user password from the Secret +| items +| +| []<> +| true +|=== + +<> + +[#swiftproxyspec] +==== SwiftProxySpec + +SwiftProxySpec defines the desired state of SwiftProxy + +|=== +| Field | Description | Scheme | Required + +| containerImageProxy +| Swift Proxy Container Image URL | string -| false +| true |=== <> -[#bondconfig] -==== BondConfig +[#swiftproxyspeccore] +==== SwiftProxySpecCore -BondConfig defines the bonding configuration for network interfaces +SwiftProxySpecCore - |=== | Field | Description | Scheme | Required -| bondInterfaces -| BondInterfaces - List of physical interfaces to bond -| []string +| replicas +| Replicas of Swift Proxy +| *int32 | true -| bondMode -| BondMode - Bonding mode (e.g., active-backup, 802.3ad) +| serviceUser +| ServiceUser - optional username used for this service to register in Swift | string +| true + +| secret +| Secret containing OpenStack password information for Swift service user password +| string +| true + +| passwordSelectors +| PasswordSelector - Selector to choose the Swift user password from the Secret +| <> +| true + +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> | false -| bondOptions -| BondOptions - Additional bonding options as key-value pairs -| map[string]string +| networkAttachments +| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network +| []string | false -|=== -<> +| resources +| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ +| corev1.ResourceRequirements +| false -[#cpucountreq] -==== CPUCountReq +| memcachedInstance +| Memcached instance name. +| string +| true -CPUCountReq defines a specific hardware request for CPU core count +| rabbitMqClusterName +| Deprecated: Use NotificationsBus.Cluster instead RabbitMQ instance name to request a transportURL for Ceilometer middleware +| string +| false -|=== -| Field | Description | Scheme | Required +| tls +| TLS - Parameters related to the TLS +| tls.API +| false -| count -| -| int +| auth +| Auth - Parameters related to authentication +| <> | false -| exactMatch -| If ExactMatch == false, actual count > Count will match -| bool +| defaultConfigOverwrite +| DefaultConfigOverwrite - can be used to add additionalfiles. Those get added to the service config dir in /etc/++++++-conf.d++++++ +| map[string]string | false -|=== -<> +| encryptionEnabled +| Encrypts new objects at rest +| bool +| true -[#cpumhzreq] -==== CPUMhzReq +| ceilometerEnabled +| Enables ceilometer in the swift proxy and creates required resources +| bool +| true -CPUMhzReq defines a specific hardware request for CPU clock speed +| nodeSelector +| NodeSelector to target subset of worker nodes running this service +| *map[string]string +| false -|=== -| Field | Description | Scheme | Required +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name +| *topologyv1.TopoRef +| false -| mhz -| +| apiTimeout +| Default APITimeout for HAProxy and Apache, defaults to 60 seconds | int | false -| exactMatch -| If ExactMatch == false, actual mhz > Mhz will match -| bool +| ringConfigMaps +| List of ring ConfigMaps +| []string +| true + +| notificationsBus +| NotificationsBus configuration (username, vhost, and cluster) +| *rabbitmqv1.RabbitMqConfig | false |=== <> -[#cpureqs] -==== CPUReqs +[#swiftproxystatus] +==== SwiftProxyStatus -CPUReqs defines specific CPU hardware requests +SwiftProxyStatus defines the observed state of SwiftProxy |=== | Field | Description | Scheme | Required -| arch -| Arch is a scalar (string) because it wouldn't make sense to give it an "exact-match" option Can be either "x86_64" or "ppc64le" if included -| string +| readyCount +| ReadyCount of SwiftProxy instances +| int32 | false -| countReq -| -| <> +| conditions +| Conditions +| condition.Conditions | false -| mhzReq -| -| <> +| networkAttachments +| NetworkAttachments status of the deployment pods +| map[string][]string | false -|=== -<> - -[#diskgbreq] -==== DiskGbReq +| hash +| Map of hashes to track e.g. job status +| map[string]string +| false -DiskGbReq defines a specific hardware request for disk size +| transportURLSecret +| TransportURLSecret - Secret containing RabbitMQ transportURL +| string +| false -|=== -| Field | Description | Scheme | Required +| applicationCredentialSecret +| ApplicationCredentialSecret - Secret that SwiftProxy is actively consuming (AC consumer finalizer present) +| string +| false -| gb -| -| int +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) +| int64 | false -| exactMatch -| If ExactMatch == false, actual GB > Gb will match -| bool +| lastAppliedTopology +| LastAppliedTopology - the last applied Topology +| *topologyv1.TopoRef | false |=== <> -[#diskreqs] -==== DiskReqs - -DiskReqs defines specific disk hardware requests +[#swiftdisk] +==== SwiftDisk |=== | Field | Description | Scheme | Required -| gbReq +| device | -| <> -| false - -| ssdReq -| SSD is scalar (bool) because it wouldn't make sense to give it an "exact-match" option -| <> -| false -|=== - -<> - -[#diskssdreq] -==== DiskSSDReq +| string +| true -DiskSSDReq defines a specific hardware request for disk of type SSD (true) or rotational (false) +| path +| +| string +| true -|=== -| Field | Description | Scheme | Required +| weight +| +| int32 +| true -| ssd +| region | -| bool -| false +| int32 +| true -| exactMatch -| We only actually care about SSD flag if it is true or ExactMatch is set to true. This second flag is necessary as SSD's bool zero-value (false) is indistinguishable from it being explicitly set to false -| bool -| false +| zone +| +| int32 +| true |=== <> -[#hardwarereqs] -==== HardwareReqs +[#swiftring] +==== SwiftRing -HardwareReqs defines request hardware attributes for the BaremetalHost replicas +SwiftRing is the Schema for the swiftrings API |=== | Field | Description | Scheme | Required -| cpuReqs +| metadata | -| <> +| metav1.ObjectMeta | false -| memReqs +| spec | -| <> +| <> | false -| diskReqs +| status | -| <> +| <> | false |=== <> -[#hoststatus] -==== HostStatus +[#swiftringlist] +==== SwiftRingList -HostStatus represents the IPStatus and provisioning state + deployment information +SwiftRingList contains a list of SwiftRing |=== | Field | Description | Scheme | Required -| provisioningState -| -| ProvisioningState -| true - -| annotatedForDeletion -| Host annotated for deletion -| bool -| true - -| userDataSecretName +| metadata | -| string -| true +| metav1.ListMeta +| false -| networkDataSecretName +| items | -| string +| []<> | true |=== <> -[#ipstatus] -==== IPStatus +[#swiftringspec] +==== SwiftRingSpec -IPStatus represents the hostname and IP info for a specific host +SwiftRingSpec defines the desired state of SwiftRing |=== | Field | Description | Scheme | Required -| hostname -| -| string -| true - -| bmhRef -| +| containerImage +| Image URL for Swift proxy service | string | true - -| ipAddresses -| -| map[string]string -| true |=== <> -[#instancespec] -==== InstanceSpec +[#swiftringspeccore] +==== SwiftRingSpecCore -InstanceSpec Instance specific attributes +SwiftRingSpec defines the desired state of SwiftRing |=== | Field | Description | Scheme | Required -| bmhLabelSelector -| BmhLabelSelector allows for the selection of a particular BaremetalHost based on arbitrary labels -| map[string]string -| false +| enabled +| Enabled - Whether SwiftRing service should be deployed and managed +| bool +| true -| ctlPlaneIP -| CtlPlaneIP - Control Plane IP in CIDR notation -| string -| false +| ringReplicas +| Number of Swift data replicas (=copies) +| *int64 +| true -| ctlplaneGateway -| CtlplaneGateway - IP of gateway for ctrlplane network (TODO: acquire this is another manner?) -| string -| false +| partPower +| Partition power of the Swift rings +| *int64 +| true -| ctlplaneInterface -| CtlplaneInterface - Interface on the provisioned nodes to use for ctlplane network -| string -| false +| minPartHours +| Minimum number of hours to restrict moving a partition more than once +| *int64 +| true -| ctlplaneVlan -| CtlplaneVlan - Vlan for ctlplane network -| *int +| tls +| TLS - Parameters related to the TLS +| tls.Ca | false -| userData -| UserData - Host User Data -| *corev1.SecretReference +| nodeSelector +| NodeSelector to target subset of worker nodes running this service +| *map[string]string | false -| networkData -| NetworkData - Host Network Data -| *corev1.SecretReference -| false +| ringConfigMaps +| List of ring ConfigMaps +| []string +| true |=== <> -[#memgbreq] -==== MemGbReq +[#swiftringstatus] +==== SwiftRingStatus -MemGbReq defines a specific hardware request for memory size +SwiftRingStatus defines the observed state of SwiftRing |=== | Field | Description | Scheme | Required -| gb -| -| int +| conditions +| Conditions +| condition.Conditions | false -| exactMatch -| If ExactMatch == false, actual GB > Gb will match -| bool +| hash +| Map of hashes to track e.g. job status +| map[string]string | false -|=== - -<> - -[#memreqs] -==== MemReqs - -MemReqs defines specific memory hardware requests - -|=== -| Field | Description | Scheme | Required -| gbReq -| -| <> +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) +| int64 | false |=== <> -[#openstackbaremetalset] -==== OpenStackBaremetalSet +[#swiftstorage] +==== SwiftStorage -OpenStackBaremetalSet is the Schema for the openstackbaremetalsets API +SwiftStorage is the Schema for the swiftstorages API |=== | Field | Description | Scheme | Required @@ -14627,21 +19168,21 @@ OpenStackBaremetalSet is the Schema for the openstackbaremetalsets API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#openstackbaremetalsetlist] -==== OpenStackBaremetalSetList +[#swiftstoragelist] +==== SwiftStorageList -OpenStackBaremetalSetList contains a list of OpenStackBaremetalSet +SwiftStorageList contains a list of SwiftStorage |=== | Field | Description | Scheme | Required @@ -14653,177 +19194,296 @@ OpenStackBaremetalSetList contains a list of OpenStackBaremetalSet | items | -| []<> +| []<> | true |=== <> -[#openstackbaremetalsetspec] -==== OpenStackBaremetalSetSpec +[#swiftstoragespec] +==== SwiftStorageSpec -OpenStackBaremetalSetSpec defines the desired state of OpenStackBaremetalSet +SwiftStorageSpec defines the desired state of SwiftStorage |=== | Field | Description | Scheme | Required -| baremetalHosts -| BaremetalHosts - Map of hostname to Instance Spec for all nodes to provision -| map[string]<> +| containerImageAccount +| Image URL for Swift account service +| string +| true + +| containerImageContainer +| Image URL for Swift container service +| string +| true + +| containerImageObject +| Image URL for Swift object service +| string +| true + +| containerImageProxy +| Image URL for Swift proxy service +| string +| true + +| tls +| TLS - Parameters related to the TLS +| tls.Ca | false +|=== -| ctlplaneGateway -| CtlplaneGateway - IP of gateway for ctrlplane network (TODO: acquire this is another manner?) +<> + +[#swiftstoragespeccore] +==== SwiftStorageSpecCore + +SwiftStorageSpecCore - + +|=== +| Field | Description | Scheme | Required + +| replicas +| +| *int32 +| true + +| storageClass +| Name of StorageClass to use for Swift PVs +| string +| true + +| storageRequest +| Minimum size for Swift PVs +| string +| true + +| networkAttachments +| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network +| []string +| false + +| resources +| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ +| corev1.ResourceRequirements +| false + +| memcachedInstance +| Memcached instance name. | string +| true + +| containerSharderEnabled +| If the container sharder daemon is enabled. +| bool +| true + +| defaultConfigOverwrite +| DefaultConfigOverwrite - can be used to add additionalfiles. Those get added to the service config dir in /etc/++++++-conf.d++++++ +| map[string]string | false -| ctlplaneVlan -| CtlplaneVlan - Vlan for ctlplane network -| *int +| nodeSelector +| NodeSelector to target subset of worker nodes running this service +| *map[string]string | false -| bootstrapDns -| BootstrapDNS - initial DNS nameserver values to set on the BaremetalHosts when they are provisioned. Note that subsequent deployment will overwrite these values -| []string +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name +| *topologyv1.TopoRef | false -| dnsSearchDomains -| DNSSearchDomains - initial DNS nameserver values to set on the BaremetalHosts when they are provisioned. Note that subsequent deployment will overwrite these values +| ringConfigMaps +| List of ring ConfigMaps | []string -| false +| true |=== <> -[#openstackbaremetalsetstatus] -==== OpenStackBaremetalSetStatus +[#swiftstoragestatus] +==== SwiftStorageStatus -OpenStackBaremetalSetStatus defines the observed state of OpenStackBaremetalSet +SwiftStorageStatus defines the observed state of SwiftStorage |=== | Field | Description | Scheme | Required +| readyCount +| ReadyCount of SwiftStorage instances +| int32 +| false + | conditions | Conditions | condition.Conditions | false +| networkAttachments +| NetworkAttachments status of the deployment pods +| map[string][]string +| false + | hash | Map of hashes to track e.g. job status | map[string]string | false -| baremetalHosts -| BaremetalHosts that are being processed or have been processed for this OpenStackBaremetalSet -| map[string]<> -| false - | observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) | int64 | false + +| lastAppliedTopology +| LastAppliedTopology - the last applied Topology +| *topologyv1.TopoRef +| false |=== <> -[#openstackbaremetalsettemplatespec] -==== OpenStackBaremetalSetTemplateSpec +[#aodh] +==== Aodh + +Aodh defines the aodh component spec |=== | Field | Description | Scheme | Required -| osImage -| OSImage - OS qcow2 image Name +| apiImage +| | string | true -| osContainerImageUrl -| OSContainerImageURL - Container image URL for init with the OS qcow2 image (osImage) +| evaluatorImage +| +| string +| true + +| notifierImage +| +| string +| true + +| listenerImage +| +| string +| true +|=== + +<> + +[#aodhcore] +==== AodhCore + +Aodh defines the aodh component spec + +|=== +| Field | Description | Scheme | Required + +| apiTimeout +| APITimeout for Route and Apache +| int +| true + +| notificationsBus +| NotificationsBus configuration (username, vhost, and cluster) for notifications +| *rabbitmqv1.RabbitMqConfig +| false + +| rabbitMqClusterName +| RabbitMQ instance name Needed to request a transportURL that is created and used in Aodh Deprecated: Use NotificationsBus.Cluster instead +| string +| false + +| databaseInstance +| MariaDB instance name Right now required by the maridb-operator to get the credentials from the instance to create the DB Might not be required in future +| string +| true + +| databaseAccount +| DatabaseAccount - optional MariaDBAccount CR name used for aodh DB, defaults to aodh | string +| true + +| passwordSelector +| PasswordSelectors - Selectors to identify the service from the Secret +| <> | false -| apacheImageUrl -| ApacheImageURL - Container image URL for the main container that serves the downloaded OS qcow2 image (osImage) +| serviceUser +| ServiceUser - optional username used for this service to register in keystone | string -| false +| true -| agentImageUrl -| AgentImageURL - Container image URL for the sidecar container that discovers provisioning network IPs +| secret +| Secret containing OpenStack password information for aodh | string -| false - -| automatedCleaningMode -| When set to disabled, automated cleaning will be avoided during provisioning and deprovisioning. -| AutomatedCleaningMode | true -| provisionServerName -| ProvisionServerName - Optional. Existing OpenStackProvisionServer to use, else one would be created. +| customServiceConfig +| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ | string | false -| provisionServerNodeSelector -| ProvisonServerNodeSelector to target subset of worker nodes running provision server +| defaultConfigOverwrite +| ConfigOverwrite - interface to overwrite default config files like e.g. logging.conf or policy.json. But can also be used to add additional files. Those get added to the service config dir in /etc/++++++.++++++ | map[string]string | false -| provisioningInterface -| ProvisioningInterface - Optional. If not provided along with ProvisionServerName, it would be discovered from CBO. This is the provisioning interface on the OCP masters/workers. -| string +| networkAttachmentDefinitions +| NetworkAttachmentDefinitions list of network attachment definitions the service pod gets attached to +| []string | false -| deploymentSSHSecret -| DeploymentSSHSecret - Name of secret holding the cloud-admin ssh keys -| string -| true +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> +| false -| ctlplaneInterface -| CtlplaneInterface - Interface on the provisioned nodes to use for ctlplane network -| string +| preserveJobs +| PreserveJobs - do not delete jobs after they finished e.g. to check logs +| bool | true -| ctlplaneBond -| CtlplaneBond - Bonding configuration for ctlplane network -| *<> -| false - -| bmhNamespace -| BmhNamespace Namespace to look for BaremetalHosts(default: openshift-machine-api) +| memcachedInstance +| Memcached instance name. | string | true -| bmhLabelSelector -| BmhLabelSelector allows for a sub-selection of BaremetalHosts based on arbitrary labels -| map[string]string +| tls +| TLS - Parameters related to the TLS +| tls.API | false -| hardwareReqs -| Hardware requests for sub-selection of BaremetalHosts with certain hardware specs -| <> +| nodeSelector +| NodeSelector to target subset of worker nodes running this service +| *map[string]string | false -| passwordSecret -| PasswordSecret the name of the secret used to optionally set the root pwd by adding NodeRootPassword: ++++++to the secret data++++++ -| *corev1.SecretReference +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name +| *topologyv1.TopoRef | false -| cloudUserName -| CloudUser to be configured for remote access +| customConfigsSecretName +| A name of a secret containing custom configuration files. Files from this secret will get copied into /etc/aodh/ and they'll overwrite any default files already present there. | string -| true +| false -| domainName -| DomainName is the domain name that will be set on the underlying Metal3 BaremetalHosts (TODO: acquire this is another manner?) -| string +| auth +| Auth - authentication settings for keystone integration +| <> | false |=== <> -[#openstackprovisionserver] -==== OpenStackProvisionServer +[#autoscaling] +==== Autoscaling -OpenStackProvisionServer used to serve custom images for baremetal provisioning with Metal3 +Autoscaling is the Schema for the autoscalings API |=== | Field | Description | Scheme | Required @@ -14835,216 +19495,186 @@ OpenStackProvisionServer used to serve custom images for baremetal provisioning | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#openstackprovisionserverdefaults] -==== OpenStackProvisionServerDefaults +[#autoscalinglist] +==== AutoscalingList -OpenStackProvisionServerDefaults - +AutoscalingList contains a list of Autoscaling |=== | Field | Description | Scheme | Required -| OSContainerImageURL -| -| string -| false - -| AgentImageURL -| -| string -| false - -| ApacheImageURL +| metadata | -| string +| metav1.ListMeta | false -| OSImage +| items | -| string -| false +| []<> +| true |=== <> -[#openstackprovisionserverlist] -==== OpenStackProvisionServerList +[#autoscalingspec] +==== AutoscalingSpec -OpenStackProvisionServerList contains a list of OpenStackProvisionServer +AutoscalingSpec defines the desired state of Autoscaling |=== | Field | Description | Scheme | Required -| metadata -| -| metav1.ListMeta +| aodh +| Aodh spec +| <> | false - -| items -| -| []<> -| true |=== <> -[#openstackprovisionserverspec] -==== OpenStackProvisionServerSpec +[#autoscalingspecbase] +==== AutoscalingSpecBase -OpenStackProvisionServerSpec defines the desired state of OpenStackProvisionServer +AutoscalingSpecBase - |=== | Field | Description | Scheme | Required -| port -| Port - The port on which the Apache server should listen +| prometheusHost +| Host of user deployed prometheus +| string +| false + +| prometheusPort +| Port of user deployed prometheus | int32 | false -| interface -| Interface - An optional interface to use instead of the cluster's default provisioning interface (if any) -| string +| prometheusTLSCaCertSecret +| If defined, specifies which CA certificate to use for user deployed prometheus +| *corev1.SecretKeySelector | false -| osImage -| OSImage - OS qcow2 image (compressed as gz, or uncompressed) +| heatInstance +| Heat instance name. | string | true +|=== -| osImageDir -| OSImageDir - Directory on the container which holds the OS qcow2 image and checksum -| *string -| true - -| osContainerImageUrl -| OSContainerImageURL - Container image URL for init with the OS qcow2 image (osImage) -| string -| true +<> -| apacheImageUrl -| ApacheImageURL - Container image URL for the main container that serves the downloaded OS qcow2 image (osImage) -| string -| true +[#autoscalingspeccore] +==== AutoscalingSpecCore -| agentImageUrl -| AgentImageURL - Container image URL for the sidecar container that discovers provisioning network IPs -| string -| true +AutoscalingSpecCore defines the desired state of Autoscaling (this version is used by the OpenStackControlplane no image parameters) -| nodeSelector -| NodeSelector to target subset of worker nodes running this provision server -| map[string]string -| false +|=== +| Field | Description | Scheme | Required -| resources -| Resources - Compute Resources required by this provision server (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ -| corev1.ResourceRequirements +| aodh +| Aodh spec +| <> | false - -| preserveJobs -| PreserveJobs - do not delete jobs after they finished e.g. to check logs -| bool -| true |=== <> -[#openstackprovisionserverstatus] -==== OpenStackProvisionServerStatus +[#autoscalingstatus] +==== AutoscalingStatus -OpenStackProvisionServerStatus defines the observed state of OpenStackProvisionServer +AutoscalingStatus defines the observed state of Autoscaling |=== | Field | Description | Scheme | Required | readyCount -| ReadyCount of provision server Apache instances +| ReadyCount of autoscaling instances | int32 | false +| hash +| Map of hashes to track e.g. job status +| map[string]string +| false + | conditions | Conditions | condition.Conditions | false -| hash -| Map of hashes to track e.g. job status -| map[string]string +| networks +| Networks in addtion to the cluster network, the service is attached to +| []string | false -| provisionIp -| IP of the provisioning interface on the node running the ProvisionServer pod +| transportURLSecret +| TransportURLSecret - Secret containing RabbitMQ transportURL | string | false -| provisionIpError -| Any error reported by the provisioning agent during provisioning IP acquisition -| string +| notificationsURLSecret +| NotificationsURLSecret - Secret containing RabbitMQ notification transportURL +| *string | false -| localImageUrl -| URL of provisioning image on underlying Apache web server +| databaseHostname +| DatabaseHostname - Hostname for the database | string | false -| osImageChecksumFilename -| Filename of OSImage checksum +| prometheusHostname +| PrometheusHost - Hostname for prometheus used for autoscaling | string | false -| osImageChecksumType -| OSImage checksum type -| metal3v1.ChecksumType +| prometheusPort +| PrometheusPort - Port for prometheus used for autoscaling +| int32 | false -| localImageChecksumUrl -| URL of provisioning image checksum on underlying Apache web server -| string +| prometheusTLS +| PrometheusTLS - Determines if TLS should be used for accessing prometheus +| bool | false -|=== - -<> -[#bond] -==== Bond - -Bond defines the configuration of each bond interface in the deployment - -|=== -| Field | Description | Scheme | Required +| apiEndpoint +| API endpoint +| map[string]string +| false -| mode -| -| string +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) +| int64 | false -| mtu -| -| int32 +| lastAppliedTopology +| LastAppliedTopology - the last applied Topology +| *topologyv1.TopoRef | false -| links -| -| []string -| true +| applicationCredentialSecret +| ApplicationCredentialSecret - the AC secret aodh is currently consuming +| string +| false |=== <> -[#ovncontroller] -==== OVNController +[#ceilometer] +==== Ceilometer -OVNController is the Schema for the ovncontrollers API +Ceilometer is the Schema for the ceilometers API |=== | Field | Description | Scheme | Required @@ -15056,21 +19686,26 @@ OVNController is the Schema for the ovncontrollers API | spec | -| <> +| <> | false | status | -| <> +| <> +| false + +| ksmStatus +| +| <> | false |=== <> -[#ovncontrollerlist] -==== OVNControllerList +[#ceilometerlist] +==== CeilometerList -OVNControllerList contains a list of OVNController +CeilometerList contains a list of Ceilometer |=== | Field | Description | Scheme | Required @@ -15082,130 +19717,261 @@ OVNControllerList contains a list of OVNController | items | -| []<> +| []<> | true |=== <> -[#ovncontrollerspec] -==== OVNControllerSpec +[#ceilometerspec] +==== CeilometerSpec -OVNControllerSpec defines the desired state of OVNController +CeilometerSpec defines the desired state of Ceilometer |=== | Field | Description | Scheme | Required -| ovsContainerImage -| Image used for the ovsdb-server and ovs-vswitchd containers (will be set to environmental default if empty) +| centralImage +| | string | true -| ovnContainerImage -| Image used for the ovn-controller container (will be set to environmental default if empty) +| notificationImage +| | string | true -| exporterImage -| ExporterImage - Container Image URL for the openstack-network-exporter metrics daemonset (will be set to environmental default if empty) +| sgCoreImage +| | string -| false +| true + +| computeImage +| +| string +| true + +| ipmiImage +| +| string +| true + +| proxyImage +| +| string +| true + +| ksmImage +| +| string +| true + +| mysqldExporterImage +| +| string +| true |=== <> -[#ovncontrollerspeccore] -==== OVNControllerSpecCore +[#ceilometerspeccore] +==== CeilometerSpecCore -OVNControllerSpecCore - +CeilometerSpecCore defines the desired state of Ceilometer. This version is used by the OpenStackControlplane (no image parameters) |=== | Field | Description | Scheme | Required -| external-ids -| -| <> +| apiTimeout +| APITimeout for Apache +| int | true -| nicMappings -| +| notificationsBus +| NotificationsBus configuration (username, vhost, and cluster) for notifications +| *rabbitmqv1.RabbitMqConfig +| false + +| rabbitMqClusterName +| RabbitMQ instance name Needed to request a transportURL that is created and used in Telemetry Deprecated: Use NotificationsBus.Cluster instead +| string +| false + +| passwordSelector +| PasswordSelectors - Selectors to identify the service from the Secret +| <> +| false + +| serviceUser +| ServiceUser - optional username used for this service to register in keystone +| string +| true + +| secret +| Secret containing OpenStack password information for ceilometer +| string +| true + +| customServiceConfig +| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ +| string +| false + +| defaultConfigOverwrite +| ConfigOverwrite - interface to overwrite default config files like e.g. logging.conf or policy.json. But can also be used to add additional files. Those get added to the service config dir in /etc/++++++.++++++ | map[string]string | false -| bondConfiguration -| Map of bond names to their configuration -| map[string]<> +| networkAttachmentDefinitions +| NetworkAttachmentDefinitions list of network attachment definitions the service pod gets attached to +| []string | false -| resources -| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ -| corev1.ResourceRequirements +| ksmEnabled +| Whether kube-state-metrics should be deployed +| *bool | false -| nodeSelector -| NodeSelector to target subset of worker nodes running this service -| *map[string]string +| mysqldExporterEnabled +| Whether mysqld_exporter should be deployed +| *bool | false -| networkAttachment -| NetworkAttachment is a NetworkAttachment resource name to expose the service to the given network. If specified the IP address of this network is used as the OVNEncapIP. +| mysqldExporterDatabaseAccountPrefix +| MysqldExporterDatabaseAccountPrefix - Database account prefix for the mysqld-exporter. A mariadbaccount CR named "++++++-++++++\" for each galera instance needs to be either created by the user or if it's missing, it'll be created by the telemetry-operator automatically.++++++++++++ | string -| true +| false | tls -| TLS - Parameters related to TLS +| TLS - Parameters related to the TLS +| tls.SimpleService +| false + +| ksmTls +| KSMTLS - Parameters related to the TLS for kube-state-metrics +| tls.SimpleService +| false + +| mysqldExporterTLS +| MysqldExporterTLS - Parameters related to the TLS for mysqld_exporter | tls.SimpleService | false +| nodeSelector +| NodeSelector to target subset of worker nodes running this service +| *map[string]string +| false + | topologyRef | TopologyRef to apply the Topology defined by the associated CR referenced by name | *topologyv1.TopoRef | false -| metricsEnabled -| MetricsEnabled enables the metrics daemonset for collecting OVN metrics -| *bool +| customConfigsSecretName +| A name of a secret containing custom configuration files. Files from this secret will get copied into /etc/ceilometer/ and they'll overwrite any default files already present there. +| string | false -| metricsTLS -| MetricsTLS - Parameters related to TLS for metrics daemonset -| tls.SimpleService +| auth +| Auth - authentication settings for keystone integration +| <> | false |=== <> -[#ovncontrollerstatus] -==== OVNControllerStatus +[#ceilometerstatus] +==== CeilometerStatus -OVNControllerStatus defines the observed state of OVNController +CeilometerStatus defines the observed state of Ceilometer |=== | Field | Description | Scheme | Required -| numberReady -| NumberReady of the OVNController instances +| readyCount +| ReadyCount of ceilometer instances | int32 | false -| ovsNumberReady -| ovsNumberReady of ovs instances -| int32 +| hash +| Map of hashes to track e.g. job status +| map[string]string | false -| metricsNumberReady -| MetricsNumberReady of metrics instances +| conditions +| Conditions +| condition.Conditions +| false + +| transportURLSecret +| TransportURLSecret - Secret containing RabbitMQ transportURL +| string +| false + +| notificationsURLSecret +| NotificationsURLSecret - Secret containing RabbitMQ notification transportURL +| *string +| false + +| networks +| Networks in addtion to the cluster network, the service is attached to +| []string +| false + +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) +| int64 +| false + +| mysqldExporterReadyCount +| ReadyCount of mysqld_exporter instances | int32 | false -| desiredNumberScheduled -| DesiredNumberScheduled - total number of the nodes which should be running Daemon +| mysqldExporterHash +| Map of hashes to track e.g. job status +| map[string]string +| false + +| mysqldExporterExportedGaleras +| List of galera CRs, which are being exported with mysqld_exporter +| []string +| false + +| ksmReadyCount +| ReadyCount of kube-state-metrics instances | int32 | false -| conditions -| Conditions -| condition.Conditions +| ksmHash +| Map of hashes to track e.g. job status +| map[string]string +| false + +| lastAppliedTopology +| LastAppliedTopology - the last applied Topology +| *topologyv1.TopoRef +| false + +| applicationCredentialSecret +| ApplicationCredentialSecret - the AC secret ceilometer is currently consuming +| string +| false +|=== + +<> + +[#ksmstatus] +==== KSMStatus + +KSMStatus defines the observed state of kube-state-metrics [DEPRECATED, Status is used instead] + +|=== +| Field | Description | Scheme | Required + +| readyCount +| ReadyCount of ksm instances +| int32 | false | hash @@ -15213,69 +19979,42 @@ OVNControllerStatus defines the observed state of OVNController | map[string]string | false -| networkAttachments -| NetworkAttachments status of the deployment pods -| map[string][]string +| conditions +| Conditions +| condition.Conditions | false | observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes. +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) | int64 | false - -| lastAppliedTopology -| LastAppliedTopology - the last applied Topology -| *topologyv1.TopoRef -| false |=== <> -[#ovsexternalids] -==== OVSExternalIDs - -OVSExternalIDs is a set of configuration options for OVS external-ids table +[#caspec] +==== CASpec |=== | Field | Description | Scheme | Required -| system-id -| -| string -| false - -| ovn-bridge -| -| string -| false - -| ovn-encap-type -| +| caKey +| Key is the data key of a ConfigMap containing a CA certificate. It needs to be in the same namespace as the CloudKitty custom resource. If empty, it defaults to "service-ca.crt". | string | false -| ovn-encap-tos -| +| caName +| CA is the name of a ConfigMap containing a CA certificate. It needs to be in the same namespace as the CloudKitty custom resource. | string | false - -| availability-zones -| -| []string -| false - -| enable-chassis-as-gateway -| DEPRECATED: To be removed in the next API version Any value set to this field is ignored -| *bool -| true |=== <> -[#ovndbcluster] -==== OVNDBCluster +[#cloudkitty] +==== CloudKitty -OVNDBCluster is the Schema for the ovndbclusters API +CloudKitty is the Schema for the cloudkitties API |=== | Field | Description | Scheme | Required @@ -15287,21 +20026,21 @@ OVNDBCluster is the Schema for the ovndbclusters API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#ovndbclusterlist] -==== OVNDBClusterList +[#cloudkittylist] +==== CloudKittyList -OVNDBClusterList contains a list of OVNDBCluster +CloudKittyList contains a list of CloudKitty |=== | Field | Description | Scheme | Required @@ -15313,563 +20052,477 @@ OVNDBClusterList contains a list of OVNDBCluster | items | -| []<> -| true -|=== - -<> - -[#ovndbclusteroverridespec] -==== OVNDBClusterOverrideSpec - -OVNDBClusterOverrideSpec to override the generated manifest of several child resources. - -|=== -| Field | Description | Scheme | Required - -| service -| Override configuration for the Service created to serve traffic to the cluster. -| *service.OverrideSpec -| false -|=== - -<> - -[#ovndbclusterspec] -==== OVNDBClusterSpec - -OVNDBClusterSpec defines the desired state of OVNDBCluster - -|=== -| Field | Description | Scheme | Required - -| containerImage -| ContainerImage - Container Image URL (will be set to environmental default if empty) -| string +| []<> | true - -| exporterImage -| ExporterImage - Container Image URL for the openstack-network-exporter metrics sidecar (will be set to environmental default if empty) -| string -| false |=== <> -[#ovndbclusterspeccore] -==== OVNDBClusterSpecCore +[#cloudkittyservicetemplate] +==== CloudKittyServiceTemplate -OVNDBClusterSpecCore - +CloudKittyServiceTemplate defines the input parameters that can be defined for a given CloudKitty service |=== | Field | Description | Scheme | Required -| dbType -| DBType - NB or SB -| string -| true - -| replicas -| Replicas of OVN DBCluster to run -| *int32 -| true - | nodeSelector -| NodeSelector to target subset of worker nodes running this service +| NodeSelector to target subset of worker nodes running this service. Setting here overrides any global NodeSelector settings within the CloudKitty CR. | *map[string]string | false -| logLevel -| LogLevel - Set log level info, dbg, emer etc +| customServiceConfig +| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to to /etc/++++++/++++++.conf.d directory as a custom config file.++++++++++++ | string | false -| electionTimer -| OVN Northbound and Southbound RAFT db election timer to use on db creation (in milliseconds) -| int32 -| true - -| inactivityProbe -| Probe interval for the OVSDB session (in milliseconds) -| int32 -| true - -| probeIntervalToActive -| Active probe interval from standby to active ovsdb-server remote -| int32 -| true +| customServiceConfigSecrets +| CustomServiceConfigSecrets - customize the service config using this parameter to specify Secrets that contain sensitive service config data. The content of each Secret gets added to the /etc/++++++/++++++.conf.d directory as a custom config file.++++++++++++ +| []string +| false | resources | Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | corev1.ResourceRequirements | false -| storageClass -| StorageClass -| string -| false - -| storageRequest -| StorageRequest -| string -| true - -| networkAttachment -| NetworkAttachment is a NetworkAttachment resource name to expose the service to the given network. If specified the IP address of this network is used as the dbAddress connection. -| string -| true - -| tls -| TLS - Parameters related to TLS -| tls.SimpleService -| false - -| override -| Override, provides the ability to override the generated manifest of several child resources. -| <> +| networkAttachments +| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network +| []string | false | topologyRef | TopologyRef to apply the Topology defined by the associated CR referenced by name | *topologyv1.TopoRef | false +|=== -| metricsEnabled -| MetricsEnabled enables the metrics sidecar container for collecting OVN DB metrics -| *bool -| false +<> + +[#cloudkittyspec] +==== CloudKittySpec + +CloudKittySpec defines the desired state of CloudKitty -| metricsTLS -| MetricsTLS - Parameters related to TLS for metrics sidecar -| tls.SimpleService -| false |=== +| Field | Description | Scheme | Required -<> +| cloudKittyAPI +| CloudKittyAPI - Spec definition for the API service of this CloudKitty deployment +| <> +| true -[#ovndbclusterstatus] -==== OVNDBClusterStatus +| cloudKittyProc +| CloudKittyProc - Spec definition for the Scheduler service of this CloudKitty deployment +| <> +| true +|=== -OVNDBClusterStatus defines the observed state of OVNDBCluster +<> + +[#cloudkittyspecbase] +==== CloudKittySpecBase |=== | Field | Description | Scheme | Required -| readyCount -| ReadyCount of OVN DBCluster instances -| int32 -| false +| databaseInstance +| MariaDB instance name Right now required by the maridb-operator to get the credentials from the instance to create the DB Might not be required in future +| string +| true -| hash -| Map of hashes to track e.g. job status -| map[string]string +| messagingBus +| MessagingBus configuration (username, vhost, and cluster) +| rabbitmqv1.RabbitMqConfig | false -| conditions -| Conditions -| condition.Conditions +| rabbitMqClusterName +| RabbitMQ instance name Needed to request a transportURL that is created and used in CloudKitty Deprecated: Use MessagingBus.Cluster instead +| string | false -| dbAddress -| DBAddress - DB IP address used by external nodes +| memcachedInstance +| Memcached instance name. | string -| false +| true -| internalDbAddress -| InternalDBAddress - DB IP address used by other Pods in the cluster +| preserveJobs +| PreserveJobs - do not delete jobs after they finished e.g. to check logs +| bool +| true + +| customServiceConfig +| CustomServiceConfig - customize the service config for all CloudKitty services using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to to /etc/++++++/++++++.conf.d directory as a custom config file.++++++++++++ | string | false -| networkAttachments -| NetworkAttachments status of the deployment pods -| map[string][]string +| nodeSelector +| NodeSelector to target subset of worker nodes running this service. Setting NodeSelector here acts as a default value and can be overridden by service specific NodeSelector Settings. +| *map[string]string | false -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes. -| int64 -| false +| apiTimeout +| APITimeout for HAProxy, Apache, and rpc_response_timeout +| int +| true -| lastAppliedTopology -| LastAppliedTopology - the last applied Topology +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name | *topologyv1.TopoRef | false -|=== - -<> - -[#ovnnorthd] -==== OVNNorthd -OVNNorthd is the Schema for the ovnnorthds API - -|=== -| Field | Description | Scheme | Required - -| metadata -| -| metav1.ObjectMeta +| prometheusHost +| Host of user deployed prometheus +| string | false -| spec -| -| <> +| prometheusPort +| Port of user deployed prometheus +| int32 | false -| status -| -| <> +| prometheusTLSCaCertSecret +| If defined, specifies which CA certificate to use for user deployed prometheus +| *corev1.SecretKeySelector | false -|=== -<> - -[#ovnnorthdlist] -==== OVNNorthdList - -OVNNorthdList contains a list of OVNNorthd +| period +| Period for collecting metrics in seconds +| int32 +| true -|=== -| Field | Description | Scheme | Required +| s3StorageConfig +| S3 related configuration passed to Loki +| <> +| true -| metadata -| -| metav1.ListMeta +| storageClass +| Storage class used for Loki +| string | false -| items -| -| []<> +| lokiStackSize +| Size of the LokiStack. Supported are "1x.demo" (default), "1x.pico", "1x.extra-small", "1x.small", "1x.medium" +| string +| true + +| lokiRetentionDays +| LokiRetentionDays defines the number of days logs are kept in Loki storage. Set to 0 to disable retention limits. +| uint +| true + +| useStructuredMetadata +| UseStructuredMetadata enables Loki structured metadata filters for CloudKitty storage queries (Loki 3.0+). Only enable after all data stored without structured metadata has expired. +| bool | true |=== <> -[#ovnnorthdspec] -==== OVNNorthdSpec +[#cloudkittyspeccore] +==== CloudKittySpecCore -OVNNorthdSpec defines the desired state of OVNNorthd +CloudKittySpecCore the same as CloudKittySpec without ContainerImage references |=== | Field | Description | Scheme | Required -| containerImage -| ContainerImage - Container Image URL (will be set to environmental default if empty) -| string +| cloudKittyAPI +| CloudKittyAPI - Spec definition for the API service of this CloudKitty deployment +| <> | true -| exporterImage -| ExporterImage - Container Image URL for the openstack-network-exporter metrics sidecar (will be set to environmental default if empty) -| string -| false +| cloudKittyProc +| CloudKittyProc - Spec definition for the Scheduler service of this CloudKitty deployment +| <> +| true |=== <> -[#ovnnorthdspeccore] -==== OVNNorthdSpecCore +[#cloudkittystatus] +==== CloudKittyStatus -OVNNorthdSpecCore - +CloudKittyStatus defines the observed state of CloudKitty |=== | Field | Description | Scheme | Required -| replicas -| Replicas of OVN Northd to run -| *int32 -| true +| hash +| Map of hashes to track e.g. job status +| map[string]string +| false -| nodeSelector -| NodeSelector to target subset of worker nodes running this service -| *map[string]string +| conditions +| Conditions +| condition.Conditions | false -| logLevel -| LogLevel - Set log level info, dbg, emer etc +| databaseHostname +| CloudKitty Database Hostname | string | false -| resources -| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ -| corev1.ResourceRequirements +| transportURLSecret +| TransportURLSecret - Secret containing RabbitMQ transportURL +| string | false -| tls -| TLS - Parameters related to TLS -| tls.SimpleService +| apiEndpoints +| API endpoints +| map[string]map[string]string | false -| nThreads -| NThreads sets number of threads used for building logical flows -| *int32 +| serviceIDs +| ServiceIDs +| map[string]string +| false + +| cloudKittyAPIReadyCount +| ReadyCount of CloudKitty API instance +| int32 | true -| topologyRef -| TopologyRef to apply the Topology defined by the associated CR referenced by name -| *topologyv1.TopoRef +| cloudKittyProcReadyCounts +| ReadyCount of CloudKitty Processor instances +| int32 +| true + +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is different than the spec generation, then the controller has not started processing the latest changes, and the status and its conditions are likely stale. +| int64 | false -| metricsEnabled -| MetricsEnabled enables the metrics sidecar container for collecting OVN metrics -| *bool +| prometheusHostname +| PrometheusHost - Hostname for prometheus used for autoscaling +| string | false -| metricsTLS -| MetricsTLS - Parameters related to TLS for metrics sidecar -| tls.SimpleService +| prometheusPort +| PrometheusPort - Port for prometheus used for autoscaling +| int32 +| false + +| prometheusTLS +| PrometheusTLS - Determines if TLS should be used for accessing prometheus +| bool +| false + +| applicationCredentialSecret +| ApplicationCredentialSecret - the AC secret cloudkitty is currently consuming +| string | false |=== <> -[#ovnnorthdstatus] -==== OVNNorthdStatus +[#cloudkittytemplate] +==== CloudKittyTemplate -OVNNorthdStatus defines the observed state of OVNNorthd +CloudKittyTemplate defines common input parameters used by all CloudKitty services |=== | Field | Description | Scheme | Required -| readyCount -| ReadyCount of OVN Northd instances -| int32 -| false +| serviceUser +| ServiceUser - optional username used for this service to register in cloudkitty +| string +| true -| conditions -| Conditions -| condition.Conditions -| false +| databaseAccount +| DatabaseAccount - optional MariaDBAccount used for cloudkitty DB, defaults to cloudkitty +| string +| true -| hash -| Map of hashes to track e.g. job status -| map[string]string -| false +| secret +| Secret containing OpenStack password information +| string +| true -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes. -| int64 -| false +| passwordSelector +| PasswordsSelectors - Selectors to identify the ServiceUser password from the Secret +| <> +| true -| lastAppliedTopology -| LastAppliedTopology - the last applied Topology -| *topologyv1.TopoRef +| auth +| Auth - authentication settings for keystone integration +| <> | false |=== <> -[#apioverridespec-2] -==== APIOverrideSpec - -APIOverrideSpec to override the generated manifest of several child resources. +[#objectstorageschema] +==== ObjectStorageSchema |=== | Field | Description | Scheme | Required -| service -| Override configuration for the Service created to serve traffic to the cluster. The key must be the endpoint type (public, internal) -| map[service.Endpoint]service.RoutedOverrideSpec -| false +| version +| Version for writing and reading logs. +| string +| true + +| effectiveDate +| EffectiveDate contains a date in YYYY-MM-DD format which is interpreted in the UTC time zone.\n\nThe configuration always needs at least one schema that is currently valid. This means that when creating a new CloudKitty it is recommended to add a schema with the latest available version and an effective date of "yesterday". New schema versions added to the configuration always needs to be placed "in the future", so that Loki can start using it once the day rolls over. +| string +| true |=== <> -[#passwordselector-2] -==== PasswordSelector - -PasswordSelector to identify the DB and AdminUser password from the Secret +[#objectstoragesecretspec] +==== ObjectStorageSecretSpec |=== | Field | Description | Scheme | Required -| service -| Service - Selector to get the service user password from the Secret +| type +| Type of object storage that should be used | string | true + +| name +| Name of a secret in the namespace configured for object storage secrets. +| string +| true + +| credentialMode +| CredentialMode can be used to set the desired credential mode for authenticating with the object storage. If this is not set, then the operator tries to infer the credential mode from the provided secret and its own configuration. +| string +| false |=== <> -[#placementapi] -==== PlacementAPI - -PlacementAPI is the Schema for the placementapis API +[#objectstoragespec] +==== ObjectStorageSpec |=== | Field | Description | Scheme | Required -| metadata -| -| metav1.ObjectMeta -| false +| schemas +| Schemas for reading and writing logs. +| []<> +| true -| spec -| -| <> -| false +| secret +| Secret for object storage authentication. Name of a secret in the same namespace as the CloudKitty custom resource. +| <> +| true -| status -| -| <> +| tls +| TLS configuration for reaching the object storage endpoint. +| *<> | false |=== <> -[#placementapilist] -==== PlacementAPIList +[#cloudkittyapi] +==== CloudKittyAPI -PlacementAPIList contains a list of PlacementAPI +CloudKittyAPI is the Schema for the cloudkittyapis API |=== | Field | Description | Scheme | Required | metadata | -| metav1.ListMeta +| metav1.ObjectMeta | false -| items +| spec | -| []<> -| true -|=== - -<> - -[#placementapispec] -==== PlacementAPISpec - -PlacementAPISpec defines the desired state of PlacementAPI - -|=== -| Field | Description | Scheme | Required +| <> +| false -| containerImage -| PlacementAPI Container Image URL (will be set to environmental default if empty) -| string -| true +| status +| +| <> +| false |=== <> -[#placementapispeccore] -==== PlacementAPISpecCore +[#cloudkittyapilist] +==== CloudKittyAPIList -PlacementAPISpecCore - +CloudKittyAPIList contains a list of CloudKittyAPI |=== | Field | Description | Scheme | Required -| apiTimeout -| APITimeout for HAProxy, Apache -| int -| true - -| serviceUser -| ServiceUser - optional username used for this service to register in keystone -| string -| true - -| databaseInstance -| MariaDB instance name Right now required by the maridb-operator to get the credentials from the instance to create the DB Might not be required in future -| string -| true - -| databaseAccount -| DatabaseAccount - name of MariaDBAccount which will be used to connect. -| string -| true - -| replicas -| Replicas of placement API to run -| *int32 -| true - -| secret -| Secret containing OpenStack password information for placement PlacementPassword -| string -| true - -| passwordSelectors -| PasswordSelectors - Selectors to identify the DB and ServiceUser password from the Secret -| <> -| true - -| nodeSelector -| NodeSelector to target subset of worker nodes running this service -| *map[string]string -| false - -| preserveJobs -| PreserveJobs - do not delete jobs after they finished e.g. to check logs -| bool -| true +| metadata +| +| metav1.ListMeta +| false -| customServiceConfig -| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ -| string +| items +| +| []<> | true +|=== -| defaultConfigOverwrite -| DefaultConfigOverwrite - interface to overwrite default config files like policy.yaml. -| map[string]string -| false +<> -| resources -| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ -| corev1.ResourceRequirements -| false +[#cloudkittyapispec] +==== CloudKittyAPISpec -| networkAttachments -| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network -| []string -| false +CloudKittyAPISpec defines the desired state of CloudKittyAPI -| override -| Override, provides the ability to override the generated manifest of several child resources. -| <> -| false +|=== +| Field | Description | Scheme | Required -| tls -| TLS - Parameters related to the TLS -| tls.API -| false +| databaseHostname +| DatabaseHostname - CloudKitty Database Hostname +| string +| true -| topologyRef -| TopologyRef to apply the Topology defined by the associated CR referenced by name -| *topologyv1.TopoRef -| false +| transportURLSecret +| Secret containing RabbitMq transport URL +| string +| true + +| serviceAccount +| ServiceAccount - service account name used internally to provide CloudKitty services the default SA name +| string +| true |=== <> -[#placementapistatus] -==== PlacementAPIStatus +[#cloudkittyapistatus] +==== CloudKittyAPIStatus -PlacementAPIStatus defines the observed state of PlacementAPI +CloudKittyAPIStatus defines the observed state of CloudKittyAPI |=== | Field | Description | Scheme | Required -| readyCount -| ReadyCount of placement API instances -| int32 -| false - | hash | Map of hashes to track e.g. job status | map[string]string | false +| apiEndpoints +| API endpoints +| map[string]map[string]string +| false + | conditions | Conditions | condition.Conditions | false -| databaseHostname -| Placement Database Hostname -| string +| readyCount +| ReadyCount of CloudKitty API instances +| int32 +| true + +| serviceIDs +| ServiceIDs +| map[string]string | false | networkAttachments @@ -15878,7 +20531,7 @@ PlacementAPIStatus defines the observed state of PlacementAPI | false | observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes. +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is different than the spec generation, then the controller has not started processing the latest changes, and the status and its conditions are likely stale. | int64 | false @@ -15886,46 +20539,66 @@ PlacementAPIStatus defines the observed state of PlacementAPI | LastAppliedTopology - the last applied Topology | *topologyv1.TopoRef | false + +| appliedInputSecretHash +| AppliedInputSecretHash - hash of the input secrets that the child has fully rolled out, used by the parent to track credential rotation convergence +| string +| false |=== <> -[#passwordselector-2] -==== PasswordSelector +[#cloudkittyapitemplate] +==== CloudKittyAPITemplate -PasswordSelector to identify the AdminUser password from the Secret +CloudKittyAPITemplate defines the input parameters for the CloudKitty API service |=== | Field | Description | Scheme | Required -| service -| Service - Selector to get the Swift service password from the Secret +| containerImage +| ContainerImage - CloudKitty Container Image URL (will be set to environmental default if empty) | string | true |=== <> -[#proxyoverridespec] -==== ProxyOverrideSpec +[#cloudkittyapitemplatecore] +==== CloudKittyAPITemplateCore -ProxyOverrideSpec to override the generated manifest of several child resources. +CloudKittyAPITemplateCore defines the input parameters for the CloudKitty API service |=== | Field | Description | Scheme | Required -| service -| Override configuration for the Service created to serve traffic to the cluster. The key must be the endpoint type (public, internal) -| map[service.Endpoint]service.RoutedOverrideSpec +| replicas +| Replicas - CloudKitty API Replicas +| *int32 +| true + +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> +| false + +| tls +| TLS - Parameters related to the TLS +| tls.API +| false + +| customConfigsSecretName +| A name of a secret containing custom configuration files. Files from this secret will get copied into /etc/cloudkitty/ and they'll overwrite any default files already present there. +| string | false |=== <> -[#swiftproxy] -==== SwiftProxy +[#cloudkittyproc] +==== CloudKittyProc -SwiftProxy is the Schema for the swiftproxies API +CloudKittyProc is the Schema for the cloudkittprocs API |=== | Field | Description | Scheme | Required @@ -15937,21 +20610,21 @@ SwiftProxy is the Schema for the swiftproxies API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#swiftproxylist] -==== SwiftProxyList +[#cloudkittyproclist] +==== CloudKittyProcList -SwiftProxyList contains a list of SwiftProxy +CloudKittyProcList contains a list of CloudKittyProc |=== | Field | Description | Scheme | Required @@ -15963,130 +20636,49 @@ SwiftProxyList contains a list of SwiftProxy | items | -| []<> -| true -|=== - -<> - -[#swiftproxyspec] -==== SwiftProxySpec - -SwiftProxySpec defines the desired state of SwiftProxy - -|=== -| Field | Description | Scheme | Required - -| containerImageProxy -| Swift Proxy Container Image URL -| string +| []<> | true |=== <> -[#swiftproxyspeccore] -==== SwiftProxySpecCore +[#cloudkittyprocspec] +==== CloudKittyProcSpec -SwiftProxySpecCore - +CloudKittyProcSpec defines the desired state of CloudKitty Processor |=== | Field | Description | Scheme | Required -| replicas -| Replicas of Swift Proxy -| *int32 -| true - -| serviceUser -| ServiceUser - optional username used for this service to register in Swift -| string -| true - -| secret -| Secret containing OpenStack password information for Swift service user password +| databaseHostname +| DatabaseHostname - CloudKitty Database Hostname | string | true -| passwordSelectors -| PasswordSelector - Selector to choose the Swift user password from the Secret -| <> -| true - -| override -| Override, provides the ability to override the generated manifest of several child resources. -| <> -| false - -| networkAttachments -| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network -| []string -| false - -| memcachedInstance -| Memcached instance name. +| transportURLSecret +| Secret containing RabbitMq transport URL | string | true -| rabbitMqClusterName -| RabbitMQ instance name to request a transportURL for Ceilometer middleware +| serviceAccount +| ServiceAccount - service account name used internally to provide CloudKitty services the default SA name | string | true - -| tls -| TLS - Parameters related to the TLS -| tls.API -| false - -| defaultConfigOverwrite -| DefaultConfigOverwrite - can be used to add additionalfiles. Those get added to the service config dir in /etc/++++++-conf.d++++++ -| map[string]string -| false - -| encryptionEnabled -| Encrypts new objects at rest -| bool -| true - -| ceilometerEnabled -| Enables ceilometer in the swift proxy and creates required resources -| bool -| true - -| nodeSelector -| NodeSelector to target subset of worker nodes running this service -| *map[string]string -| false - -| topologyRef -| TopologyRef to apply the Topology defined by the associated CR referenced by name -| *topologyv1.TopoRef -| false - -| apiTimeout -| Default APITimeout for HAProxy and Apache, defaults to 60 seconds -| int -| false - -| ringConfigMaps -| List of ring ConfigMaps -| []string -| true |=== <> -[#swiftproxystatus] -==== SwiftProxyStatus +[#cloudkittyprocstatus] +==== CloudKittyProcStatus -SwiftProxyStatus defines the observed state of SwiftProxy +CloudKittyProcStatus defines the observed state of CloudKitty Processor |=== | Field | Description | Scheme | Required -| readyCount -| ReadyCount of SwiftProxy instances -| int32 +| hash +| Map of hashes to track e.g. job status +| map[string]string | false | conditions @@ -16094,23 +20686,18 @@ SwiftProxyStatus defines the observed state of SwiftProxy | condition.Conditions | false +| readyCount +| ReadyCount of CloudKitty Processor instances +| int32 +| true + | networkAttachments | NetworkAttachments status of the deployment pods | map[string][]string | false -| hash -| Map of hashes to track e.g. job status -| map[string]string -| false - -| transportURLSecret -| TransportURLSecret - Secret containing RabbitMQ transportURL -| string -| false - | observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is different than the spec generation, then the controller has not started processing the latest changes, and the status and its conditions are likely stale. | int64 | false @@ -16118,48 +20705,61 @@ SwiftProxyStatus defines the observed state of SwiftProxy | LastAppliedTopology - the last applied Topology | *topologyv1.TopoRef | false + +| appliedInputSecretHash +| AppliedInputSecretHash - hash of the input secrets that the child has fully rolled out, used by the parent to track credential rotation convergence +| string +| false |=== <> -[#swiftdisk] -==== SwiftDisk +[#cloudkittyproctemplate] +==== CloudKittyProcTemplate + +CloudKittyProcTemplate defines the input parameters for the CloudKitty Processor service |=== | Field | Description | Scheme | Required -| device -| +| containerImage +| ContainerImage - CloudKitty Container Image URL (will be set to environmental default if empty) | string | true +|=== -| path -| -| string -| true +<> -| weight -| -| int32 -| true +[#cloudkittyproctemplatecore] +==== CloudKittyProcTemplateCore -| region -| -| int32 -| true +CloudKittyProcTemplateCore defines the input parameters for the CloudKitty Processor service -| zone -| -| int32 +|=== +| Field | Description | Scheme | Required + +| replicas +| Replicas - CloudKitty API Replicas +| *int32 | true + +| tls +| TLS - Parameters related to the TLS +| tls.SimpleService +| false + +| customConfigsSecretName +| A name of a secret containing custom configuration files. Files from this secret will get copied into /etc/cloudkitty/ and they'll overwrite any default files already present there. +| string +| false |=== <> -[#swiftring] -==== SwiftRing +[#logging] +==== Logging -SwiftRing is the Schema for the swiftrings API +Logging is the Schema for the loggings API |=== | Field | Description | Scheme | Required @@ -16171,21 +20771,21 @@ SwiftRing is the Schema for the swiftrings API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#swiftringlist] -==== SwiftRingList +[#logginglist] +==== LoggingList -SwiftRingList contains a list of SwiftRing +LoggingList contains a list of Logging |=== | Field | Description | Scheme | Required @@ -16197,92 +20797,81 @@ SwiftRingList contains a list of SwiftRing | items | -| []<> +| []<> | true |=== <> -[#swiftringspec] -==== SwiftRingSpec +[#loggingspec] +==== LoggingSpec -SwiftRingSpec defines the desired state of SwiftRing +LoggingSpec defines the desired state of Logging |=== | Field | Description | Scheme | Required -| containerImage -| Image URL for Swift proxy service -| string +| port +| Port is the port where the service will listen on +| int32 | true -|=== - -<> - -[#swiftringspeccore] -==== SwiftRingSpecCore - -SwiftRingSpec defines the desired state of SwiftRing - -|=== -| Field | Description | Scheme | Required -| enabled -| Enabled - Whether SwiftRing service should be deployed and managed -| bool +| targetPort +| TargetPort is the port where the logging syslog receiver is listening +| int | true -| ringReplicas -| Number of Swift data replicas (=copies) -| *int64 +| cloNamespace +| CLONamespace points to the namespace where the cluster-logging-operator is deployed +| string | true -| partPower -| Partition power of the Swift rings -| *int64 +| annotations +| Annotations is a way to configure certain LoadBalancers, like MetalLB +| map[string]string | true -| minPartHours -| Minimum number of hours to restrict moving a partition more than once -| *int64 +| rsyslogRetries +| The number of retries rsyslog will attempt before abandoning +| int32 | true -| tls -| TLS - Parameters related to the TLS -| tls.Ca -| false +| rsyslogQueueType +| The type of the local queue of logs +| string +| true -| nodeSelector -| NodeSelector to target subset of worker nodes running this service -| *map[string]string -| false +| rsyslogQueueSize +| The size of the local queue of logs +| int32 +| true -| ringConfigMaps -| List of ring ConfigMaps -| []string +| rsyslogTemplate +| The template format for rsyslog forwarding actions +| string | true |=== <> -[#swiftringstatus] -==== SwiftRingStatus +[#loggingstatus] +==== LoggingStatus -SwiftRingStatus defines the observed state of SwiftRing +LoggingStatus defines the observed state of Logging |=== | Field | Description | Scheme | Required -| conditions -| Conditions -| condition.Conditions -| false - | hash | Map of hashes to track e.g. job status | map[string]string | false +| conditions +| Conditions +| condition.Conditions +| false + | observedGeneration | ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) | int64 @@ -16291,10 +20880,10 @@ SwiftRingStatus defines the observed state of SwiftRing <> -[#swiftstorage] -==== SwiftStorage +[#metricstorage] +==== MetricStorage -SwiftStorage is the Schema for the swiftstorages API +MetricStorage is the Schema for the metricstorages API |=== | Field | Description | Scheme | Required @@ -16306,21 +20895,21 @@ SwiftStorage is the Schema for the swiftstorages API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#swiftstoragelist] -==== SwiftStorageList +[#metricstoragelist] +==== MetricStorageList -SwiftStorageList contains a list of SwiftStorage +MetricStorageList contains a list of MetricStorage |=== | Field | Description | Scheme | Required @@ -16332,448 +20921,372 @@ SwiftStorageList contains a list of SwiftStorage | items | -| []<> +| []<> | true |=== <> -[#swiftstoragespec] -==== SwiftStorageSpec +[#metricstoragespec] +==== MetricStorageSpec -SwiftStorageSpec defines the desired state of SwiftStorage +MetricStorageSpec defines the desired state of MetricStorage |=== | Field | Description | Scheme | Required -| containerImageAccount -| Image URL for Swift account service -| string +| dashboardsEnabled +| DashboardsEnabled allows to enable or disable dashboards and related artifacts +| bool | true -| containerImageContainer -| Image URL for Swift container service -| string +| dataplaneNetwork +| DataplaneNetwork defines the network that will be used to scrape dataplane node_exporter endpoints +| *infranetworkv1.NetNameStr | true -| containerImageObject -| Image URL for Swift object service -| string +| networkAttachments +| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network +| []string | true -| containerImageProxy -| Image URL for Swift proxy service +| monitoringStack +| MonitoringStack allows to define a metric storage with options supported by Red Hat +| *<> +| false + +| customMonitoringStack +| CustomMonitoringStack allows to deploy a custom monitoring stack when the options in "MonitoringStack" aren't enough +| *obov1.MonitoringStackSpec +| false + +| prometheusTls +| TLS - Parameters related to the Prometheus TLS +| tls.SimpleService +| false + +| prometheusClientCertSecret +| PrometheusClientCertSecret - Secret containing client cert and key (tls.crt, tls.key) for Prometheus to present when scraping targets that require mTLS. +| tls.GenericService +| false + +| openStackLightspeedNamespace +| OpenStackLightspeedNamespace defines the namespace where OpenStack Lightspeed is deployed. Used for discovering Lightspeed metrics services. | string | true + +| alertmanagerTls +| TLS - Parameters related to the Alertmanager TLS. The value of caBundleSecretName is currently ignored. +| tls.SimpleService +| false |=== <> -[#swiftstoragespeccore] -==== SwiftStorageSpecCore +[#metricstoragestatus] +==== MetricStorageStatus -SwiftStorageSpecCore - +MetricStorageStatus defines the observed state of MetricStorage |=== | Field | Description | Scheme | Required -| replicas +| conditions | -| *int32 -| true - -| storageClass -| Name of StorageClass to use for Swift PVs -| string -| true - -| storageRequest -| Minimum size for Swift PVs -| string -| true - -| networkAttachments -| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network -| []string +| condition.Conditions | false -| memcachedInstance -| Memcached instance name. -| string -| true - -| containerSharderEnabled -| If the container sharder daemon is enabled. +| prometheusTLSPatched +| Deprecated: used only for upgrade migration from the old direct Prometheus CR TLS patching to the new MonitoringStack WebTLSConfig API. Can be removed once all deployments have upgraded past this version. | bool -| true - -| defaultConfigOverwrite -| DefaultConfigOverwrite - can be used to add additionalfiles. Those get added to the service config dir in /etc/++++++-conf.d++++++ -| map[string]string | false -| nodeSelector -| NodeSelector to target subset of worker nodes running this service -| *map[string]string +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) +| int64 | false -| topologyRef -| TopologyRef to apply the Topology defined by the associated CR referenced by name -| *topologyv1.TopoRef +| networkAttachments +| NetworkAttachments status of the Prometheus pods +| map[string]string | false - -| ringConfigMaps -| List of ring ConfigMaps -| []string -| true |=== <> -[#swiftstoragestatus] -==== SwiftStorageStatus +[#monitoringstack] +==== MonitoringStack -SwiftStorageStatus defines the observed state of SwiftStorage +MonitoringStack defines the options for a Red Hat supported metric storage |=== | Field | Description | Scheme | Required -| readyCount -| ReadyCount of SwiftStorage instances -| int32 -| false - -| conditions -| Conditions -| condition.Conditions -| false - -| networkAttachments -| NetworkAttachments status of the deployment pods -| map[string][]string -| false - -| hash -| Map of hashes to track e.g. job status -| map[string]string -| false +| alertingEnabled +| AlertingEnabled allows to enable or disable alertmanager +| bool +| true -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) -| int64 -| false +| scrapeInterval +| ScrapeInterval sets the interval between scrapes +| string +| true -| lastAppliedTopology -| LastAppliedTopology - the last applied Topology -| *topologyv1.TopoRef +| storage +| Storage allows to define options for how to store metrics +| <> +| true + +| nodeSelector +| NodeSelector to target subset of worker nodes running this service +| *map[string]string | false |=== <> -[#swift] -==== Swift +[#persistentstorage] +==== PersistentStorage -Swift is the Schema for the swifts API +PersistentStorage defines storage options used for persistent storage |=== | Field | Description | Scheme | Required -| metadata -| -| metav1.ObjectMeta -| false +| pvcStorageRequest +| PvcStorageRequest The amount of storage to request in PVC +| string +| true -| spec -| -| <> +| pvcStorageSelector +| PvcStorageSelector The Label selector to specify in PVCs +| metav1.LabelSelector | false -| status -| -| <> +| pvcStorageClass +| PvcStorageClass The storage class to use for storing metrics +| string | false |=== <> -[#swiftlist] -==== SwiftList +[#storage-2] +==== Storage -SwiftList contains a list of Swift +Storage defines the options used for storage of metrics |=== | Field | Description | Scheme | Required -| metadata -| -| metav1.ListMeta -| false +| strategy +| Strategy to use for storage. Can be "persistent", "ephemeral" or empty, in which case a COO default is used +| string +| true -| items -| -| []<> +| retention +| Retention time for metrics +| string | true + +| persistent +| Used to specify the options of persistent storage when strategy = "persistent" +| *<> +| false |=== <> -[#swiftspec] -==== SwiftSpec +[#apioverridespec-2] +==== APIOverrideSpec -SwiftSpec defines the desired state of Swift +APIOverrideSpec to override the generated manifest of several child resources. |=== | Field | Description | Scheme | Required -| swiftRing -| SwiftRing - Spec definition for the Ring service of this Swift deployment -| <> -| true - -| swiftStorage -| SwiftStorage - Spec definition for the Storage service of this Swift deployment -| <> -| true - -| swiftProxy -| SwiftProxy - Spec definition for the Proxy service of this Swift deployment -| <> -| true +| service +| Override configuration for the Service created to serve traffic to the cluster. The key must be the endpoint type (public, internal) +| map[service.Endpoint]service.RoutedOverrideSpec +| false |=== <> -[#swiftspecbase] -==== SwiftSpecBase +[#authspec-2] +==== AuthSpec -SwiftSpecBase - +AuthSpec - authentication settings for keystone integration |=== | Field | Description | Scheme | Required -| storageClass -| Storage class. This is passed to SwiftStorage unless storageClass is explicitly set for the SwiftStorage. +| applicationCredentialSecret +| ApplicationCredentialSecret - secret name for application credential | string -| true - -| networkAttachments -| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network -| []string | false +|=== -| memcachedInstance -| Memcached instance name. -| string -| true +<> -| nodeSelector -| NodeSelector to target subset of worker nodes running this service -| *map[string]string -| false +[#autoscalingsection] +==== AutoscalingSection -| topologyRef -| TopologyRef to apply the Topology defined by the associated CR referenced by name -| *topologyv1.TopoRef -| false +AutoscalingSection defines the desired state of the autoscaling service -| ringConfigMaps -| List of ring ConfigMaps -| []string +|=== +| Field | Description | Scheme | Required + +| enabled +| Enabled - Whether OpenStack autoscaling service should be deployed and managed +| *bool | true |=== <> -[#swiftspeccore] -==== SwiftSpecCore +[#autoscalingsectioncore] +==== AutoscalingSectionCore -SwiftSpecCore defines the desired state of Swift (this version is used by OpenStackControlplane) +AutoscalingSectionCore defines the desired state of the autoscaling service |=== | Field | Description | Scheme | Required -| swiftRing -| SwiftRing - Spec definition for the Ring service of this Swift deployment -| <> -| true - -| swiftStorage -| SwiftStorage - Spec definition for the Storage service of this Swift deployment -| <> -| true - -| swiftProxy -| SwiftProxy - Spec definition for the Proxy service of this Swift deployment -| <> +| enabled +| Enabled - Whether OpenStack autoscaling service should be deployed and managed +| *bool | true |=== <> -[#swiftstatus] -==== SwiftStatus +[#ceilometersection] +==== CeilometerSection -SwiftStatus defines the observed state of Swift +CeilometerSection defines the desired state of the ceilometer service |=== | Field | Description | Scheme | Required -| conditions -| Conditions -| condition.Conditions -| false - -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) -| int64 -| false +| enabled +| Enabled - Whether OpenStack Ceilometer service should be deployed and managed +| *bool +| true |=== <> -[#apioverridespec-2] -==== APIOverrideSpec +[#ceilometersectioncore] +==== CeilometerSectionCore -APIOverrideSpec to override the generated manifest of several child resources. +CeilometerSectionCore defines the desired state of the ceilometer service |=== | Field | Description | Scheme | Required -| service -| Override configuration for the Service created to serve traffic to the cluster. The key must be the endpoint type (public, internal) -| map[service.Endpoint]service.RoutedOverrideSpec -| false +| enabled +| Enabled - Whether OpenStack Ceilometer service should be deployed and managed +| *bool +| true |=== <> -[#aodh] -==== Aodh +[#cloudkittysection] +==== CloudKittySection -Aodh defines the aodh component spec +CloudKittySpec defines the desired state of the cloudkitty service |=== | Field | Description | Scheme | Required -| apiImage -| -| string +| enabled +| Enabled - Whether OpenStack CloudKitty service should be deployed and managed +| *bool | true +|=== -| evaluatorImage -| -| string -| true +<> -| notifierImage -| -| string -| true +[#cloudkittysectioncore] +==== CloudKittySectionCore -| listenerImage -| -| string +CloudKittySpec defines the desired state of the cloudkitty service + +|=== +| Field | Description | Scheme | Required + +| enabled +| Enabled - Whether OpenStack CloudKitty service should be deployed and managed +| *bool | true |=== <> -[#aodhcore] -==== AodhCore +[#loggingsection] +==== LoggingSection -Aodh defines the aodh component spec +LoggingSection defines the desired state of the logging service |=== | Field | Description | Scheme | Required -| apiTimeout -| APITimeout for Route and Apache -| int -| true - -| rabbitMqClusterName -| RabbitMQ instance name Needed to request a transportURL that is created and used in Aodh -| string -| false - -| databaseInstance -| MariaDB instance name Right now required by the maridb-operator to get the credentials from the instance to create the DB Might not be required in future -| string +| enabled +| Enabled - Whether OpenStack logging service should be deployed and managed +| *bool | true +|=== -| databaseAccount -| DatabaseAccount - optional MariaDBAccount CR name used for aodh DB, defaults to aodh -| string -| true +<> -| passwordSelector -| PasswordSelectors - Selectors to identify the service from the Secret -| <> -| false +[#metricstoragesection] +==== MetricStorageSection -| serviceUser -| ServiceUser - optional username used for this service to register in keystone -| string -| true +MetricStorageSection defines the desired state of the MetricStorage -| secret -| Secret containing OpenStack password information for aodh -| string +|=== +| Field | Description | Scheme | Required + +| enabled +| Enabled - Whether a MetricStorage should be deployed and managed +| *bool | true +|=== -| customServiceConfig -| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ -| string -| false +<> -| defaultConfigOverwrite -| ConfigOverwrite - interface to overwrite default config files like e.g. logging.conf or policy.json. But can also be used to add additional files. Those get added to the service config dir in /etc/++++++.++++++ -| map[string]string -| false +[#passwordsselector] +==== PasswordsSelector -| networkAttachmentDefinitions -| NetworkAttachmentDefinitions list of network attachment definitions the service pod gets attached to -| []string -| false +PasswordsSelector to identify the Service password from the Secret -| override -| Override, provides the ability to override the generated manifest of several child resources. -| <> -| false +|=== +| Field | Description | Scheme | Required -| preserveJobs -| PreserveJobs - do not delete jobs after they finished e.g. to check logs -| bool +| ceilometerService +| CeilometerService - Selector to get the ceilometer service password from the Secret +| string | true -| memcachedInstance -| Memcached instance name. +| aodhService +| AodhService - Selector to get the aodh service password from the Secret | string | true -| tls -| TLS - Parameters related to the TLS -| tls.API -| false - -| nodeSelector -| NodeSelector to target subset of worker nodes running this service -| *map[string]string -| false - -| topologyRef -| TopologyRef to apply the Topology defined by the associated CR referenced by name -| *topologyv1.TopoRef -| false +| cloudKittyService +| CloudKittyService - Selector to get the CloudKitty service password from the Secret +| string +| true |=== <> -[#autoscaling] -==== Autoscaling +[#telemetry] +==== Telemetry -Autoscaling is the Schema for the autoscalings API +Telemetry is the Schema for the telemetry API |=== | Field | Description | Scheme | Required @@ -16785,21 +21298,21 @@ Autoscaling is the Schema for the autoscalings API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#autoscalinglist] -==== AutoscalingList +[#telemetrylist] +==== TelemetryList -AutoscalingList contains a list of Autoscaling +TelemetryList contains a list of Telemetry |=== | Field | Description | Scheme | Required @@ -16811,88 +21324,103 @@ AutoscalingList contains a list of Autoscaling | items | -| []<> +| []<> | true |=== <> -[#autoscalingspec] -==== AutoscalingSpec +[#telemetryspec] +==== TelemetrySpec -AutoscalingSpec defines the desired state of Autoscaling +TelemetrySpec defines the desired state of Telemetry |=== | Field | Description | Scheme | Required -| aodh -| Aodh spec -| <> +| autoscaling +| Autoscaling - Parameters related to the autoscaling service +| <> +| false + +| ceilometer +| Ceilometer - Parameters related to the ceilometer service +| <> +| false + +| cloudkitty +| CloudKitty - Parameters related to the cloudkitty service +| <> | false |=== <> -[#autoscalingspecbase] -==== AutoscalingSpecBase +[#telemetryspecbase] +==== TelemetrySpecBase -AutoscalingSpecBase - +TelemetrySpecBase - |=== | Field | Description | Scheme | Required -| prometheusHost -| Host of user deployed prometheus -| string +| metricStorage +| MetricStorage - Parameters related to the metricStorage +| <> | false -| prometheusPort -| Port of user deployed prometheus -| int32 +| logging +| Logging - Parameters related to the logging +| <> | false -| prometheusTLSCaCertSecret -| If defined, specifies which CA certificate to use for user deployed prometheus -| *corev1.SecretKeySelector +| nodeSelector +| NodeSelector to target subset of worker nodes running this service +| *map[string]string | false -| heatInstance -| Heat instance name. -| string -| true +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name +| *topologyv1.TopoRef +| false |=== <> -[#autoscalingspeccore] -==== AutoscalingSpecCore +[#telemetryspeccore] +==== TelemetrySpecCore -AutoscalingSpecCore defines the desired state of Autoscaling (this version is used by the OpenStackControlplane no image parameters) +TelemetrySpecCore defines the desired state of Telemetry. This version has no image parameters and is used by OpenStackControlplane |=== | Field | Description | Scheme | Required -| aodh -| Aodh spec -| <> +| autoscaling +| Autoscaling - Parameters related to the autoscaling service +| <> +| false + +| ceilometer +| Ceilometer - Parameters related to the ceilometer service +| <> +| false + +| cloudkitty +| CloudKitty - Parameters related to the cloudkitty service +| <> | false |=== <> -[#autoscalingstatus] -==== AutoscalingStatus +[#telemetrystatus] +==== TelemetryStatus -AutoscalingStatus defines the observed state of Autoscaling +TelemetryStatus defines the observed state of Telemetry |=== | Field | Description | Scheme | Required -| readyCount -| ReadyCount of autoscaling instances -| int32 -| false - | hash | Map of hashes to track e.g. job status | map[string]string @@ -16903,354 +21431,410 @@ AutoscalingStatus defines the observed state of Autoscaling | condition.Conditions | false -| networks -| Networks in addtion to the cluster network, the service is attached to -| []string +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) +| int64 | false -| transportURLSecret -| TransportURLSecret - Secret containing RabbitMQ transportURL -| string +| lastAppliedTopology +| LastAppliedTopology - the last applied Topology +| *topologyv1.TopoRef | false +|=== -| databaseHostname -| DatabaseHostname - Hostname for the database -| string -| false +<> -| prometheusHostname -| PrometheusHost - Hostname for prometheus used for autoscaling +[#authspec-2] +==== AuthSpec + +AuthSpec defines authentication parameters + +|=== +| Field | Description | Scheme | Required + +| applicationCredentialSecret +| ApplicationCredentialSecret - Secret containing Application Credential ID and Secret | string | false +|=== -| prometheusPort -| PrometheusPort - Port for prometheus used for autoscaling -| int32 -| false +<> -| prometheusTLS -| PrometheusTLS - Determines if TLS should be used for accessing prometheus -| bool -| false +[#passwordselector-2] +==== PasswordSelector -| apiEndpoint -| API endpoint -| map[string]string -| false +PasswordSelector to identify the DB and AdminUser password from the Secret -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) -| int64 -| false +|=== +| Field | Description | Scheme | Required -| lastAppliedTopology -| LastAppliedTopology - the last applied Topology -| *topologyv1.TopoRef -| false +| service +| Service - Selector to get the watcher service user password from the Secret +| *string +| true |=== <> -[#ceilometer] -==== Ceilometer +[#watchercommon] +==== WatcherCommon -Ceilometer is the Schema for the ceilometers API +WatcherCommon defines a spec based reusable for all the CRDs |=== | Field | Description | Scheme | Required -| metadata -| -| metav1.ObjectMeta -| false +| serviceUser +| ServiceUser - optional username used for this service to register in keystone +| *string +| true -| spec -| -| <> +| passwordSelectors +| PasswordSelectors - Selectors to identify the ServiceUser password from the Secret +| <> +| true + +| memcachedInstance +| MemcachedInstance is the name of the Memcached CR that all watcher service will use. +| *string +| true + +| preserveJobs +| PreserveJobs - do not delete jobs after they finished e.g. to check logs +| bool +| true + +| nodeSelector +| NodeSelector to target subset of worker nodes running this component. Setting here overrides any global NodeSelector settings within the Watcher CR. +| *map[string]string | false -| status -| -| <> +| customServiceConfig +| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to to /etc/++++++/++++++.conf.d directory as a custom config file.++++++++++++ +| string | false -| ksmStatus -| -| <> +| prometheusSecret +| Secret containing prometheus connection parameters +| *string +| true + +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name +| *topologyv1.TopoRef | false |=== <> -[#ceilometerlist] -==== CeilometerList +[#watcherimages] +==== WatcherImages -CeilometerList contains a list of Ceilometer +WatcherImages defines the container images for all Watcher services |=== | Field | Description | Scheme | Required -| metadata -| -| metav1.ListMeta -| false +| apiContainerImageURL +| APIContainerImageURL +| string +| true -| items -| -| []<> +| decisionengineContainerImageURL +| DecisionEngineContainerImageURL +| string +| true + +| applierContainerImageURL +| ApplierContainerImageURL +| string | true |=== <> -[#ceilometerspec] -==== CeilometerSpec +[#watcherspeccore] +==== WatcherSpecCore -CeilometerSpec defines the desired state of Ceilometer +WatcherSpecCore defines the fields used from the OpenStackControlPlane CR (does not include images) |=== | Field | Description | Scheme | Required -| centralImage -| -| string +| messagingBus +| MessagingBus configuration (username, vhost, and cluster) +| rabbitmqv1.RabbitMqConfig +| false + +| notificationsBus +| NotificationsBus configuration (username, vhost, and cluster) for notifications +| *rabbitmqv1.RabbitMqConfig +| false + +| rabbitMqClusterName +| RabbitMQ instance name Needed to request a transportURL that is created and used in Watcher Deprecated: Use MessagingBus.Cluster instead +| *string +| false + +| secret +| Secret containing all passwords / keys needed +| *string | true -| notificationImage -| -| string +| databaseInstance +| MariaDB instance name Required to use the mariadb-operator instance to create the DB and user +| *string | true -| sgCoreImage -| -| string +| databaseAccount +| DatabaseAccount - MariaDBAccount CR name used for watcher DB, defaults to watcher +| *string | true -| computeImage -| -| string +| apiServiceTemplate +| APIServiceTemplate - define the watcher-api service +| <> | true -| ipmiImage -| -| string +| applierServiceTemplate +| WatcherApplierTemplate - define the watcher-applier service +| <> | true -| proxyImage -| -| string +| decisionengineServiceTemplate +| DecisionEngineServiceTemplate - define the watcher-decision-engine service +| <> | true -| ksmImage -| -| string +| dbPurge +| DBPurge defines the parameters for the Watcher DB purging cron job +| <> | true -| mysqldExporterImage -| -| string +| apiTimeout +| APITimeout for Route and Apache +| *int | true + +| auth +| Auth - Parameters related to authentication (shared by all Watcher components) +| <> +| false + +| notificationsBusInstance +| NotificationsBusInstance is the name of the RabbitMqCluster CR to select the Message Bus Service instance used by the Watcher service to publish and consume notifications from other services. If undefined, the value will be inherited from OpenStackControlPlane. An empty value "" leaves the notification drivers unconfigured and emitting no notifications at all. Avoid colocating it with RabbitMqClusterName or other message bus instances used for RPC. Deprecated: Use NotificationsBus.Cluster instead +| *string +| false |=== <> -[#ceilometerspeccore] -==== CeilometerSpecCore +[#watchersubcrscommon] +==== WatcherSubCrsCommon -CeilometerSpecCore defines the desired state of Ceilometer. This version is used by the OpenStackControlplane (no image parameters) +WatcherSubCrsCommon defines the common fields for Watcher sub-CRs |=== | Field | Description | Scheme | Required -| apiTimeout -| APITimeout for Apache -| int -| true - -| rabbitMqClusterName -| RabbitMQ instance name Needed to request a transportURL that is created and used in Telemetry +| containerImage +| The service specific Container Image URL (will be set to environmental default if empty) | string -| false +| true -| passwordSelector -| PasswordSelectors - Selectors to identify the service from the Secret -| <> +| resources +| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ +| corev1.ResourceRequirements | false -| serviceUser -| ServiceUser - optional username used for this service to register in keystone +| serviceAccount +| ServiceAccount - service account name used internally to provide Watcher services the default SA name | string | true +|=== -| secret -| Secret containing OpenStack password information for ceilometer -| string -| true +<> -| customServiceConfig -| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to /etc/++++++/++++++.conf.d directory as custom.conf file.++++++++++++ -| string -| false +[#watchersubcrstemplate] +==== WatcherSubCrsTemplate -| defaultConfigOverwrite -| ConfigOverwrite - interface to overwrite default config files like e.g. logging.conf or policy.json. But can also be used to add additional files. Those get added to the service config dir in /etc/++++++.++++++ -| map[string]string -| false +WatcherSubCrsTemplate define de common part of the input parameters specified by the user to create a 2nd CR via higher level CRDs. -| networkAttachmentDefinitions -| NetworkAttachmentDefinitions list of network attachment definitions the service pod gets attached to -| []string -| false +|=== +| Field | Description | Scheme | Required -| ksmEnabled -| Whether kube-state-metrics should be deployed -| *bool +| resources +| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ +| corev1.ResourceRequirements | false -| mysqldExporterEnabled -| Whether mysqld_exporter should be deployed -| *bool +| nodeSelector +| NodeSelector to target subset of worker nodes running this component. Setting here overrides any global NodeSelector settings within the Watcher CR. +| *map[string]string | false -| mysqldExporterDatabaseAccountPrefix -| MysqldExporterDatabaseAccountPrefix - Database account prefix for the mysqld-exporter. A mariadbaccount CR named "++++++-++++++\" for each galera instance needs to be either created by the user or if it's missing, it'll be created by the telemetry-operator automatically.++++++++++++ +| customServiceConfig +| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to to /etc/++++++/++++++.conf.d directory as a custom config file.++++++++++++ | string | false -| tls -| TLS - Parameters related to the TLS -| tls.SimpleService +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name +| *topologyv1.TopoRef | false +|=== -| ksmTls -| KSMTLS - Parameters related to the TLS for kube-state-metrics -| tls.SimpleService -| false +<> -| mysqldExporterTLS -| MysqldExporterTLS - Parameters related to the TLS for mysqld_exporter -| tls.SimpleService +[#watcher] +==== Watcher + +Watcher is the Schema for the watchers API + +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ObjectMeta | false -| nodeSelector -| NodeSelector to target subset of worker nodes running this service -| *map[string]string +| spec +| +| <> | false -| topologyRef -| TopologyRef to apply the Topology defined by the associated CR referenced by name -| *topologyv1.TopoRef +| status +| +| <> | false |=== <> -[#ceilometerstatus] -==== CeilometerStatus +[#watcherdbpurge] +==== WatcherDBPurge -CeilometerStatus defines the observed state of Ceilometer +WatcherDBPurge defines the parameters for the Watcher database purging cron job |=== | Field | Description | Scheme | Required -| readyCount -| ReadyCount of ceilometer instances -| int32 -| false +| schedule +| Schedule defines when to run the Watcher DB Purge job in a cron format. By default it runs everyday at 01:00. +| *string +| true -| hash -| Map of hashes to track e.g. job status -| map[string]string +| purgeAge +| PurgeAge defines the minimum age of soft-deleted records in days that can be deleted from the shadow tables +| *int +| true +|=== + +<> + +[#watcherlist] +==== WatcherList + +WatcherList contains a list of Watcher + +|=== +| Field | Description | Scheme | Required + +| metadata +| +| metav1.ListMeta | false +| items +| +| []<> +| true +|=== + +<> + +[#watcherstatus] +==== WatcherStatus + +WatcherStatus defines the observed state of Watcher + +|=== +| Field | Description | Scheme | Required + | conditions | Conditions | condition.Conditions | false -| transportURLSecret -| TransportURLSecret - Secret containing RabbitMQ transportURL +| serviceID +| ServiceID - The ID of the watcher service registered in keystone | string | false -| networks -| Networks in addtion to the cluster network, the service is attached to -| []string +| hash +| Map of hashes to track e.g. job status +| map[string]string | false | observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) | int64 | false -| mysqldExporterReadyCount -| ReadyCount of mysqld_exporter instances +| apiServiceReadyCount +| APIServiceReadyCount defines the number or replicas ready from watcher-api | int32 | false -| mysqldExporterHash -| Map of hashes to track e.g. job status -| map[string]string +| applierServiceReadyCount +| ApplierServiceReadyCount defines the number or replicas ready from watcher-applier +| int32 | false -| mysqldExporterExportedGaleras -| List of galera CRs, which are being exported with mysqld_exporter -| []string +| decisionengineServiceReadyCount +| DecisionEngineServiceReadyCount defines the number or replicas ready from watcher-decision-engine +| int32 | false -| ksmReadyCount -| ReadyCount of kube-state-metrics instances -| int32 +| applicationCredentialSecret +| ApplicationCredentialSecret - the AC secret watcher is currently consuming and protecting with the openstack.org/watcher-ac-consumer finalizer. Tracked so the controller can remove its finalizer from the old secret when the openstack-operator rotates the reference. +| string | false -| ksmHash -| Map of hashes to track e.g. job status -| map[string]string +| transportURLSecret +| TransportURLSecret - the transport URL secret watcher is currently consuming and protecting with the openstack.org/watcher-transport-consumer finalizer. Tracked so the controller can remove its finalizer from the old secret when the transport URL is rotated. +| string | false -| lastAppliedTopology -| LastAppliedTopology - the last applied Topology -| *topologyv1.TopoRef +| notificationsTransportURLSecret +| NotificationsTransportURLSecret - the notifications transport URL secret watcher is currently consuming and protecting with the openstack.org/watcher-transport-consumer finalizer. Tracked so the controller can remove its finalizer from the old secret on rotation. +| string | false |=== <> -[#ksmstatus] -==== KSMStatus +[#apioverridespec-2] +==== APIOverrideSpec -KSMStatus defines the observed state of kube-state-metrics [DEPRECATED, Status is used instead] +APIOverrideSpec to override the generated manifest of several child resources. |=== | Field | Description | Scheme | Required -| readyCount -| ReadyCount of ksm instances -| int32 -| false - -| hash -| Map of hashes to track e.g. job status -| map[string]string -| false - -| conditions -| Conditions -| condition.Conditions -| false - -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) -| int64 +| service +| Override configuration for the Service created to serve traffic to the cluster. The key must be the endpoint type (public, internal) +| map[service.Endpoint]service.RoutedOverrideSpec | false |=== <> -[#logging] -==== Logging +[#watcherapi] +==== WatcherAPI -Logging is the Schema for the loggings API +WatcherAPI is the Schema for the watcherapis API |=== | Field | Description | Scheme | Required @@ -17262,21 +21846,21 @@ Logging is the Schema for the loggings API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#logginglist] -==== LoggingList +[#watcherapilist] +==== WatcherAPIList -LoggingList contains a list of Logging +WatcherAPIList contains a list of WatcherAPI |=== | Field | Description | Scheme | Required @@ -17288,71 +21872,56 @@ LoggingList contains a list of Logging | items | -| []<> +| []<> | true |=== <> -[#loggingspec] -==== LoggingSpec +[#watcherapispec] +==== WatcherAPISpec -LoggingSpec defines the desired state of Logging +WatcherAPISpec defines the desired state of WatcherAPI |=== | Field | Description | Scheme | Required -| port -| Port is the port where the service will listen on -| int32 -| true - -| targetPort -| TargetPort is the port where the logging syslog receiver is listening -| int -| true - -| cloNamespace -| CLONamespace points to the namespace where the cluster-logging-operator is deployed +| secret +| Secret containing all passwords / keys needed | string | true -| annotations -| Annotations is a way to configure certain LoadBalancers, like MetalLB -| map[string]string +| replicas +| Replicas of Watcher service to run +| *int32 | true -| rsyslogRetries -| The number of retries rsyslog will attempt before abandoning -| int32 -| true +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> +| false -| rsyslogQueueType -| The type of the local queue of logs -| string -| true +| tls +| TLS - Parameters related to the TLS +| tls.API +| false -| rsyslogQueueSize -| The size of the local queue of logs -| int32 +| apiTimeout +| APITimeout for Route and Apache +| int | true |=== <> -[#loggingstatus] -==== LoggingStatus +[#watcherapistatus] +==== WatcherAPIStatus -LoggingStatus defines the observed state of Logging +WatcherAPIStatus defines the observed state of WatcherAPI |=== | Field | Description | Scheme | Required -| hash -| Map of hashes to track e.g. job status -| map[string]string -| false - | conditions | Conditions | condition.Conditions @@ -17362,328 +21931,341 @@ LoggingStatus defines the observed state of Logging | ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) | int64 | false -|=== - -<> - -[#metricstorage] -==== MetricStorage - -MetricStorage is the Schema for the metricstorages API -|=== -| Field | Description | Scheme | Required +| readyCount +| ReadyCount of watcher API instances +| int32 +| false -| metadata -| -| metav1.ObjectMeta +| hash +| Map of hashes to track e.g. job status +| map[string]string | false -| spec -| -| <> +| appliedInputSecretHash +| AppliedInputSecretHash is the hash of the input Secret consumed by the currently ready workload. +| string | false -| status -| -| <> +| lastAppliedTopology +| LastAppliedTopology - the last applied Topology +| *topologyv1.TopoRef | false |=== <> -[#metricstoragelist] -==== MetricStorageList +[#watcherapitemplate] +==== WatcherAPITemplate -MetricStorageList contains a list of MetricStorage +WatcherAPITemplate defines the input parameters specified by the user to create a WatcherAPI via higher level CRDs. |=== | Field | Description | Scheme | Required -| metadata -| -| metav1.ListMeta +| replicas +| Replicas of WatcherAPI service to run +| *int32 +| true + +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> | false -| items -| -| []<> -| true +| tls +| TLS - Parameters related to the TLS +| tls.API +| false |=== <> -[#metricstoragespec] -==== MetricStorageSpec +[#watcherapplier] +==== WatcherApplier -MetricStorageSpec defines the desired state of MetricStorage +WatcherApplier is the Schema for the watcherappliers API |=== | Field | Description | Scheme | Required -| dashboardsEnabled -| DashboardsEnabled allows to enable or disable dashboards and related artifacts -| bool -| true - -| dataplaneNetwork -| DataplaneNetwork defines the network that will be used to scrape dataplane node_exporter endpoints -| *infranetworkv1.NetNameStr -| true - -| networkAttachments -| NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network -| []string -| false - -| monitoringStack -| MonitoringStack allows to define a metric storage with options supported by Red Hat -| *<> +| metadata +| +| metav1.ObjectMeta | false -| customMonitoringStack -| CustomMonitoringStack allows to deploy a custom monitoring stack when the options in "MonitoringStack" aren't enough -| *obov1.MonitoringStackSpec +| spec +| +| <> | false -| prometheusTls -| TLS - Parameters related to the TLS -| tls.SimpleService +| status +| +| <> | false |=== <> -[#metricstoragestatus] -==== MetricStorageStatus +[#watcherapplierlist] +==== WatcherApplierList -MetricStorageStatus defines the observed state of MetricStorage +WatcherApplierList contains a list of WatcherApplier |=== | Field | Description | Scheme | Required -| conditions +| metadata | -| condition.Conditions +| metav1.ListMeta | false -| prometheusTLSPatched +| items | -| bool -| false - -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) -| int64 -| false - -| networkAttachments -| NetworkAttachments status of the Prometheus pods -| map[string]string -| false +| []<> +| true |=== <> -[#monitoringstack] -==== MonitoringStack +[#watcherapplierspec] +==== WatcherApplierSpec -MonitoringStack defines the options for a Red Hat supported metric storage +WatcherApplierSpec defines the desired state of WatcherApplier |=== | Field | Description | Scheme | Required -| alertingEnabled -| AlertingEnabled allows to enable or disable alertmanager -| bool -| true - -| scrapeInterval -| ScrapeInterval sets the interval between scrapes +| secret +| Secret containing all passwords / keys needed | string | true -| storage -| Storage allows to define options for how to store metrics -| <> +| replicas +| Replicas of Watcher service to run +| *int32 | true + +| tls +| TLS - Parameters related to the TLS +| tls.Ca +| false |=== <> -[#persistentstorage] -==== PersistentStorage +[#watcherapplierstatus] +==== WatcherApplierStatus -PersistentStorage defines storage options used for persistent storage +WatcherApplierStatus defines the observed state of WatcherApplier |=== | Field | Description | Scheme | Required -| pvcStorageRequest -| PvcStorageRequest The amount of storage to request in PVC -| string -| true +| conditions +| Conditions +| condition.Conditions +| false -| pvcStorageSelector -| PvcStorageSelector The Label selector to specify in PVCs -| metav1.LabelSelector +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) +| int64 | false -| pvcStorageClass -| PvcStorageClass The storage class to use for storing metrics +| readyCount +| ReadyCount of watcher Applier instances +| int32 +| false + +| hash +| Map of hashes to track e.g. job status +| map[string]string +| false + +| appliedInputSecretHash +| AppliedInputSecretHash is the hash of the input Secret consumed by the currently ready workload. | string | false + +| lastAppliedTopology +| LastAppliedTopology - the last applied Topology +| *topologyv1.TopoRef +| false |=== <> -[#storage-2] -==== Storage +[#watcherappliertemplate] +==== WatcherApplierTemplate -Storage defines the options used for storage of metrics +WatcherApplierTemplate defines the input parameters specified by the user to create a WatcherApplier via higher level CRDs. |=== | Field | Description | Scheme | Required -| strategy -| Strategy to use for storage. Can be "persistent", "ephemeral" or empty, in which case a COO default is used -| string -| true - -| retention -| Retention time for metrics -| string +| replicas +| Replicas of WatcherApplier service to run +| *int32 | true - -| persistent -| Used to specify the options of persistent storage when strategy = "persistent" -| *<> -| false |=== <> -[#autoscalingsection] -==== AutoscalingSection +[#watcherdecisionengine] +==== WatcherDecisionEngine -AutoscalingSection defines the desired state of the autoscaling service +WatcherDecisionEngine is the Schema for the watcherdecisionengines API |=== | Field | Description | Scheme | Required -| enabled -| Enabled - Whether OpenStack autoscaling service should be deployed and managed -| *bool -| true +| metadata +| +| metav1.ObjectMeta +| false + +| spec +| +| <> +| false + +| status +| +| <> +| false |=== <> -[#autoscalingsectioncore] -==== AutoscalingSectionCore +[#watcherdecisionenginelist] +==== WatcherDecisionEngineList -AutoscalingSectionCore defines the desired state of the autoscaling service +WatcherDecisionEngineList contains a list of WatcherDecisionEngine |=== | Field | Description | Scheme | Required -| enabled -| Enabled - Whether OpenStack autoscaling service should be deployed and managed -| *bool +| metadata +| +| metav1.ListMeta +| false + +| items +| +| []<> | true |=== <> -[#ceilometersection] -==== CeilometerSection +[#watcherdecisionenginespec] +==== WatcherDecisionEngineSpec -CeilometerSection defines the desired state of the ceilometer service +WatcherDecisionEngineSpec defines the desired state of WatcherDecisionEngine |=== | Field | Description | Scheme | Required -| enabled -| Enabled - Whether OpenStack Ceilometer service should be deployed and managed -| *bool +| secret +| Secret containing all passwords / keys needed +| string +| true + +| replicas +| Replicas of Watcher service to run +| *int32 | true + +| tls +| TLS - Parameters related to the TLS +| tls.Ca +| false |=== <> -[#ceilometersectioncore] -==== CeilometerSectionCore +[#watcherdecisionenginestatus] +==== WatcherDecisionEngineStatus -CeilometerSectionCore defines the desired state of the ceilometer service +WatcherDecisionEngineStatus defines the observed state of WatcherDecisionEngine |=== | Field | Description | Scheme | Required -| enabled -| Enabled - Whether OpenStack Ceilometer service should be deployed and managed -| *bool -| true -|=== +| conditions +| INSERT ADDITIONAL STATUS FIELD - define observed state of cluster Important: Run "make" to regenerate code after modifying this file +| condition.Conditions +| false -<> +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) +| int64 +| false -[#loggingsection] -==== LoggingSection +| readyCount +| ReadyCount of WatcherDecisionEngine instances +| int32 +| false -LoggingSection defines the desired state of the logging service +| hash +| Map of hashes to track e.g. job status +| map[string]string +| false -|=== -| Field | Description | Scheme | Required +| appliedInputSecretHash +| AppliedInputSecretHash is the hash of the input Secret consumed by the currently ready workload. +| string +| false -| enabled -| Enabled - Whether OpenStack logging service should be deployed and managed -| *bool -| true +| lastAppliedTopology +| LastAppliedTopology - the last applied Topology +| *topologyv1.TopoRef +| false |=== <> -[#metricstoragesection] -==== MetricStorageSection +[#watcherdecisionenginetemplate] +==== WatcherDecisionEngineTemplate -MetricStorageSection defines the desired state of the MetricStorage +WatcherDecisionEngineTemplate defines the input parameters specified by the user to create a WatcherDecisionengine via higher level CRDs. |=== | Field | Description | Scheme | Required -| enabled -| Enabled - Whether a MetricStorage should be deployed and managed -| *bool +| replicas +| Replicas of WatcherDecisionEngine service to run +| *int32 | true |=== <> -[#passwordsselector] -==== PasswordsSelector +[#mtlssection] +==== MTLSSection -PasswordsSelector to identify the Service password from the Secret +MTLSSection contains mutual TLS configuration |=== | Field | Description | Scheme | Required -| ceilometerService -| CeilometerService - Selector to get the ceilometer service password from the Secret +| sslVerifyMode +| Used to enforce client side tls cert validation | string -| true +| false -| aodhService -| AodhService - Selector to get the aodh service password from the Secret -| string -| true +| authCertSecret +| Name of the secret containing the client cert used to perform mtls auth +| tls.GenericService +| false |=== <> -[#telemetry] -==== Telemetry +[#memcached] +==== Memcached -Telemetry is the Schema for the telemetry API +Memcached is the Schema for the memcacheds API |=== | Field | Description | Scheme | Required @@ -17695,21 +22277,21 @@ Telemetry is the Schema for the telemetry API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#telemetrylist] -==== TelemetryList +[#memcachedlist] +==== MemcachedList -TelemetryList contains a list of Telemetry +MemcachedList contains a list of Memcached |=== | Field | Description | Scheme | Required @@ -17721,105 +22303,124 @@ TelemetryList contains a list of Telemetry | items | -| []<> +| []<> | true |=== <> -[#telemetryspec] -==== TelemetrySpec +[#memcachedspec] +==== MemcachedSpec -TelemetrySpec defines the desired state of Telemetry +MemcachedSpec defines the desired state of Memcached |=== -| Field | Description | Scheme | Required - -| autoscaling -| Autoscaling - Parameters related to the autoscaling service -| <> -| false - -| ceilometer -| Ceilometer - Parameters related to the ceilometer service -| <> -| false +| Field | Description | Scheme | Required + +| containerImage +| Name of the memcached container image to run (will be set to environmental default if empty) +| string +| true |=== <> -[#telemetryspecbase] -==== TelemetrySpecBase +[#memcachedspeccore] +==== MemcachedSpecCore -TelemetrySpecBase - +MemcachedSpecCore - this version is used by the OpenStackControlplane CR (no container images) |=== | Field | Description | Scheme | Required -| metricStorage -| MetricStorage - Parameters related to the metricStorage -| <> -| false - -| logging -| Logging - Parameters related to the logging -| <> -| false +| replicas +| Size of the memcached cluster +| *int32 +| true | nodeSelector | NodeSelector to target subset of worker nodes running this service | *map[string]string | false -| topologyRef -| TopologyRef to apply the Topology defined by the associated CR referenced by name -| *topologyv1.TopoRef +| tls +| TLS settings for memcached service +| <> | false -|=== -<> - -[#telemetryspeccore] -==== TelemetrySpecCore +| cacheSize +| Maximum Memcached cache size in MB +| int32 +| true -TelemetrySpecCore defines the desired state of Telemetry. This version has no image parameters and is used by OpenStackControlplane +| maxConn +| Maximum number of connections accepted by Memcached +| int32 +| true -|=== -| Field | Description | Scheme | Required +| logLevel +| LogLevel controls memcached logging verbosity: "none" (quiet), "verbose" (-v), or "debug" (-vv). +| string +| false -| autoscaling -| Autoscaling - Parameters related to the autoscaling service -| <> +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name +| *topologyv1.TopoRef | false -| ceilometer -| Ceilometer - Parameters related to the ceilometer service -| <> +| resources +| Resources QoS configuration for pods +| corev1.ResourceRequirements | false |=== <> -[#telemetrystatus] -==== TelemetryStatus +[#memcachedstatus] +==== MemcachedStatus -TelemetryStatus defines the observed state of Telemetry +MemcachedStatus defines the observed state of Memcached |=== | Field | Description | Scheme | Required | hash -| Map of hashes to track e.g. job status +| Map of hashes to track input changes | map[string]string | false +| readyCount +| ReadyCount of Memcached instances +| int32 +| false + | conditions | Conditions | condition.Conditions | false +| serverList +| ServerList - List of memcached endpoints without inet(6) prefix +| []string +| false + +| serverListWithInet +| ServerListWithInet - List of memcached endpoints with inet(6) prefix +| []string +| false + +| tlsSupport +| Whether TLS is supported by the memcached instance +| bool +| false + +| mtlsCert +| Name of the certificate used for MTLS +| string +| false + | observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) | int64 | false @@ -17831,235 +22432,131 @@ TelemetryStatus defines the observed state of Telemetry <> -[#passwordselector-2] -==== PasswordSelector +[#tlssection-2] +==== TLSSection -PasswordSelector to identify the DB and AdminUser password from the Secret +TLSSection contains TLS and MTLS configuration |=== | Field | Description | Scheme | Required -| service -| Service - Selector to get the watcher service user password from the Secret -| *string -| true +| mtls +| +| <> +| false |=== <> -[#watchercommon] -==== WatcherCommon +[#bgpconfiguration] +==== BGPConfiguration -WatcherCommon defines a spec based reusable for all the CRDs +BGPConfiguration is the Schema for the bgpconfigurations API |=== | Field | Description | Scheme | Required -| serviceUser -| ServiceUser - optional username used for this service to register in keystone -| *string -| true - -| passwordSelectors -| PasswordSelectors - Selectors to identify the ServiceUser password from the Secret -| <> -| true - -| memcachedInstance -| MemcachedInstance is the name of the Memcached CR that all watcher service will use. -| *string -| true - -| preserveJobs -| PreserveJobs - do not delete jobs after they finished e.g. to check logs -| bool -| true - -| nodeSelector -| NodeSelector to target subset of worker nodes running this component. Setting here overrides any global NodeSelector settings within the Watcher CR. -| *map[string]string +| metadata +| +| metav1.ObjectMeta | false -| customServiceConfig -| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to /etc/++++++/++++++.conf.d directory as a custom config file.++++++++++++ -| string +| spec +| +| <> | false -| prometheusSecret -| Secret containing prometheus connection parameters -| *string -| true - -| topologyRef -| TopologyRef to apply the Topology defined by the associated CR referenced by name -| *topologyv1.TopoRef +| status +| +| <> | false |=== <> -[#watcherimages] -==== WatcherImages - -|=== -| Field | Description | Scheme | Required - -| apiContainerImageURL -| APIContainerImageURL -| string -| true - -| decisionengineContainerImageURL -| DecisionEngineContainerImageURL -| string -| true - -| applierContainerImageURL -| ApplierContainerImageURL -| string -| true -|=== - -<> - -[#watcherspeccore] -==== WatcherSpecCore +[#bgpconfigurationlist] +==== BGPConfigurationList -WatcherSpecCore defines the fields used from the OpenStackControlPlane CR (does not include images) +BGPConfigurationList contains a list of BGPConfiguration |=== | Field | Description | Scheme | Required -| rabbitMqClusterName -| RabbitMQ instance name Needed to request a transportURL that is created and used in Watcher -| *string -| true - -| secret -| Secret containing all passwords / keys needed -| *string -| true - -| databaseInstance -| MariaDB instance name Required to use the mariadb-operator instance to create the DB and user -| *string -| true - -| databaseAccount -| DatabaseAccount - MariaDBAccount CR name used for watcher DB, defaults to watcher -| *string -| true - -| apiServiceTemplate -| APIServiceTemplate - define the watcher-api service -| <> -| true - -| applierServiceTemplate -| WatcherApplierTemplate - define the watcher-applier service -| <> -| true - -| decisionengineServiceTemplate -| DecisionEngineServiceTemplate - define the watcher-decision-engine service -| <> -| true - -| dbPurge -| DBPurge defines the parameters for the Watcher DB purging cron job -| <> -| true +| metadata +| +| metav1.ListMeta +| false -| apiTimeout -| APITimeout for Route and Apache -| *int +| items +| +| []<> | true - -| notificationsBusInstance -| NotificationsBusInstance is the name of the RabbitMqCluster CR to select the Message Bus Service instance used by the Watcher service to publish and consume notifications from other services. If undefined, the value will be inherited from OpenStackControlPlane. An empty value "" leaves the notification drivers unconfigured and emitting no notifications at all. Avoid colocating it with RabbitMqClusterName or other message bus instances used for RPC. -| *string -| false |=== <> -[#watchersubcrscommon] -==== WatcherSubCrsCommon +[#bgpconfigurationspec] +==== BGPConfigurationSpec -WatcherSubCrsCommon +BGPConfigurationSpec defines the desired state of BGPConfiguration |=== -| Field | Description | Scheme | Required - -| containerImage -| The service specific Container Image URL (will be set to environmental default if empty) -| string -| true - -| resources -| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ -| corev1.ResourceRequirements -| false +| Field | Description | Scheme | Required -| serviceAccount -| ServiceAccount - service account name used internally to provide Watcher services the default SA name +| frrConfigurationNamespace +| FRRConfigurationNamespace - namespace where to create the FRRConfiguration. Defaults to openshift-frr-k8s. | string | true + +| frrNodeConfigurationSelector +| FRRNodeConfigurationSelector - per default the FRRConfiguration per node within the FRRConfigurationNamespace gets queried using the FRRConfiguration.spec.NodeSelector `kubernetes.io/hostname: worker-0`. In case a more specific +| []<> +| false |=== <> -[#watchersubcrstemplate] -==== WatcherSubCrsTemplate +[#bgpconfigurationstatus] +==== BGPConfigurationStatus -WatcherSubCrsTemplate define de common part of the input parameters specified by the user to create a 2nd CR via higher level CRDs. +BGPConfigurationStatus defines the observed state of BGPConfiguration |=== | Field | Description | Scheme | Required -| resources -| Resources - Compute Resources required by this service (Limits/Requests). https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ -| corev1.ResourceRequirements -| false - -| nodeSelector -| NodeSelector to target subset of worker nodes running this component. Setting here overrides any global NodeSelector settings within the Watcher CR. -| *map[string]string -| false - -| customServiceConfig -| CustomServiceConfig - customize the service config using this parameter to change service defaults, or overwrite rendered information using raw OpenStack config format. The content gets added to /etc/++++++/++++++.conf.d directory as a custom config file.++++++++++++ -| string -| false - -| topologyRef -| TopologyRef to apply the Topology defined by the associated CR referenced by name -| *topologyv1.TopoRef +| conditions +| Conditions +| condition.Conditions | false |=== <> -[#apioverridespec-2] -==== APIOverrideSpec +[#frrnodeconfigurationselectortype] +==== FRRNodeConfigurationSelectorType -APIOverrideSpec to override the generated manifest of several child resources. +FRRNodeConfigurationSelectorType - |=== | Field | Description | Scheme | Required -| service -| Override configuration for the Service created to serve traffic to the cluster. The key must be the endpoint type (public, internal) -| map[service.Endpoint]service.RoutedOverrideSpec +| nodeName +| NodeName - name of the node object as seen by running the `oc get nodes` command +| string +| false + +| nodeSelector +| NodeSelector to identify the correct FRRConfiguration from spec.nodeSelector +| metav1.LabelSelector | false |=== <> -[#watcherapi] -==== WatcherAPI +[#dnsdata] +==== DNSData -WatcherAPI is the Schema for the watcherapis API +DNSData is the Schema for the dnsdata API |=== | Field | Description | Scheme | Required @@ -18071,21 +22568,21 @@ WatcherAPI is the Schema for the watcherapis API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#watcherapilist] -==== WatcherAPIList +[#dnsdatalist] +==== DNSDataList -WatcherAPIList contains a list of WatcherAPI +DNSDataList contains a list of DNSData |=== | Field | Description | Scheme | Required @@ -18097,52 +22594,37 @@ WatcherAPIList contains a list of WatcherAPI | items | -| []<> +| []<> | true |=== <> -[#watcherapispec] -==== WatcherAPISpec +[#dnsdataspec] +==== DNSDataSpec -WatcherAPISpec defines the desired state of WatcherAPI +DNSDataSpec defines the desired state of DNSData |=== | Field | Description | Scheme | Required -| secret -| Secret containing all passwords / keys needed -| string -| true - -| replicas -| Replicas of Watcher service to run -| *int32 -| true - -| override -| Override, provides the ability to override the generated manifest of several child resources. -| <> -| false - -| tls -| TLS - Parameters related to the TLS -| tls.API +| hosts +| +| []<> | false -| apiTimeout -| APITimeout for Route and Apache -| int +| dnsDataLabelSelectorValue +| Value of the DNSDataLabelSelector to set on the created configmaps containing hosts information +| string | true |=== <> -[#watcherapistatus] -==== WatcherAPIStatus +[#dnsdatastatus] +==== DNSDataStatus -WatcherAPIStatus defines the observed state of WatcherAPI +DNSDataStatus defines the observed state of DNSData |=== | Field | Description | Scheme | Required @@ -18152,59 +22634,44 @@ WatcherAPIStatus defines the observed state of WatcherAPI | condition.Conditions | false -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) -| int64 -| false - -| readyCount -| ReadyCount of watcher API instances -| int32 -| false - | hash -| Map of hashes to track e.g. job status -| map[string]string +| Map of the dns data configmap +| string | false -| lastAppliedTopology -| LastAppliedTopology - the last applied Topology -| *topologyv1.TopoRef +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) +| int64 | false |=== <> -[#watcherapitemplate] -==== WatcherAPITemplate +[#dnshost] +==== DNSHost -WatcherAPITemplate defines the input parameters specified by the user to create a WatcherAPI via higher level CRDs. +DNSHost holds the mapping between IP and hostnames that will be added to dnsmasq hosts file. |=== | Field | Description | Scheme | Required -| replicas -| Replicas of WatcherAPI service to run -| *int32 +| ip +| IP address of the host file entry. +| string | true -| override -| Override, provides the ability to override the generated manifest of several child resources. -| <> -| false - -| tls -| TLS - Parameters related to the TLS -| tls.API -| false +| hostnames +| Hostnames for the IP address. +| []string +| true |=== <> -[#watcherapplier] -==== WatcherApplier +[#dnsmasq] +==== DNSMasq -WatcherApplier is the Schema for the watcherappliers API +DNSMasq is the Schema for the dnsmasqs API |=== | Field | Description | Scheme | Required @@ -18216,21 +22683,21 @@ WatcherApplier is the Schema for the watcherappliers API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#watcherapplierlist] -==== WatcherApplierList +[#dnsmasqlist] +==== DNSMasqList -WatcherApplierList contains a list of WatcherApplier +DNSMasqList contains a list of DNSMasq |=== | Field | Description | Scheme | Required @@ -18242,42 +22709,110 @@ WatcherApplierList contains a list of WatcherApplier | items | -| []<> +| []<> | true |=== <> -[#watcherapplierspec] -==== WatcherApplierSpec +[#dnsmasqoption] +==== DNSMasqOption -WatcherApplierSpec defines the desired state of WatcherApplier +DNSMasqOption defines allowed options for dnsmasq |=== | Field | Description | Scheme | Required -| secret -| Secret containing all passwords / keys needed +| key +| +| string +| true + +| values +| +| []string +| false +|=== + +<> + +[#dnsmasqoverridespec] +==== DNSMasqOverrideSpec + +DNSMasqOverrideSpec to override the generated manifest of several child resources. + +|=== +| Field | Description | Scheme | Required + +| service +| Override configuration for the Service created to serve traffic to the cluster. +| *service.OverrideSpec +| false +|=== + +<> + +[#dnsmasqspec] +==== DNSMasqSpec + +DNSMasqSpec defines the desired state of DNSMasq + +|=== +| Field | Description | Scheme | Required + +| containerImage +| DNSMasq Container Image URL | string | true +|=== + +<> + +[#dnsmasqspeccore] +==== DNSMasqSpecCore + +DNSMasqSpecCore - this version is used by the OpenStackControlplane CR (no container images) + +|=== +| Field | Description | Scheme | Required | replicas -| Replicas of Watcher service to run +| Replicas - DNSMasq Replicas | *int32 | true -| tls -| TLS - Parameters related to the TLS -| tls.Ca +| options +| Options allows to customize the dnsmasq instance +| []<> +| false + +| nodeSelector +| NodeSelector to target subset of worker nodes running this service. Setting NodeSelector here acts as a default value and can be overridden by service specific NodeSelector Settings. +| *map[string]string +| false + +| dnsDataLabelSelectorValue +| Value of the DNSDataLabelSelectorKey which was set on the configmaps containing hosts information +| string +| true + +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> +| false + +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name +| *topologyv1.TopoRef | false |=== <> -[#watcherapplierstatus] -==== WatcherApplierStatus +[#dnsmasqstatus] +==== DNSMasqStatus -WatcherApplierStatus defines the observed state of WatcherApplier +DNSMasqStatus defines the observed state of DNSMasq |=== | Field | Description | Scheme | Required @@ -18287,19 +22822,29 @@ WatcherApplierStatus defines the observed state of WatcherApplier | condition.Conditions | false -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) -| int64 +| hash +| Map of hashes to track e.g. job status +| map[string]string | false | readyCount -| ReadyCount of watcher Applier instances +| ReadyCount of dnsmasq deployment | int32 | false -| hash -| Map of hashes to track e.g. job status -| map[string]string +| dnsAddresses +| DNSServer Addresses +| []string +| false + +| dnsClusterAddresses +| DNSServer Cluster Addresses +| []string +| false + +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) +| int64 | false | lastAppliedTopology @@ -18310,26 +22855,10 @@ WatcherApplierStatus defines the observed state of WatcherApplier <> -[#watcherappliertemplate] -==== WatcherApplierTemplate - -WatcherApplierTemplatce defines the input parameters specified by the user to create a WatcherApplier via higher level CRDs. - -|=== -| Field | Description | Scheme | Required - -| replicas -| Replicas of WatcherApplier service to run -| *int32 -| true -|=== - -<> - -[#watcherdecisionengine] -==== WatcherDecisionEngine +[#ipset] +==== IPSet -WatcherDecisionEngine is the Schema for the watcherdecisionengines API +IPSet is the Schema for the ipsets API |=== | Field | Description | Scheme | Required @@ -18341,21 +22870,21 @@ WatcherDecisionEngine is the Schema for the watcherdecisionengines API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#watcherdecisionenginelist] -==== WatcherDecisionEngineList +[#ipsetlist] +==== IPSetList -WatcherDecisionEngineList contains a list of WatcherDecisionEngine +IPSetList contains a list of IPSet |=== | Field | Description | Scheme | Required @@ -18367,225 +22896,176 @@ WatcherDecisionEngineList contains a list of WatcherDecisionEngine | items | -| []<> +| []<> | true |=== <> -[#watcherdecisionenginespec] -==== WatcherDecisionEngineSpec +[#ipsetnetwork] +==== IPSetNetwork -WatcherDecisionEngineSpec defines the desired state of WatcherDecisionEngine +IPSetNetwork Type |=== | Field | Description | Scheme | Required -| secret -| Secret containing all passwords / keys needed -| string +| name +| Network Name +| NetNameStr | true -| replicas -| Replicas of Watcher service to run -| *int32 +| subnetName +| Subnet Name +| NetNameStr | true -| tls -| TLS - Parameters related to the TLS -| tls.Ca -| false -|=== - -<> - -[#watcherdecisionenginestatus] -==== WatcherDecisionEngineStatus - -WatcherDecisionEngineStatus defines the observed state of WatcherDecisionEngine - -|=== -| Field | Description | Scheme | Required - -| conditions -| INSERT ADDITIONAL STATUS FIELD - define observed state of cluster Important: Run "make" to regenerate code after modifying this file -| condition.Conditions -| false - -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) -| int64 -| false - -| readyCount -| ReadyCount of WatcherDecisionEngine instances -| int32 -| false - -| hash -| Map of hashes to track e.g. job status -| map[string]string +| fixedIP +| Fixed Ip +| *string | false -| lastAppliedTopology -| LastAppliedTopology - the last applied Topology -| *topologyv1.TopoRef +| defaultRoute +| Use gateway from subnet as default route. There can only be one default route defined per IPSet. +| *bool | false |=== <> -[#watcherdecisionenginetemplate] -==== WatcherDecisionEngineTemplate +[#ipsetreservation] +==== IPSetReservation -WatcherDecisionEngineTemplate defines the input parameters specified by the user to create a WatcherDecisionengine via higher level CRDs. +IPSetReservation defines reservation status per requested network |=== | Field | Description | Scheme | Required -| replicas -| Replicas of WatcherDecisionEngine service to run -| *int32 +| network +| Network name +| NetNameStr | true -|=== - -<> - -[#watcher] -==== Watcher -Watcher is the Schema for the watchers API +| subnet +| Subnet name +| NetNameStr +| true -|=== -| Field | Description | Scheme | Required +| address +| Address contains the IP address +| string +| true -| metadata -| -| metav1.ObjectMeta +| mtu +| MTU of the network +| int | false -| spec -| -| <> +| cidr +| Cidr the cidr to use for this network +| string | false -| status -| -| <> +| vlan +| Vlan ID +| *int | false -|=== - -<> -[#watcherdbpurge] -==== WatcherDBPurge +| gateway +| Gateway optional gateway for the network +| *string +| false -|=== -| Field | Description | Scheme | Required +| routes +| Routes, list of networks that should be routed via network gateway. +| []<> +| false -| schedule -| Schedule defines when to run the Watcher DB Purge job in a cron format. By default it runs everyday at 01:00. -| *string +| dnsDomain +| DNSDomain of the subnet +| string | true -| purgeAge -| PurgeAge defines the minimum age of soft-deleted records in days that can be deleted from the shadow tables -| *int +| serviceNetwork +| ServiceNetwork mapping +| ServiceNetNameStr | true |=== <> -[#watcherlist] -==== WatcherList +[#ipsetspec] +==== IPSetSpec -WatcherList contains a list of Watcher +IPSetSpec defines the desired state of IPSet |=== | Field | Description | Scheme | Required -| metadata -| -| metav1.ListMeta -| false +| immutable +| Immutable, if `true` the validation webhook will block any update to the Spec, except of Spec.Immutable. This allows the caller to add safety mechanism to the object. If a change is required to the object, an extra update needs to be done to make updates possible. +| bool +| true -| items -| -| []<> +| networks +| Networks used to request IPs for +| []<> | true |=== <> -[#watcherstatus] -==== WatcherStatus +[#ipsetstatus] +==== IPSetStatus -WatcherStatus defines the observed state of Watcher +IPSetStatus defines the observed state of IPSet |=== | Field | Description | Scheme | Required +| reservations +| Reservation +| []<> +| false + | conditions | Conditions | condition.Conditions | false -| serviceID -| ServiceID - The ID of the watcher service registered in keystone -| string -| false - -| hash -| Map of hashes to track e.g. job status -| map[string]string -| false - | observedGeneration | ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) | int64 | false - -| apiServiceReadyCount -| APIServiceReadyCount defines the number or replicas ready from watcher-api -| int32 -| false - -| applierServiceReadyCount -| ApplierServiceReadyCount defines the number or replicas ready from watcher-applier -| int32 -| false - -| decisionengineServiceReadyCount -| DecisionEngineServiceReadyCount defines the number or replicas ready from watcher-decision-engine -| int32 -| false |=== <> -[#mtlssection] -==== MTLSSection +[#allocationrange] +==== AllocationRange + +AllocationRange definition |=== | Field | Description | Scheme | Required -| sslVerifyMode -| Used to enforce client side tls cert validation +| start +| Start IP for the AllocationRange | string -| false +| true -| authCertSecret -| Name of the secret containing the client cert used to perform mtls auth -| tls.GenericService -| false +| end +| End IP for the AllocationRange +| string +| true |=== <> -[#memcached] -==== Memcached +[#netconfig] +==== NetConfig -Memcached is the Schema for the memcacheds API +NetConfig is the Schema for the netconfigs API |=== | Field | Description | Scheme | Required @@ -18597,21 +23077,21 @@ Memcached is the Schema for the memcacheds API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#memcachedlist] -==== MemcachedList +[#netconfiglist] +==== NetConfigList -MemcachedList contains a list of Memcached +NetConfigList contains a list of NetConfig |=== | Field | Description | Scheme | Required @@ -18623,150 +23103,166 @@ MemcachedList contains a list of Memcached | items | -| []<> +| []<> | true |=== <> -[#memcachedspec] -==== MemcachedSpec +[#netconfigspec] +==== NetConfigSpec -MemcachedSpec defines the desired state of Memcached +NetConfigSpec defines the desired state of NetConfig |=== | Field | Description | Scheme | Required -| containerImage -| Name of the memcached container image to run (will be set to environmental default if empty) -| string +| networks +| Networks, list of all networks of the deployment +| []<> | true |=== <> -[#memcachedspeccore] -==== MemcachedSpecCore +[#network] +==== Network -MemcachedSpecCore - this version is used by the OpenStackControlplane CR (no container images) +Network definition |=== | Field | Description | Scheme | Required -| replicas -| Size of the memcached cluster -| *int32 +| name +| Name of the network, e.g. External, InternalApi, ... +| NetNameStr | true -| nodeSelector -| NodeSelector to target subset of worker nodes running this service -| *map[string]string -| false - -| tls -| TLS settings for memcached service -| <> -| false - -| cacheSize -| Maximum Memcached cache size in MB -| int32 +| dnsDomain +| DNSDomain name of the Network +| string | true -| maxConn -| Maximum number of connections accepted by Memcached -| int32 +| mtu +| MTU of the network +| int | true -| topologyRef -| TopologyRef to apply the Topology defined by the associated CR referenced by name -| *topologyv1.TopoRef -| false +| subnets +| Subnets of the network +| []<> +| true -| resources -| Resources QoS configuration for pods -| corev1.ResourceRequirements +| serviceNetwork +| Service network mapping +| ServiceNetNameStr | false |=== <> -[#memcachedstatus] -==== MemcachedStatus +[#route] +==== Route -MemcachedStatus defines the observed state of Memcached +Route definition |=== | Field | Description | Scheme | Required -| hash -| Map of hashes to track input changes -| map[string]string -| false +| destination +| Destination, network CIDR +| string +| true -| readyCount -| ReadyCount of Memcached instances -| int32 -| false +| nexthop +| Nexthop, gateway for the destination +| string +| true +|=== -| conditions -| Conditions -| condition.Conditions -| false +<> -| serverList -| ServerList - List of memcached endpoints without inet(6) prefix -| []string -| false +[#subnet] +==== Subnet -| serverListWithInet -| ServerListWithInet - List of memcached endpoints with inet(6) prefix -| []string +Subnet definition + +|=== +| Field | Description | Scheme | Required + +| name +| Name of the subnet +| NetNameStr +| true + +| cidr +| Cidr the cidr to use for this network +| string +| true + +| dnsDomain +| DNSDomain name of the subnet, allows to overwrite the DNSDomain of the Network +| *string | false -| tlsSupport -| Whether TLS is supported by the memcached instance -| bool +| vlan +| Vlan ID +| *int | false -| mtlsCert -| Name of the certificate used for MTLS -| string +| allocationRanges +| AllocationRanges a list of AllocationRange for assignment. Allocation will start from first range, first address. +| []<> +| true + +| excludeAddresses +| ExcludeAddresses a set of IPs that should be excluded from used as reservation, for both dynamic and static via IPSet FixedIP parameter +| []string | false -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) -| int64 +| gateway +| Gateway optional gateway for the network +| *string | false -| lastAppliedTopology -| LastAppliedTopology - the last applied Topology -| *topologyv1.TopoRef +| routes +| Routes, list of networks that should be routed via network gateway. +| []<> | false |=== <> -[#tlssection-2] -==== TLSSection +[#ipaddress] +==== IPAddress -TLSSection +IPAddress - |=== | Field | Description | Scheme | Required -| mtls -| -| <> -| false +| network +| Network name +| NetNameStr +| true + +| subnet +| Subnet name +| NetNameStr +| true + +| address +| Address contains the IP address +| string +| true |=== <> -[#bgpconfiguration] -==== BGPConfiguration +[#reservation] +==== Reservation -BGPConfiguration is the Schema for the bgpconfigurations API +Reservation is the Schema for the reservations API |=== | Field | Description | Scheme | Required @@ -18778,21 +23274,21 @@ BGPConfiguration is the Schema for the bgpconfigurations API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#bgpconfigurationlist] -==== BGPConfigurationList +[#reservationlist] +==== ReservationList -BGPConfigurationList contains a list of BGPConfiguration +ReservationList contains a list of Reservation |=== | Field | Description | Scheme | Required @@ -18804,376 +23300,368 @@ BGPConfigurationList contains a list of BGPConfiguration | items | -| []<> +| []<> | true |=== <> -[#bgpconfigurationspec] -==== BGPConfigurationSpec +[#reservationspec] +==== ReservationSpec -BGPConfigurationSpec defines the desired state of BGPConfiguration +ReservationSpec defines the desired state of Reservation |=== | Field | Description | Scheme | Required -| frrConfigurationNamespace -| FRRConfigurationNamespace - namespace where to create the FRRConfiguration. Defaults to metallb-system. -| string +| ipSetRef +| IPSetRef points to the IPSet object the IPs were created for. +| corev1.ObjectReference | true -| frrNodeConfigurationSelector -| FRRNodeConfigurationSelector - per default the FRRConfiguration per node within the FRRConfigurationNamespace gets queried using the FRRConfiguration.spec.NodeSelector `kubernetes.io/hostname: worker-0`. In case a more specific -| []<> -| false -|=== - -<> - -[#bgpconfigurationstatus] -==== BGPConfigurationStatus - -BGPConfigurationStatus defines the observed state of BGPConfiguration - -|=== -| Field | Description | Scheme | Required - -| conditions -| Conditions -| condition.Conditions -| false +| reservation +| Reservation, map (index network name) with reservation +| map[string]<> +| true |=== <> -[#frrnodeconfigurationselectortype] -==== FRRNodeConfigurationSelectorType +[#deprecatedembeddedlabelsannotations] +==== DeprecatedEmbeddedLabelsAnnotations -FRRNodeConfigurationSelectorType - +DeprecatedEmbeddedLabelsAnnotations is an embedded subset of the fields included in k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta. Only labels and annotations are included. |=== | Field | Description | Scheme | Required -| nodeName -| NodeName - name of the node object as seen by running the `oc get nodes` command -| string +| labels +| Map of string keys and values that can be used to organize and categorize (scope and select) objects. +| map[string]string | false -| nodeSelector -| NodeSelector to identify the correct FRRConfiguration from spec.nodeSelector -| metav1.LabelSelector +| annotations +| Annotations is an unstructured key value map stored with a resource. +| map[string]string | false |=== <> -[#dnsdata] -==== DNSData +[#deprecatedembeddedobjectmeta] +==== DeprecatedEmbeddedObjectMeta -DNSData is the Schema for the dnsdata API +DeprecatedEmbeddedObjectMeta mirrors the old rabbitmq-cluster-operator EmbeddedObjectMeta type. |=== | Field | Description | Scheme | Required -| metadata +| name | -| metav1.ObjectMeta +| string | false -| spec +| namespace | -| <> +| string | false -| status +| labels | -| <> +| map[string]string +| false + +| annotations +| +| map[string]string | false |=== <> -[#dnsdatalist] -==== DNSDataList +[#deprecatedpersistencespec] +==== DeprecatedPersistenceSpec -DNSDataList contains a list of DNSData +DeprecatedPersistenceSpec mirrors the old rabbitmq-cluster-operator RabbitmqClusterPersistenceSpec type. |=== | Field | Description | Scheme | Required -| metadata -| -| metav1.ListMeta +| storageClassName +| The name of the StorageClass to claim a PersistentVolume from. +| *string | false -| items -| -| []<> -| true +| storage +| The requested size of the persistent volume attached to each Pod in the RabbitmqCluster. The format of this field matches that defined by kubernetes/apimachinery. See https://pkg.go.dev/k8s.io/apimachinery/pkg/api/resource#Quantity for more info on the format of this field. +| *resource.Quantity +| false |=== <> -[#dnsdataspec] -==== DNSDataSpec +[#deprecatedpodtemplatespec] +==== DeprecatedPodTemplateSpec -DNSDataSpec defines the desired state of DNSData +DeprecatedPodTemplateSpec mirrors the old rabbitmq-cluster-operator PodTemplateSpec type. |=== | Field | Description | Scheme | Required -| hosts +| metadata | -| []<> +| *<> | false -| dnsDataLabelSelectorValue -| Value of the DNSDataLabelSelector to set on the created configmaps containing hosts information -| string -| true +| spec +| +| *corev1.PodSpec +| false |=== <> -[#dnsdatastatus] -==== DNSDataStatus +[#deprecatedrabbitmqservicespec] +==== DeprecatedRabbitMQServiceSpec -DNSDataStatus defines the observed state of DNSData +DeprecatedRabbitMQServiceSpec mirrors the old top-level service configuration. DEPRECATED: Use Override.Service instead. |=== | Field | Description | Scheme | Required -| conditions -| Conditions -| condition.Conditions +| type +| Type of Service to create for the cluster. Must be one of: ClusterIP, LoadBalancer, NodePort. For more info see https://pkg.go.dev/k8s.io/api/core/v1#ServiceType +| corev1.ServiceType | false -| hash -| Map of the dns data configmap -| string +| annotations +| Annotations to add to the Service. +| map[string]string | false -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) -| int64 +| labels +| +| map[string]string +| false + +| ipFamilyPolicy +| IPFamilyPolicy represents the dual-stack-ness requested or required by a Service See also: https://pkg.go.dev/k8s.io/api/core/v1#IPFamilyPolicy +| *corev1.IPFamilyPolicy | false |=== <> -[#dnshost] -==== DNSHost +[#deprecatedrabbitmqconfigspec] +==== DeprecatedRabbitmqConfigSpec -DNSHost holds the mapping between IP and hostnames that will be added to dnsmasq hosts file. +DeprecatedRabbitmqConfigSpec mirrors the old rabbitmq-cluster-operator RabbitmqClusterConfigurationSpec type. |=== | Field | Description | Scheme | Required -| ip -| IP address of the host file entry. +| additionalPlugins +| List of plugins to enable in addition to essential plugins: rabbitmq_management, rabbitmq_prometheus, and rabbitmq_peer_discovery_k8s. +| []RabbitMQPlugin +| false + +| additionalConfig +| Modify to add to the rabbitmq.conf file in addition to default configurations set by the operator. Modifying this property on an existing RabbitmqCluster will trigger a StatefulSet rolling restart and will cause rabbitmq downtime. For more information on this config, see https://www.rabbitmq.com/configure.html#config-file | string -| true +| false -| hostnames -| Hostnames for the IP address. -| []string -| true +| advancedConfig +| Specify any rabbitmq advanced.config configurations to apply to the cluster. For more information on advanced config, see https://www.rabbitmq.com/configure.html#advanced-config-file +| string +| false + +| envConfig +| Modify to add to the rabbitmq-env.conf file. Modifying this property on an existing RabbitmqCluster will trigger a StatefulSet rolling restart and will cause rabbitmq downtime. For more information on env config, see https://www.rabbitmq.com/man/rabbitmq-env.conf.5.html +| string +| false + +| erlangInetConfig +| Erlang Inet configuration to apply to the Erlang VM running rabbit. See also: https://www.erlang.org/doc/apps/erts/inet_cfg.html +| string +| false |=== <> -[#dnsmasq] -==== DNSMasq +[#deprecatedsecretbackendspec] +==== DeprecatedSecretBackendSpec -DNSMasq is the Schema for the dnsmasqs API +DeprecatedSecretBackendSpec mirrors the old rabbitmq-cluster-operator SecretBackend type. |=== | Field | Description | Scheme | Required -| metadata -| -| metav1.ObjectMeta -| false - -| spec +| externalSecret | -| <> +| *corev1.LocalObjectReference | false -| status +| vault | -| <> +| *<> | false |=== <> -[#dnsmasqlist] -==== DNSMasqList +[#deprecatedstatefulsetoverride] +==== DeprecatedStatefulSetOverride -DNSMasqList contains a list of DNSMasq +DeprecatedStatefulSetOverride mirrors the old rabbitmq-cluster-operator StatefulSet type. Used for webhook validation of the override.statefulSet JSON field. |=== | Field | Description | Scheme | Required | metadata | -| metav1.ListMeta +| *<> | false -| items +| spec | -| []<> -| true +| *<> +| false |=== <> -[#dnsmasqoption] -==== DNSMasqOption +[#deprecatedstatefulsetspec] +==== DeprecatedStatefulSetSpec -DNSMasqOption defines allowed options for dnsmasq +DeprecatedStatefulSetSpec mirrors a subset of the old rabbitmq-cluster-operator StatefulSetSpec type. |=== | Field | Description | Scheme | Required -| key +| replicas | -| string -| true +| *int32 +| false -| values +| selector | -| []string -| true -|=== - -<> - -[#dnsmasqoverridespec] -==== DNSMasqOverrideSpec - -DNSMasqOverrideSpec to override the generated manifest of several child resources. +| *metav1.LabelSelector +| false -|=== -| Field | Description | Scheme | Required +| template +| +| *<> +| false -| service -| Override configuration for the Service created to serve traffic to the cluster. -| *service.OverrideSpec +| volumeClaimTemplates +| +| []corev1.PersistentVolumeClaim | false -|=== -<> +| serviceName +| +| string +| false -[#dnsmasqspec] -==== DNSMasqSpec +| podManagementPolicy +| +| appsv1.PodManagementPolicyType +| false -DNSMasqSpec defines the desired state of DNSMasq +| updateStrategy +| +| *appsv1.StatefulSetUpdateStrategy +| false -|=== -| Field | Description | Scheme | Required +| minReadySeconds +| +| int32 +| false -| containerImage -| DNSMasq Container Image URL -| string -| true +| persistentVolumeClaimRetentionPolicy +| +| *appsv1.StatefulSetPersistentVolumeClaimRetentionPolicy +| false |=== <> -[#dnsmasqspeccore] -==== DNSMasqSpecCore +[#deprecatedvaultspec] +==== DeprecatedVaultSpec -DNSMasqSpecCore - this version is used by the OpenStackControlplane CR (no container images) +DeprecatedVaultSpec mirrors the old rabbitmq-cluster-operator VaultSpec type. VaultSpec will add Vault annotations (see https://www.vaultproject.io/docs/platform/k8s/injector/annotations) to RabbitMQ Pods. It requires a Vault Agent Sidecar Injector (https://www.vaultproject.io/docs/platform/k8s/injector) to be installed in the K8s cluster. |=== | Field | Description | Scheme | Required -| replicas -| Replicas - DNSMasq Replicas -| *int32 -| true - -| options -| Options allows to customize the dnsmasq instance -| []<> +| role +| Role in Vault. If vault.defaultUserPath is set, this role must have capability to read the pre-created default user credential in Vault. If vault.tls is set, this role must have capability to create and update certificates in the Vault PKI engine for the domains "++++++\" and \"++++++.svc\".++++++++++++ +| string | false -| nodeSelector -| NodeSelector to target subset of worker nodes running this service. Setting NodeSelector here acts as a default value and can be overridden by service specific NodeSelector Settings. -| *map[string]string +| annotations +| Vault annotations that override the Vault annotations set by the cluster-operator. For a list of valid Vault annotations, see https://www.vaultproject.io/docs/platform/k8s/injector/annotations +| map[string]string | false -| dnsDataLabelSelectorValue -| Value of the DNSDataLabelSelectorKey which was set on the configmaps containing hosts information +| defaultUserPath +| Path in Vault to access a KV (Key-Value) secret with the fields username and password for the default user. For example "secret/data/rabbitmq/config". | string -| true +| false -| override -| Override, provides the ability to override the generated manifest of several child resources. -| <> +| defaultUserUpdaterImage +| Sidecar container that updates the default user's password in RabbitMQ when it changes in Vault. Additionally, it updates /var/lib/rabbitmq/.rabbitmqadmin.conf (used by rabbitmqadmin CLI). Set to empty string to disable the sidecar container. +| string | false -| topologyRef -| TopologyRef to apply the Topology defined by the associated CR referenced by name -| *topologyv1.TopoRef +| tls +| +| *<> | false |=== <> -[#dnsmasqstatus] -==== DNSMasqStatus +[#deprecatedvaulttlsspec] +==== DeprecatedVaultTLSSpec -DNSMasqStatus defines the observed state of DNSMasq +DeprecatedVaultTLSSpec mirrors the old rabbitmq-cluster-operator VaultSpec TLS fields. |=== | Field | Description | Scheme | Required -| conditions -| Conditions -| condition.Conditions -| false - -| hash -| Map of hashes to track e.g. job status -| map[string]string -| false - -| readyCount -| ReadyCount of dnsmasq deployment -| int32 +| pkiIssuerPath +| Path in Vault PKI engine. For example "pki/issue/hashicorp-com". Required. +| string | false -| dnsAddresses -| DNSServer Addresses -| []string +| pkiRootPath +| Specifies an optional path to retrieve the root CA from vault. Useful if certificates are issued by an intermediate CA. +| string | false -| dnsClusterAddresses -| DNSServer Cluster Addresses -| []string +| altNames +| Specifies the requested Subject Alternative Names (SANs), in a comma-delimited list. These will be appended to the SANs added by the cluster-operator. +| string | false -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) -| int64 +| commonName +| Specifies the requested certificate Common Name (CN). Defaults to ++++++.++++++.svc if not provided.++++++++++++ +| string | false -| lastAppliedTopology -| LastAppliedTopology - the last applied Topology -| *topologyv1.TopoRef +| ipSans +| Specifies the requested IP Subject Alternative Names, in a comma-delimited list. +| string | false |=== <> -[#ipset] -==== IPSet +[#rabbitmqpolicy] +==== RabbitMQPolicy -IPSet is the Schema for the ipsets API +RabbitMQPolicy is the Schema for the rabbitmqpolicies API |=== | Field | Description | Scheme | Required @@ -19185,21 +23673,21 @@ IPSet is the Schema for the ipsets API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#ipsetlist] -==== IPSetList +[#rabbitmqpolicylist] +==== RabbitMQPolicyList -IPSetList contains a list of IPSet +RabbitMQPolicyList contains a list of RabbitMQPolicy |=== | Field | Description | Scheme | Required @@ -19211,176 +23699,177 @@ IPSetList contains a list of IPSet | items | -| []<> +| []<> | true |=== <> -[#ipsetnetwork] -==== IPSetNetwork +[#rabbitmqpolicyspec] +==== RabbitMQPolicySpec -IPSetNetwork Type +RabbitMQPolicySpec defines the desired state of RabbitMQPolicy |=== | Field | Description | Scheme | Required +| rabbitmqClusterName +| RabbitmqClusterName - the name of the RabbitMQ cluster +| string +| true + +| vhostRef +| VhostRef - reference to the RabbitMQVhost resource (if empty, uses default vhost "/") +| string +| false + | name -| Network Name -| NetNameStr +| Name - the policy name in RabbitMQ (defaults to CR name) +| string +| false + +| pattern +| Pattern - regex pattern to match queue/exchange names +| string | true -| subnetName -| Subnet Name -| NetNameStr +| definition +| Definition - policy definition as key-value pairs +| apiextensionsv1.JSON | true -| fixedIP -| Fixed Ip -| *string -| false +| priority +| Priority - policy priority (higher value = higher priority) +| int +| true -| defaultRoute -| Use gateway from subnet as default route. There can only be one default route defined per IPSet. -| *bool -| false +| applyTo +| ApplyTo - what to apply the policy to +| string +| true |=== <> -[#ipsetreservation] -==== IPSetReservation +[#rabbitmqpolicystatus] +==== RabbitMQPolicyStatus -IPSetReservation defines reservation status per requested network +RabbitMQPolicyStatus defines the observed state of RabbitMQPolicy |=== | Field | Description | Scheme | Required -| network -| Network name -| NetNameStr -| true +| conditions +| Conditions +| condition.Conditions +| false -| subnet -| Subnet name -| NetNameStr -| true +| observedGeneration +| ObservedGeneration - the most recent generation observed for this resource +| int64 +| false -| address -| Address contains the IP address +| vhost +| Vhost - actual vhost name where the policy was last applied | string -| true - -| mtu -| MTU of the network -| int | false -| cidr -| Cidr the cidr to use for this network +| policyName +| PolicyName - actual policy name used in RabbitMQ | string | false +|=== -| vlan -| Vlan ID -| *int -| false +<> -| gateway -| Gateway optional gateway for the network -| *string -| false +[#podoverride] +==== PodOverride -| routes -| Routes, list of networks that should be routed via network gateway. -| []<> -| false +PodOverride defines per-pod service configurations -| dnsDomain -| DNSDomain of the subnet -| string -| true +|=== +| Field | Description | Scheme | Required -| serviceNetwork -| ServiceNetwork mapping -| ServiceNetNameStr -| true +| services +| Services - list of per-pod service overrides +| []service.OverrideSpec +| false |=== <> -[#ipsetspec] -==== IPSetSpec +[#rabbitmqoverridespec] +==== RabbitMQOverrideSpec -IPSetSpec defines the desired state of IPSet +RabbitMQOverrideSpec to override the generated manifest of several child resources. |=== | Field | Description | Scheme | Required -| immutable -| Immutable, if `true` the validation webhook will block any update to the Spec, except of Spec.Immutable. This allows the caller to add safety mechanism to the object. If a change is required to the object, an extra update needs to be done to make updates possible. -| bool -| true +| service +| Override configuration for the Service created to serve traffic to the cluster. +| *<> +| false -| networks -| Networks used to request IPs for -| []<> -| true +| statefulSet +| DEPRECATED: For backward compatibility with old RabbitmqClusterSpecCore format. Override configuration for the RabbitMQ StatefulSet. This will be removed in a future release. +| *runtime.RawExtension +| false |=== <> -[#ipsetstatus] -==== IPSetStatus +[#rabbitmqserviceoverride] +==== RabbitMQServiceOverride -IPSetStatus defines the observed state of IPSet +RabbitMQServiceOverride defines service override configuration for RabbitMQ. Uses lib-common's EmbeddedLabelsAnnotations for metadata (consistent with other operators) and full corev1.ServiceSpec for backward compatibility with the old rabbitmq-cluster-operator CRD. |=== | Field | Description | Scheme | Required -| reservations -| Reservation -| []<> -| false - -| conditions -| Conditions -| condition.Conditions +| metadata +| +| *service.EmbeddedLabelsAnnotations | false -| observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) -| int64 +| spec +| +| *corev1.ServiceSpec | false |=== <> -[#allocationrange] -==== AllocationRange +[#rabbitmqtlsspec] +==== RabbitMQTLSSpec -AllocationRange definition +RabbitMQTLSSpec defines TLS configuration for RabbitMQ |=== | Field | Description | Scheme | Required -| start -| Start IP for the AllocationRange +| secretName +| SecretName is the name of a Secret in the same Namespace as the RabbitmqCluster, containing the server's private key & public certificate for TLS. The Secret must store these as tls.key and tls.crt, respectively. This Secret can be created by running `kubectl create secret tls tls-secret --cert=path/to/tls.crt --key=path/to/tls.key` | string -| true +| false -| end -| End IP for the AllocationRange +| caSecretName +| CaSecretName is the name of a Secret in the same Namespace as the RabbitmqCluster, containing the Certificate Authority's public certificate for TLS. The Secret must store this as ca.crt. This Secret can be created by running `kubectl create secret generic ca-secret --from-file=ca.crt=path/to/ca.crt` Used for mTLS, and TLS for rabbitmq_web_stomp and rabbitmq_web_mqtt. | string +| false + +| disableNonTLSListeners +| DisableNonTLSListeners - when set to true, disables non-TLS listeners for RabbitMQ, management plugin and for any enabled plugins in the following list: stomp, mqtt, web_stomp, web_mqtt. Only TLS-enabled clients will be able to connect. +| bool | true |=== <> -[#netconfig] -==== NetConfig +[#rabbitmq] +==== RabbitMq -NetConfig is the Schema for the netconfigs API +RabbitMq is the Schema for the rabbitmqs API |=== | Field | Description | Scheme | Required @@ -19392,21 +23881,21 @@ NetConfig is the Schema for the netconfigs API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#netconfiglist] -==== NetConfigList +[#rabbitmqlist] +==== RabbitMqList -NetConfigList contains a list of NetConfig +RabbitMqList contains a list of RabbitMq |=== | Field | Description | Scheme | Required @@ -19418,166 +23907,298 @@ NetConfigList contains a list of NetConfig | items | -| []<> +| []<> | true |=== <> -[#netconfigspec] -==== NetConfigSpec +[#rabbitmqspec] +==== RabbitMqSpec -NetConfigSpec defines the desired state of NetConfig +RabbitMqSpec defines the desired state of RabbitMq |=== | Field | Description | Scheme | Required -| networks -| Networks, list of all networks of the deployment -| []<> +| containerImage +| Name of the rabbitmq container image to run (will be set to environmental default if empty) +| string | true |=== <> -[#network] -==== Network +[#rabbitmqspeccore] +==== RabbitMqSpecCore -Network definition +RabbitMqSpecCore - this version is used by the OpenStackControlplane CR (no container images) + +|=== +| Field | Description | Scheme | Required + +| replicas +| Replicas is the number of nodes in the RabbitMQ cluster. Each node is deployed as a Replica in a StatefulSet. Only 1, 3, 5 replicas clusters are tested. This value should be an odd number to ensure the resultant cluster can establish exactly one quorum of nodes in the event of a fragmenting network partition. +| *int32 +| true + +| resources +| Resources - Resource requirements for RabbitMQ containers +| *corev1.ResourceRequirements +| true + +| tls +| TLS-related configuration for the RabbitMQ cluster. +| <> +| false + +| override +| Override, provides the ability to override the generated manifest of several child resources. +| <> +| false + +| affinity +| Affinity scheduling rules to be applied on created Pods. +| *corev1.Affinity +| false + +| tolerations +| Tolerations is the list of Toleration resources attached to each Pod in the RabbitmqCluster. +| []corev1.Toleration +| false + +| nodeSelector +| NodeSelector to target subset of worker nodes running this service +| *map[string]string +| false + +| topologyRef +| TopologyRef to apply the Topology defined by the associated CR referenced by name +| *topologyv1.TopoRef +| false + +| queueType +| QueueType - the default queue type for the cluster. Allowed values: Mirrored, Quorum. New clusters default to Quorum. Existing clusters without a value default to Mirrored. +| *QueueType +| false + +| podOverride +| PodOverride - Override configuration for per-pod services. When specified, individual LoadBalancer services will be created for each pod with the provided configuration, and the transport URL will be configured to use these per-pod services. +| *<> +| false + +| terminationGracePeriodSeconds +| TerminationGracePeriodSeconds is the timeout for graceful pod termination. NOTE: The default was changed from 604800 (1 week, inherited from rabbitmq-cluster-operator) to 60 since this controller manages RabbitMQ directly and does not rely on the same graceful shutdown mechanism. +| *int64 +| true + +| skipPostDeploySteps +| SkipPostDeploySteps - if set to true, the cluster will not run `rabbitmq-queues rebalance all` after a cluster update. Has no effect if the cluster only consists of one node. For more information, see https://www.rabbitmq.com/rabbitmq-queues.8.html#rebalance +| bool +| true + +| delayStartSeconds +| DelayStartSeconds is the time the init container (`setup-container`) will sleep before terminating. This effectively delays the time between starting the Pod and starting the `rabbitmq` container. RabbitMQ relies on up-to-date DNS entries early during peer discovery. The purpose of this artificial delay is to ensure that DNS entries are up-to-date when booting RabbitMQ. For more information, see https://github.com/kubernetes/kubernetes/issues/92559 If your Kubernetes DNS backend is configured with a low DNS cache value or publishes not ready addresses promptly, you can decrease this value or set it to 0. +| *int32 +| true + +| targetVersion +| TargetVersion - the desired RabbitMQ version (e.g., "4.2", "3.13.1"). When set to a version different from Status.CurrentVersion, the controller will initiate a storage wipe and version upgrade. The controller updates Status.CurrentVersion once the upgrade completes. +| *string +| false + +| service +| DEPRECATED: For backward compatibility with old format. Use Override.Service instead. Settable attributes for the Service resource. +| *<> +| false + +| persistence +| The desired persistent storage configuration for each Pod in the cluster. +| <> +| false + +| rabbitmq +| Configuration options for RabbitMQ Pods created in the cluster. +| <> +| false + +| secretBackend +| DEPRECATED: For backward compatibility with old rabbitmq-cluster-operator format. This field is no longer used and will be removed in a future release. SecretBackend was used to configure fetching default user credentials and certificates from K8s external secret stores. +| *<> +| false +|=== + +<> + +[#rabbitmqstatus] +==== RabbitMqStatus + +RabbitMqStatus defines the observed state of RabbitMq |=== | Field | Description | Scheme | Required -| name -| Name of the network, e.g. External, InternalApi, ... -| NetNameStr -| true +| conditions +| Conditions +| condition.Conditions +| false + +| observedGeneration +| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the openstack-operator in the top-level CR (e.g. the ContainerImage) +| int64 +| false + +| lastAppliedTopology +| LastAppliedTopology - the last applied Topology +| *topologyv1.TopoRef +| false + +| queueType +| QueueType - the active queue type for this cluster +| QueueType +| false + +| readyCount +| ReadyCount tracks ready replicas +| int32 +| false + +| defaultUser +| DefaultUser - Identifying information on default user secret +| *<> +| false + +| serviceHostnames +| ServiceHostnames - list of per-pod service hostnames for RabbitMQ cluster. When populated, transport URLs use these hostnames instead of pod names. +| []string +| false + +| oldCRCleaned +| OldCRCleaned - set to "True" when the old rabbitmq.com RabbitmqCluster CR has been cleaned up during migration from rabbitmq-cluster-operator. +| string +| false + +| vctCleaned +| VCTCleaned - set to "True" when stale ownerReferences in the StatefulSet's volumeClaimTemplates have been cleaned up during migration. +| string +| false -| dnsDomain -| DNSDomain name of the Network +| currentVersion +| CurrentVersion - the currently deployed RabbitMQ version (e.g., "3.9", "4.2") This is controller-managed and reflects the actual running version. Set Spec.TargetVersion to request a version change. | string -| true +| false -| mtu -| MTU of the network -| int -| true +| upgradePhase +| UpgradePhase - tracks the current phase of a version upgrade or migration. This allows resuming upgrades that failed midway. +| UpgradePhase +| false -| subnets -| Subnets of the network -| []<> -| true +| wipeReason +| WipeReason - tracks why the current storage wipe was initiated. Persisted so that resumed upgrades use the correct handling path. +| WipeReason +| false -| serviceNetwork -| Service network mapping -| ServiceNetNameStr +| proxyRequired +| ProxyRequired - set to "True" when the AMQP proxy sidecar is required for this cluster. Set when upgrading from RabbitMQ 3.x to 4.x with Quorum queues. The proxy allows non-durable clients to work with quorum queues during the upgrade window. Only cleared when the AnnotationClientsReconfigured annotation is set to "true". +| string | false |=== <> -[#route] -==== Route +[#rabbitmqclusterdefaultuser] +==== RabbitmqClusterDefaultUser -Route definition +RabbitmqClusterDefaultUser contains default user information |=== | Field | Description | Scheme | Required -| destination -| Destination, network CIDR -| string -| true +| secretReference +| SecretReference - reference to the secret containing credentials +| *<> +| false -| nexthop -| Nexthop, gateway for the destination -| string -| true +| serviceReference +| ServiceReference - reference to the service +| *<> +| false |=== <> -[#subnet] -==== Subnet +[#rabbitmqclustersecretreference] +==== RabbitmqClusterSecretReference -Subnet definition +RabbitmqClusterSecretReference contains reference to a secret |=== | Field | Description | Scheme | Required | name -| Name of the subnet -| NetNameStr -| true - -| cidr -| Cidr the cidr to use for this network +| Name of the secret | string -| true +| false -| dnsDomain -| DNSDomain name of the subnet, allows to overwrite the DNSDomain of the Network -| *string +| namespace +| Namespace of the secret +| string | false -| vlan -| Vlan ID -| *int +| keys +| Keys in the secret +| map[string]string | false +|=== -| allocationRanges -| AllocationRanges a list of AllocationRange for assignment. Allocation will start from first range, first address. -| []<> -| true +<> -| excludeAddresses -| ExcludeAddresses a set of IPs that should be excluded from used as reservation, for both dynamic and static via IPSet FixedIP parameter -| []string -| false +[#rabbitmqclusterservicereference] +==== RabbitmqClusterServiceReference -| gateway -| Gateway optional gateway for the network -| *string +RabbitmqClusterServiceReference contains reference to a service + +|=== +| Field | Description | Scheme | Required + +| name +| Name of the service +| string | false -| routes -| Routes, list of networks that should be routed via network gateway. -| []<> +| namespace +| Namespace of the service +| string | false |=== <> -[#ipaddress] -==== IPAddress +[#credentialselectors] +==== CredentialSelectors -IPAddress - +CredentialSelectors defines selectors for username and password in a secret |=== | Field | Description | Scheme | Required -| network -| Network name -| NetNameStr -| true - -| subnet -| Subnet name -| NetNameStr +| username +| Username - key name for username in the secret (default "username") +| string | true -| address -| Address contains the IP address +| password +| Password - key name for password in the secret (default "password") | string | true |=== <> -[#reservation] -==== Reservation +[#rabbitmquser] +==== RabbitMQUser -Reservation is the Schema for the reservations API +RabbitMQUser is the Schema for the rabbitmqusers API |=== | Field | Description | Scheme | Required @@ -19589,21 +24210,21 @@ Reservation is the Schema for the reservations API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#reservationlist] -==== ReservationList +[#rabbitmquserlist] +==== RabbitMQUserList -ReservationList contains a list of Reservation +RabbitMQUserList contains a list of RabbitMQUser |=== | Field | Description | Scheme | Required @@ -19615,37 +24236,129 @@ ReservationList contains a list of Reservation | items | -| []<> +| []<> | true |=== <> -[#reservationspec] -==== ReservationSpec +[#rabbitmquserpermissions] +==== RabbitMQUserPermissions -ReservationSpec defines the desired state of Reservation +RabbitMQUserPermissions defines permissions for a user on a vhost. Design note: this implementation uses a default of ".*" (allow all). To explicitly deny permissions, set the field to an empty string "". The Permissions struct itself is always present (not omitempty) so it will never be nil. |=== | Field | Description | Scheme | Required -| ipSetRef -| IPSetRef points to the IPSet object the IPs were created for. -| corev1.ObjectReference +| configure +| Configure - configure permission regex (default ".*" allows all, "" denies all) +| string | true -| reservation -| Reservation, map (index network name) with reservation -| map[string]<> +| write +| Write - write permission regex (default ".*" allows all, "" denies all) +| string +| true + +| read +| Read - read permission regex (default ".*" allows all, "" denies all) +| string | true |=== <> -[#rabbitmq] -==== RabbitMq +[#rabbitmquserspec] +==== RabbitMQUserSpec -RabbitMq is the Schema for the rabbitmqs API +RabbitMQUserSpec defines the desired state of RabbitMQUser + +|=== +| Field | Description | Scheme | Required + +| rabbitmqClusterName +| RabbitmqClusterName - the name of the RabbitMQ cluster +| string +| true + +| vhostRef +| VhostRef - reference to the RabbitMQVhost resource (defaults to default vhost "/" if empty) +| string +| false + +| username +| Username - the username in RabbitMQ (defaults to CR name) +| string +| false + +| secret +| Secret - name of secret containing user credentials (username and password) If specified, credentials will be read from this secret instead of being auto-generated +| *string +| false + +| credentialSelectors +| CredentialSelectors - selectors to identify username and password keys in the secret Defaults to {username: "username", password: "password"} when not specified +| *<> +| false + +| permissions +| Permissions - user permissions on the vhost +| <> +| true + +| tags +| Tags - RabbitMQ user tags +| []string +| false +|=== + +<> + +[#rabbitmquserstatus] +==== RabbitMQUserStatus + +RabbitMQUserStatus defines the observed state of RabbitMQUser + +|=== +| Field | Description | Scheme | Required + +| conditions +| Conditions +| condition.Conditions +| false + +| observedGeneration +| ObservedGeneration - the most recent generation observed for this resource +| int64 +| false + +| secretName +| SecretName - name of the secret containing user credentials +| string +| false + +| username +| Username - actual username used in RabbitMQ +| string +| false + +| vhost +| Vhost - actual vhost name used in RabbitMQ +| string +| false + +| vhostRef +| VhostRef - reference to the RabbitMQVhost CR (for tracking finalizers) +| string +| false +|=== + +<> + +[#rabbitmqvhost] +==== RabbitMQVhost + +RabbitMQVhost is the Schema for the rabbitmqvhosts API |=== | Field | Description | Scheme | Required @@ -19657,21 +24370,21 @@ RabbitMq is the Schema for the rabbitmqs API | spec | -| <> +| <> | false | status | -| <> +| <> | false |=== <> -[#rabbitmqlist] -==== RabbitMqList +[#rabbitmqvhostlist] +==== RabbitMQVhostList -RabbitMqList contains a list of RabbitMq +RabbitMQVhostList contains a list of RabbitMQVhost |=== | Field | Description | Scheme | Required @@ -19683,58 +24396,37 @@ RabbitMqList contains a list of RabbitMq | items | -| []<> +| []<> | true |=== <> -[#rabbitmqspec] -==== RabbitMqSpec +[#rabbitmqvhostspec] +==== RabbitMQVhostSpec -RabbitMqSpec defines the desired state of RabbitMq +RabbitMQVhostSpec defines the desired state of RabbitMQVhost |=== | Field | Description | Scheme | Required -| containerImage -| Name of the rabbitmq container image to run (will be set to environmental default if empty) +| rabbitmqClusterName +| RabbitmqClusterName - the name of the RabbitMQ cluster | string | true -|=== - -<> - -[#rabbitmqspeccore] -==== RabbitMqSpecCore - -RabbitMqSpecCore - this version is used by the OpenStackControlplane CR (no container images) - -|=== -| Field | Description | Scheme | Required - -| nodeSelector -| NodeSelector to target subset of worker nodes running this service -| *map[string]string -| false - -| topologyRef -| TopologyRef to apply the Topology defined by the associated CR referenced by name -| *topologyv1.TopoRef -| false -| queueType -| QueueType to eventually apply the ha-all policy or configure default queue type for the cluster +| name +| Name - the vhost name in RabbitMQ (defaults to "/") | string | true |=== <> -[#rabbitmqstatus] -==== RabbitMqStatus +[#rabbitmqvhoststatus] +==== RabbitMQVhostStatus -RabbitMqStatus defines the observed state of RabbitMq +RabbitMQVhostStatus defines the observed state of RabbitMQVhost |=== | Field | Description | Scheme | Required @@ -19745,19 +24437,9 @@ RabbitMqStatus defines the observed state of RabbitMq | false | observedGeneration -| ObservedGeneration - the most recent generation observed for this service. If the observed generation is less than the spec generation, then the controller has not processed the latest changes injected by the opentack-operator in the top-level CR (e.g. the ContainerImage) +| ObservedGeneration - the most recent generation observed for this resource | int64 | false - -| lastAppliedTopology -| LastAppliedTopology - the last applied Topology -| *topologyv1.TopoRef -| false - -| queueType -| QueueType - store whether default ha-all policy is present or not -| string -| false |=== <> @@ -19821,6 +24503,21 @@ TransportURLSpec defines the desired state of TransportURL | RabbitmqClusterName the name of the Rabbitmq cluster which to configure the transport URL | string | true + +| userRef +| UserRef - reference to a RabbitMQUser resource. If not specified, Username will be used to create a RabbitMQUser on-demand +| string +| false + +| username +| Username - RabbitMQ username. If UserRef is not specified, a RabbitMQUser will be created with this username +| string +| false + +| vhost +| Vhost - RabbitMQ vhost name. If specified and vhost doesn't exist, a RabbitMQVhost will be created. Defaults to "/" if not specified +| string +| false |=== <> @@ -19845,6 +24542,41 @@ TransportURLStatus defines the observed state of TransportURL | queueType | QueueType - the queue type from the associated RabbitMq instance +| QueueType +| false + +| rabbitmqUsername +| RabbitmqUsername - the actual username used for the RabbitMQ user +| string +| false + +| rabbitmqVhost +| RabbitmqVhost - the actual vhost name used +| string +| false + +| rabbitmqClusterName +| RabbitmqClusterName - the cluster name used to build canonical vhost/user CR names. Stored in status so that spec changes can be compared against the previously reconciled value. +| string +| false + +| rabbitmqUserRef +| RabbitmqUserRef - the name of the RabbitMQUser CR that was created or referenced by this TransportURL. Empty if using default cluster admin credentials (no dedicated RabbitMQUser CR) +| string +| false + +| secretHash +| SecretHash - hash of the current TransportURL secret content. Consuming services compare this with the hash they computed to confirm credential rotation is complete. +| string +| false + +| previousSecretName +| PreviousSecretName - name of the previous TransportURL secret retained during credential rotation, pending consumer finalization. Cleared when the old secret is cleaned up after all consumers release it. +| string +| false + +| previousRabbitmqUserRef +| PreviousRabbitmqUserRef - the name of a previous RabbitMQUser CR whose finalizer removal was deferred during a credential rotation, pending deployment verification. Only set while a rotation is in progress. | string | false diff --git a/docs/assemblies/dataplane_resources.adoc b/docs/assemblies/dataplane_resources.adoc index c1820ebee..1299d3afd 100644 --- a/docs/assemblies/dataplane_resources.adoc +++ b/docs/assemblies/dataplane_resources.adoc @@ -8,6 +8,7 @@ [#sub-resources] === Sub Resources +* <> * <> * <> * <> @@ -27,6 +28,47 @@ * <> * <> +[#ansibleexecutionsummary] +==== AnsibleExecutionSummary + +AnsibleExecutionSummary captures the final ansible-runner execution result reported by the AEE pod. + +|=== +| Field | Description | Scheme | Required + +| totalHosts +| TotalHosts is the number of hosts included in the Ansible execution summary. +| *int +| false + +| failedHosts +| FailedHosts is the number of hosts with Ansible task failures. +| *int +| false + +| unreachableHosts +| UnreachableHosts is the number of hosts that were unreachable. +| *int +| false + +| failurePercent +| FailurePercent is the percent of total hosts that failed or were unreachable. +| *int +| false + +| failedHostList +| FailedHostList contains the hosts that failed. +| *[]string +| false + +| unreachableHostList +| UnreachableHostList contains the hosts that were unreachable. +| *[]string +| false +|=== + +<> + [#openstackdataplanedeployment] ==== OpenStackDataPlaneDeployment @@ -131,6 +173,16 @@ OpenStackDataPlaneDeploymentSpec defines the desired state of OpenStackDataPlane | AnsibleJobNodeSelector to target subset of worker nodes running the ansible jobs | map[string]string | false + +| useParallelExecution +| UseParallelExecution enables parallel execution of services based on their dependsOn dependencies. When not set (default), services run sequentially in list order and service dependencies are ignored. +| bool +| false + +| ansibleEEEnvConfigMapName +| AnsibleEEEnvConfigMapName is the name of the ConfigMap containing environment variables to inject into the Ansible Execution Environment pod. If not specified, defaults to "openstack-aee-default-env". +| string +| false |=== <> @@ -148,11 +200,21 @@ OpenStackDataPlaneDeploymentStatus defines the observed state of OpenStackDataPl | map[string]condition.Conditions | false +| failedNodeSets +| FailedNodeSets maps a nodeSet name to the message of the permanent failure that terminated it. Terminality cannot live in the conditions because the AEE job backing the failure is garbage collected once the deployment settles. +| map[string]string +| false + | ansibleEEHashes | AnsibleEEHashes | map[string]string | false +| ansibleExecutionSummaries +| AnsibleExecutionSummaries stores the most recent AEE execution summary per Job name. +| map[string]<> +| false + | configMapHashes | ConfigMapHashes | map[string]string @@ -261,6 +323,11 @@ OpenStackDataPlaneNodeSetSpec defines the desired state of OpenStackDataPlaneNod | *baremetalv1.OpenStackBaremetalSetTemplateSpec | false +| osImageType +| OSImageType selects the OS image flavor for this NodeSet's baremetal hosts. "uefi" (default) selects the UEFI self-extracting image, "bootc" selects the bootc qcow2 self-extracting image. +| OSImageType +| true + | nodeTemplate | NodeTemplate - node attributes specific to nodes defined by this resource. These attributes can be overriden at the individual node level, else take their defaults from valus in this section. | <> @@ -277,7 +344,7 @@ OpenStackDataPlaneNodeSetSpec defines the desired state of OpenStackDataPlaneNod | false | ansibleEEResources -| CPU and memory requests and limits for the main Ansible EE Job container; unset by default. The CPU request capped by a lower limit determines default forks (ceil fractional cores; 8 with no CPU). +| AnsibleEEResources specifies CPU and memory requests and limits for the main Ansible execution environment Job container. No resources are set by default. | corev1.ResourceRequirements | false @@ -332,6 +399,11 @@ OpenStackDataPlaneNodeSetStatus defines the observed state of OpenStackDataPlane | map[string]condition.Conditions | false +| deploymentExecutionSummaries +| DeploymentExecutionSummaries stores the most recent AEE execution summary per deployment and Job name. +| map[string]map[string]<> +| false + | allHostnames | AllHostnames | map[string]map[infranetworkv1.NetNameStr]string @@ -519,6 +591,11 @@ OpenStackDataPlaneServiceSpec defines the desired state of OpenStackDataPlaneSer | EDPMServiceType - service type, which typically corresponds to one of the default service names (such as nova, ovn, etc). Also typically corresponds to the ansible role name (without the "edpm_" prefix) used to manage the service. If not set, will default to the OpenStackDataPlaneService name. | string | false + +| dependsOn +| DependsOn lists EDPMServiceType or CR names that must complete before this service runs; if empty, the list predecessor is used instead. Entries referencing a service that is not part of the deployment's service list are ignored, so a service can be deployed on its own (e.g. via OpenStackDataPlaneDeployment spec.servicesOverride) without its prerequisites. +| []string +| false |=== <> @@ -593,6 +670,11 @@ AnsibleEESpec is a specification of the ansible EE attributes | []corev1.EnvVar | false +| ansibleEEResources +| AnsibleEEResources is applied to the main execution container. +| corev1.ResourceRequirements +| false + | extraVars | ExtraVars for ansible execution | map[string]json.RawMessage @@ -632,6 +714,11 @@ AnsibleEESpec is a specification of the ansible EE attributes | ServiceAccountName allows to specify what ServiceAccountName do we want the ansible execution run with. Without specifying, it will run with default serviceaccount | string | false + +| ansibleEEEnvConfigMapName +| AnsibleEEEnvConfigMapName is the name of ConfigMap containing environment variables to inject to the Ansible execution environment pod. +| string +| false |=== <> diff --git a/docs/assemblies/ref_example-OpenStackDataPlaneNodeSet-CR-for-bare-metal-nodes.adoc b/docs/assemblies/ref_example-OpenStackDataPlaneNodeSet-CR-for-bare-metal-nodes.adoc index 104b84d19..50ea37a2d 100644 --- a/docs/assemblies/ref_example-OpenStackDataPlaneNodeSet-CR-for-bare-metal-nodes.adoc +++ b/docs/assemblies/ref_example-OpenStackDataPlaneNodeSet-CR-for-bare-metal-nodes.adoc @@ -11,6 +11,13 @@ metadata: name: openstack-edpm-ipam namespace: openstack spec: + ansibleEEResources: + limits: + cpu: "2" + memory: 2Gi + requests: + cpu: 1500m + memory: 512Mi baremetalSetTemplate: #<1> bmhLabelSelector: app: openstack diff --git a/docs/assemblies/ref_example-OpenStackDataPlaneNodeSet-CR-for-preprovisioned-nodes.adoc b/docs/assemblies/ref_example-OpenStackDataPlaneNodeSet-CR-for-preprovisioned-nodes.adoc index 1456d406e..84ec3609c 100644 --- a/docs/assemblies/ref_example-OpenStackDataPlaneNodeSet-CR-for-preprovisioned-nodes.adoc +++ b/docs/assemblies/ref_example-OpenStackDataPlaneNodeSet-CR-for-preprovisioned-nodes.adoc @@ -11,6 +11,13 @@ metadata: name: openstack-edpm-ipam namespace: openstack spec: + ansibleEEResources: + limits: + cpu: "2" + memory: 2Gi + requests: + cpu: 1500m + memory: 512Mi env: #<1> - name: ANSIBLE_FORCE_COLOR value: "True"