Keystone: User Controller by dlaw4608 · Pull Request #657 · k-orc/openstack-resource-controller

dlaw4608 · 2026-01-28T11:22:52Z

Fixes #583
Add Support for the Identity service's User resource in ORC

winiciusallan

Hi, @dlaw4608, that was a great job!

Left a few comments about using a Project object instead of the ID directly, LMK what you think.

winiciusallan · 2026-02-03T13:48:07Z

api/v1alpha1/user_types.go

+	// +kubebuilder:validation:MinLength:=1
+	// +kubebuilder:validation:MaxLength:=255
+	// +optional
+	DefaultProjectID *string `json:"defaultProjectID,omitempty"`


Isn't it better to use a ProjectRef here so we can better control the resource?

Suggested change

DefaultProjectID *string `json:"defaultProjectID,omitempty"`

DefaultProjectID *ProjectRef `json:"defaultProjectID,omitempty"`

It should indeed be a reference, but would rather be in the form:

Suggested change

DefaultProjectID *string `json:"defaultProjectID,omitempty"`

DefaultProjectRef *KubernetesNameRef `json:"defaultProjectRef,omitempty"`

See https://k-orc.cloud/development/architecture/#api-design-philosophy.

I'd like to add a lint rule to flag these.

Also, since this is an optional dependency for your controller, you should have run the scaffolding tool with -optional-create-dependency Project.

Agreed, went back and recreated the user controller this time with Project included as an optional dependency
go run ./cmd/scaffold-controller -interactive=false \ -kind User \ -gophercloud-client NewIdentityV3 \ -gophercloud-module github.com/gophercloud/gophercloud/v2/openstack/identity/v3/users \ -import-dependency Domain \ -optional-create-dependency Domain \ -optional-create-dependency Project

Changed ProjectRef to DefaultProjectRef to match the OpenStack field naming. The spec only references other ORC objects (like Project) by K8s name, never OpenStack UUIDs. The controller resolves the reference to get the Project's UUID and waits for the Project to be Available before creating the User with its DefaultProjectID.

winiciusallan · 2026-02-03T17:03:59Z

internal/controllers/user/actuator.go

+	}
+}
+
+func handleDefaultProjectIDUpdate(updateOpts *users.UpdateOpts, resource *resourceSpecT, osResource *osResourceT) {


Possibly change this to use a reference instead of an ID as suggested above.

winiciusallan · 2026-02-04T14:00:35Z

internal/controllers/user/tests/user-create-minimal/00-assert.yaml

+
+
+
+
+


Blank lines at the end. I would remove them to make it cleaner.

internal/controllers/user/tests/user-create-minimal/00-assert.yaml

mandre · 2026-02-05T09:28:33Z

api/v1alpha1/user_types.go

+	// +kubebuilder:validation:MinLength:=1
+	// +kubebuilder:validation:MaxLength:=255
+	// +optional
+	DefaultProjectID *string `json:"defaultProjectID,omitempty"`


It should indeed be a reference, but would rather be in the form:

Suggested change

DefaultProjectID *string `json:"defaultProjectID,omitempty"`

DefaultProjectRef *KubernetesNameRef `json:"defaultProjectRef,omitempty"`

See https://k-orc.cloud/development/architecture/#api-design-philosophy.

I'd like to add a lint rule to flag these.

Also, since this is an optional dependency for your controller, you should have run the scaffolding tool with -optional-create-dependency Project.

mandre · 2026-02-05T09:37:52Z

api/v1alpha1/user_types.go

+	// +kubebuilder:validation:MinLength:=1
+	// +kubebuilder:validation:MaxLength:=255
+	// +optional
+	Password *string `json:"password,omitempty"`


This must be stored in a secret. See how we do it for user data in the server controller.

Followed the same structure as user data in the server controller, the user_types api uses a SecretRef field to reference a secret containing the password of a user in a secret, thanks for the help!!

mandre

Could you also add the User resource to the README ?

internal/controllers/user/tests/user-create-full/00-create-resource.yaml

internal/controllers/volume/user-import-error/00-create-resources.yaml

api/v1alpha1/user_types.go

internal/controllers/user/tests/user-create-full/01-disable-domain.yaml

go run ./cmd/scaffold-controller -interactive=false \ -kind User \ -gophercloud-client NewIdentityV3 \ -gophercloud-module github.com/gophercloud/gophercloud/v2/openstack/identity/v3/users \ -import-dependency Domain \ -optional-create-dependency Domain \ -optional-create-dependency Project Signed-off-by: Daniel Lawton <dlawton@redhat.com>

- E2E tests included - API configured - Controller Note: Password functionality will be implemented in a future PR. Users can still be created and managed, just without password support. Signed-off-by: Daniel Lawton <dlawton@redhat.com>

mandre

Great, let's get this merged.

Keystone: User Controller

github-actions bot added the semver:major Breaking change label Jan 28, 2026

dlaw4608 force-pushed the keystone_user branch 2 times, most recently from 23295c5 to dcfe645 Compare January 29, 2026 19:28

dlaw4608 marked this pull request as ready for review January 29, 2026 19:32

dlaw4608 force-pushed the keystone_user branch from dcfe645 to 0f90e6a Compare January 29, 2026 20:48

winiciusallan reviewed Feb 4, 2026

View reviewed changes

mandre reviewed Feb 5, 2026

View reviewed changes

dlaw4608 force-pushed the keystone_user branch 4 times, most recently from c2ebe4c to cfe154f Compare February 11, 2026 10:11

mandre reviewed Feb 11, 2026

View reviewed changes

gndrmnn mentioned this pull request Feb 26, 2026

Keystone Application Credentials Controller #670

Open

dlaw4608 marked this pull request as draft March 3, 2026 15:39

dlaw4608 force-pushed the keystone_user branch from 9ef61e1 to 7622f12 Compare March 4, 2026 14:50

dlaw4608 force-pushed the keystone_user branch from 7622f12 to 624ef57 Compare March 4, 2026 14:57

Working User Controller:

ae115bc

- E2E tests included - API configured - Controller Note: Password functionality will be implemented in a future PR. Users can still be created and managed, just without password support. Signed-off-by: Daniel Lawton <dlawton@redhat.com>

dlaw4608 force-pushed the keystone_user branch from 624ef57 to ae115bc Compare March 4, 2026 15:22

dlaw4608 mentioned this pull request Mar 4, 2026

Keystone: Add Password field to User Controller #703

Open

dlaw4608 marked this pull request as ready for review March 4, 2026 16:11

mandre approved these changes Mar 4, 2026

View reviewed changes

mandre added this pull request to the merge queue Mar 4, 2026

github-merge-queue bot pushed a commit that referenced this pull request Mar 4, 2026

Merge pull request #657 from dlaw4608/keystone_user

037016e

Keystone: User Controller

github-merge-queue bot removed this pull request from the merge queue due to no response for status checks Mar 4, 2026

mandre added this pull request to the merge queue Mar 4, 2026

Merged via the queue into k-orc:main with commit 21e4081 Mar 4, 2026
9 checks passed

mandre mentioned this pull request Mar 5, 2026

Implement ApplicationCredentials #671

Draft

	DefaultProjectID *string `json:"defaultProjectID,omitempty"`
	DefaultProjectID *ProjectRef `json:"defaultProjectID,omitempty"`

	DefaultProjectID *string `json:"defaultProjectID,omitempty"`
	DefaultProjectRef *KubernetesNameRef `json:"defaultProjectRef,omitempty"`

Conversation

dlaw4608 commented Jan 28, 2026

Uh oh!

winiciusallan left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mandre left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mandre left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants