Initial cephrgw-operator: Ceph RGW buckets & keys via dashboard API

Adds a Kubernetes operator that provisions Ceph RGW (S3) buckets and
access keys declaratively through the Ceph manager dashboard REST API.

Three CRDs in group ceph.unkin.net/v1alpha1:
- ObjectStoreUser: creates an RGW user, delivers its key pair to a Secret
- Bucket: creates an S3 bucket owned by an ObjectStoreUser; owns the
  bucket's aggregate S3 policy (union of all BucketAccess grants)
- BucketAccess: grants read-only/read-write/full access, provisioning a
  dedicated user (or reusing a referenced one) and delivering RW/RO keys

The internal/ceph client wraps the dashboard /api/auth, /api/rgw/user and
/api/rgw/bucket endpoints with lazy token auth and re-auth on 401. Bucket
policies are rendered deterministically and applied via the bucket
policy API (Reef 18.2+). Credentials come from the cephrgw-credentials
Secret via env. Includes generated CRDs/RBAC, samples, kind manifests,
Woodpecker CI, and docs/ceph-setup.md covering the required Ceph
dashboard account, RGW wiring and permissions.

internal/controller/helpers.go

@@ -0,0 +1,101 @@
+package controller
+
+import (
+	"context"
+	"net/url"
+	"time"
+
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+
+	"git.unkin.net/unkin/cephrgw-operator/internal/ceph"
+)
+
+// finalizer guards external RGW state (users, buckets, policy statements) so it
+// is cleaned up before the Kubernetes object disappears.
+const finalizer = "ceph.unkin.net/finalizer"
+
+// requeueSteady is the resync interval for healthy objects; it lets the
+// operator heal drift made directly against RGW.
+const requeueSteady = 10 * time.Minute
+
+// requeueShort backs off on transient "waiting for a dependency" states.
+const requeueShort = 30 * time.Second
+
+// setReady sets the standard Ready condition on a status conditions slice.
+func setReady(conds *[]metav1.Condition, gen int64, ok bool, reason, msg string) {
+	status := metav1.ConditionFalse
+	if ok {
+		status = metav1.ConditionTrue
+	}
+	meta.SetStatusCondition(conds, metav1.Condition{
+		Type:               "Ready",
+		Status:             status,
+		ObservedGeneration: gen,
+		Reason:             reason,
+		Message:            truncate(msg, 32000),
+	})
+}
+
+func truncate(s string, n int) string {
+	if len(s) <= n {
+		return s
+	}
+	return s[:n]
+}
+
+func orDefault(v, def string) string {
+	if v != "" {
+		return v
+	}
+	return def
+}
+
+// upsertSecret creates or updates an owner-referenced Opaque Secret with data.
+func upsertSecret(ctx context.Context, c client.Client, scheme *runtime.Scheme, owner client.Object, name, namespace string, data map[string][]byte) error {
+	sec := &corev1.Secret{}
+	sec.Name = name
+	sec.Namespace = namespace
+	_, err := controllerutil.CreateOrUpdate(ctx, c, sec, func() error {
+		sec.Type = corev1.SecretTypeOpaque
+		if sec.Data == nil {
+			sec.Data = map[string][]byte{}
+		}
+		for k, v := range data {
+			sec.Data[k] = v
+		}
+		return controllerutil.SetControllerReference(owner, sec, scheme)
+	})
+	return err
+}
+
+// credentialSecretData assembles the conventional S3/AWS credential keys.
+func credentialSecretData(key ceph.UserKey, uid, endpoint, bucket string) map[string][]byte {
+	data := map[string][]byte{
+		"AWS_ACCESS_KEY_ID":     []byte(key.AccessKey),
+		"AWS_SECRET_ACCESS_KEY": []byte(key.SecretKey),
+		"RGW_UID":               []byte(uid),
+	}
+	if endpoint != "" {
+		data["S3_ENDPOINT"] = []byte(endpoint)
+		if host := hostOf(endpoint); host != "" {
+			data["BUCKET_HOST"] = []byte(host)
+		}
+	}
+	if bucket != "" {
+		data["BUCKET_NAME"] = []byte(bucket)
+	}
+	return data
+}
+
+func hostOf(endpoint string) string {
+	u, err := url.Parse(endpoint)
+	if err != nil || u.Host == "" {
+		return endpoint
+	}
+	return u.Host
+}