unkinben
54d3e38223
The operator previously assumed it created every user and bucket it managed: reconciling an existing resource could overwrite its user attributes or wipe its bucket policy, and deleting a CRD always deleted the underlying RGW object (only Bucket had retainOnDelete). That made taking over pre-existing radosgw state unsafe. Make adoption first-class. - add retainOnDelete to ObjectStoreUser and BucketAccess (dedicated users), so deleting the CRD orphans the RGW user instead of deleting it (symmetric with Bucket) - merge bucket policy instead of replacing it: the operator marks its own statements with a cephrgwop* Sid and preserves any statement it does not own, so adopting a bucket with a hand-written policy keeps it; add Bucket managePolicy (default true) to opt out of policy management entirely - only reconcile user attributes the spec sets: DisplayName when non-empty and Suspended is now an optional *bool, so adopting a user does not reset them - record adoption: ObjectStoreUser/Bucket status.adopted (+ printcolumn) is true when the RGW object already existed on first reconcile - add GetBucketPolicy + MergeBucketPolicy; keyed adoption detection off the status identity field so a Pending owner wait does not mislabel it - regenerate CRDs/deepcopy; add docs/adoption.md and config/samples/05-adoption.yaml; cover the merge in policy_test.go Claude-Session: https://claude.ai/code/session_016CEncETbf8cvy1PhsHfFHM
32 lines
1.1 KiB
YAML
32 lines
1.1 KiB
YAML
# Adopting an existing radosgw user + bucket. The operator takes them over in
|
|
# place: no recreation, existing keys reused, existing bucket policy preserved.
|
|
# retainOnDelete keeps the RGW objects if these CRDs are later deleted.
|
|
# See docs/adoption.md.
|
|
apiVersion: ceph.unkin.net/v1alpha1
|
|
kind: ObjectStoreUser
|
|
metadata:
|
|
name: legacy-owner
|
|
namespace: default
|
|
spec:
|
|
# uid must match the existing RGW user id.
|
|
uid: legacy-owner
|
|
# Set maxBuckets to the existing user's limit (it otherwise defaults to 1000
|
|
# and would be applied). Leave displayName/suspended unset to keep them as-is.
|
|
maxBuckets: 1000
|
|
retainOnDelete: true
|
|
---
|
|
apiVersion: ceph.unkin.net/v1alpha1
|
|
kind: Bucket
|
|
metadata:
|
|
name: legacy-data
|
|
namespace: default
|
|
spec:
|
|
# bucketName must match the existing bucket.
|
|
bucketName: legacy-data
|
|
ownerRef: legacy-owner
|
|
retainOnDelete: true
|
|
# managePolicy defaults to true: the operator merges its BucketAccess grants
|
|
# into the existing policy, preserving statements it does not own. Set it to
|
|
# false to leave the bucket policy entirely under manual control.
|
|
managePolicy: true
|