Skip to content

[b/r] Add OpenStackBackupConfig controller and backup/restore labeling#1868

Open
stuggi wants to merge 3 commits intoopenstack-k8s-operators:mainfrom
stuggi:backup_restore_controller
Open

[b/r] Add OpenStackBackupConfig controller and backup/restore labeling#1868
stuggi wants to merge 3 commits intoopenstack-k8s-operators:mainfrom
stuggi:backup_restore_controller

Conversation

@stuggi
Copy link
Copy Markdown
Contributor

@stuggi stuggi commented Mar 31, 2026 •
edited by openshift-ci bot
Loading

  • Add OpenStackBackupConfig CRD and controller that watches CRD instances across operators and labels namespace resources (Secrets, ConfigMaps, NADs, cert-manager Issuers) with backup.openstack.org labels for backup/restore integration
  • Wire backup/restore labeling into the ControlPlane controller: CA cert secrets get backup labels via SecretTemplate, internal service cert requests get restore=false, and ReconcileBackupConfig creates/updates the BackupConfig CR with spec defaults

Commit 1: [b/r] Add OpenStackBackupConfig controller

Introduces the backup.openstack.org/v1beta1 API group with the OpenStackBackupConfig CRD. The controller:

  • Discovers CRD instances by reading backup.openstack.org/restore and backup.openstack.org/restore-order labels from CRD schemas (only on start, not on each reconcile and creates a cache) and applies them to all instances. This allows to have a dynamic approach where new CRDs just require the labels and the controller the rbac perms.
  • Labels Secrets, ConfigMaps, and NADs in the namespace with configurable restore ordering
  • Labels custom cert-manager Issuers (without ownerReferences) — operator-created Issuers are skipped
  • Supports per-resource annotation overrides (backup.openstack.org/restore, backup.openstack.org/restore-order) to customize or exclude individual resources
  • Includes envtest coverage

Commit 2: [b/r] Add backup/restore labels to ControlPlane controller

Integrates backup/restore into the existing ControlPlane reconciliation:

  • ReconcileBackupConfig in internal/openstack/backup.go creates the OpenStackBackupConfig CR with spec defaults via CreateOrPatch
  • CA cert secrets labeled at creation time in ca.go via SecretTemplate
  • Internal service cert requests labeled with restore=false (regenerated by cert-manager on restore)
  • ControlPlane controller watches Secrets for annotation changes via backup.AnnotationChangedPredicate
  • CRD label additions for backup.openstack.org/restore and backup.openstack.org/restore-order on ControlPlane, Version, DataPlaneNodeSet, and DataPlaneService types

Jira: OSPRH-22912
Jira: OSPRH-22913

Depends-On: openstack-k8s-operators/lib-common#680

stuggi and others added 2 commits March 31, 2026 19:00
@stuggi @claude
[b/r] Add OpenStackBackupConfig controller
f35f29a 
Add the BackupConfig CRD, API types, controller, RBAC, samples, and
envtests for the backup/restore labeling feature. The controller watches
CRD instances across operators and labels resources (secrets, configmaps,
NADs, cert-manager issuers) with backup.openstack.org labels for
backup/restore integration. Supports annotation overrides on individual
resources to customize restore ordering or exclude from backup.

Jira: OSPRH-22912
Jira: OSPRH-22913

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Martin Schuppert <mschuppert@redhat.com>
@stuggi @claude
[b/r] Add backup/restore labels to ControlPlane controller
4eafd75 
Wire the BackupConfig reconciliation into the ControlPlane controller.
Add backup/restore labels to CA cert secrets via SecretTemplate, and
restore=false labels to internal service cert requests. Add the
ReconcileBackupConfig call, secret watch with annotation change
predicate, and RBAC for openstackbackupconfigs. Set BackupConfig spec
defaults in the CreateOrPatch mutate function.

Jira: OSPRH-22912
Jira: OSPRH-22913

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Martin Schuppert <mschuppert@redhat.com>
@openshift-ci openshift-ci bot requested review from rabi and rebtoor March 31, 2026 17:00
@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci bot commented Mar 31, 2026

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: stuggi

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@github-actions
Copy link
Copy Markdown

github-actions bot commented Mar 31, 2026 •
edited
Loading

OpenStackControlPlane CRD Size Report

Metric Value
CRD JSON size 322337 bytes (315KB)
Base branch size 322199 bytes
Change +0.04%
Status yellow — growing
Threshold reference
Color Range Meaning
🟢 green < 300KB Comfortable
🟡 yellow 300–400KB Growing
🟠 orange 400–750KB Concerning
🔴 red > 750KB Approaching 1.5MB etcd limit (cut in half to allow space for update)

@stuggi stuggi requested review from abays and dprince and removed request for rabi and rebtoor March 31, 2026 17:01
@softwarefactory-project-zuul
Copy link
Copy Markdown

softwarefactory-project-zuul bot commented Mar 31, 2026

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/dd57c92b72a04ef0929c08fe0728effe

❌ openstack-k8s-operators-content-provider FAILURE in 9m 19s
⚠️ podified-multinode-edpm-deployment-crc SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider
⚠️ cifmw-crc-podified-edpm-baremetal SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider
⚠️ adoption-standalone-to-crc-ceph-provider SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider
⚠️ openstack-operator-tempest-multinode SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider
⚠️ openstack-operator-edpm-baremetal-minor-update SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider

@stuggi @claude
Fix pin-bundle-images.sh IMAGENAMESPACE behavior
2e3227a 
Revert IMAGENAMESPACE behavior to pre-507cdb80 logic where it only
affects replaced operators (non-openstack-k8s-operators) and operators
matching IMAGEBASE. Standard openstack-k8s-operators bundles now always
use quay.io/openstack-k8s-operators regardless of IMAGENAMESPACE.

This fixes the issue where setting IMAGENAMESPACE to a custom value
would try to find all bundles (barbican, cinder, etc.) in the custom
namespace instead of quay.io/openstack-k8s-operators, causing failures
when those bundles don't exist there.

The previous behavior is restored:
- IMAGENAMESPACE only affects replaced operators (e.g., custom forks)
- IMAGEBASE explicitly targets a specific operator for custom namespace
- Standard operators always use openstack-k8s-operators namespace

All bug fixes from 507cdb8 are retained (better error handling, jq
safety checks, proper query string syntax).

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Signed-off-by: Martin Schuppert <mschuppert@redhat.com>
@softwarefactory-project-zuul
Copy link
Copy Markdown

softwarefactory-project-zuul bot commented Apr 1, 2026

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/fe53444e267b46bfab002d52d844e719

❌ openstack-k8s-operators-content-provider FAILURE in 7m 42s
⚠️ podified-multinode-edpm-deployment-crc SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider
⚠️ cifmw-crc-podified-edpm-baremetal SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider
⚠️ adoption-standalone-to-crc-ceph-provider SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider
⚠️ openstack-operator-tempest-multinode SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider
⚠️ openstack-operator-edpm-baremetal-minor-update SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci bot commented Apr 1, 2026

@stuggi: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/precommit-check 2e3227a link true /test precommit-check
ci/prow/openstack-operator-build-deploy-kuttl-4-18 2e3227a link true /test openstack-operator-build-deploy-kuttl-4-18

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@abays abays Awaiting requested review from abays

@dprince dprince Awaiting requested review from dprince

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

approved do-not-merge/hold

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@stuggi