OpenSearch credentials lifecycle was implemented

apis/clusterresources/v1beta1/opensearchuser_types.go

@@ -0,0 +1,75 @@
+/*
+Copyright 2022.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1beta1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	"github.com/instaclustr/operator/pkg/models"
+)
+
+// OpenSearchUserSpec defines the desired state of OpenSearchUser
+type OpenSearchUserSpec struct {
+	SecretRef *SecretReference `json:"secretRef"`
+}
+
+// OpenSearchUserStatus defines the observed state of OpenSearchUser
+type OpenSearchUserStatus struct {
+	State     string `json:"state"`
+	ClusterID string `json:"clusterId"`
+}
+
+//+kubebuilder:object:root=true
+//+kubebuilder:subresource:status
+
+// OpenSearchUser is the Schema for the opensearchusers API
+type OpenSearchUser struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   OpenSearchUserSpec   `json:"spec,omitempty"`
+	Status OpenSearchUserStatus `json:"status,omitempty"`
+}
+
+//+kubebuilder:object:root=true
+
+// OpenSearchUserList contains a list of OpenSearchUser
+type OpenSearchUserList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []OpenSearchUser `json:"items"`
+}
+
+func (u *OpenSearchUser) ToInstaAPI(username, password string) *models.InstaOpenSearchUser {
+	return &models.InstaOpenSearchUser{
+		InstaUser: &models.InstaUser{
+			Username:          username,
+			Password:          password,
+			InitialPermission: "standard",
+		},
+	}
+}
+
+func (u *OpenSearchUser) NewPatch() client.Patch {
+	old := u.DeepCopy()
+	return client.MergeFrom(old)
+}
+
+func init() {
+	SchemeBuilder.Register(&OpenSearchUser{}, &OpenSearchUserList{})
+}

apis/clusters/v1beta1/opensearch_types.go

@@ -52,6 +52,7 @@ type OpenSearchSpec struct {
 	IndexManagementPlugin    bool                    `json:"indexManagementPlugin,omitempty"`
 	AlertingPlugin           bool                    `json:"alertingPlugin,omitempty"`
 	BundledUseOnly           bool                    `json:"bundleUseOnly,omitempty"`
+	UserRef                  *UserReference          `json:"userRef,omitempty"`
 }
 
 type OpenSearchDataCentre struct {

config/crd/bases/clusterresources.instaclustr.com_opensearchusers.yaml

@@ -0,0 +1,66 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.9.2
+  creationTimestamp: null
+  name: opensearchusers.clusterresources.instaclustr.com
+spec:
+  group: clusterresources.instaclustr.com
+  names:
+    kind: OpenSearchUser
+    listKind: OpenSearchUserList
+    plural: opensearchusers
+    singular: opensearchuser
+  scope: Namespaced
+  versions:
+  - name: v1beta1
+    schema:
+      openAPIV3Schema:
+        description: OpenSearchUser is the Schema for the opensearchusers API
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: OpenSearchUserSpec defines the desired state of OpenSearchUser
+            properties:
+              secretRef:
+                properties:
+                  name:
+                    type: string
+                  namespace:
+                    type: string
+                required:
+                - name
+                - namespace
+                type: object
+            required:
+            - secretRef
+            type: object
+          status:
+            description: OpenSearchUserStatus defines the observed state of OpenSearchUser
+            properties:
+              clusterId:
+                type: string
+              state:
+                type: string
+            required:
+            - clusterId
+            - state
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}

config/crd/bases/clusters.instaclustr.com_opensearches.yaml

@@ -212,6 +212,16 @@ spec:
                   - email
                   type: object
                 type: array
+              userRef:
+                properties:
+                  name:
+                    type: string
+                  namespace:
+                    type: string
+                required:
+                - name
+                - namespace
+                type: object
               version:
                 type: string
             required:

config/crd/kustomization.yaml

@@ -25,6 +25,7 @@ resources:
 - bases/clusterresources.instaclustr.com_redisusers.yaml
 - bases/clusterresources.instaclustr.com_awsencryptionkeys.yaml
 - bases/clusterresources.instaclustr.com_cassandrausers.yaml
+- bases/clusterresources.instaclustr.com_opensearchusers.yaml
 #+kubebuilder:scaffold:crdkustomizeresource
 
 patchesStrategicMerge:

config/crd/patches/cainjection_in_clusterresources_opensearchusers.yaml

@@ -0,0 +1,7 @@
+# The following patch adds a directive for certmanager to inject CA into the CRD
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
+  name: opensearchusers.clusterresources.instaclustr.com

config/crd/patches/webhook_in_clusterresources_opensearchusers.yaml

@@ -0,0 +1,16 @@
+# The following patch enables a conversion webhook for the CRD
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: opensearchusers.clusterresources.instaclustr.com
+spec:
+  conversion:
+    strategy: Webhook
+    webhook:
+      clientConfig:
+        service:
+          namespace: system
+          name: webhook-service
+          path: /convert
+      conversionReviewVersions:
+      - v1

config/rbac/clusterresources_opensearchuser_editor_role.yaml

@@ -0,0 +1,31 @@
+# permissions for end users to edit opensearchusers.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/name: clusterrole
+    app.kubernetes.io/instance: opensearchuser-editor-role
+    app.kubernetes.io/component: rbac
+    app.kubernetes.io/created-by: operator
+    app.kubernetes.io/part-of: operator
+    app.kubernetes.io/managed-by: kustomize
+  name: opensearchuser-editor-role
+rules:
+- apiGroups:
+  - clusterresources.instaclustr.com
+  resources:
+  - opensearchusers
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - clusterresources.instaclustr.com
+  resources:
+  - opensearchusers/status
+  verbs:
+  - get

config/rbac/clusterresources_opensearchuser_viewer_role.yaml

@@ -0,0 +1,27 @@
+# permissions for end users to view opensearchusers.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/name: clusterrole
+    app.kubernetes.io/instance: opensearchuser-viewer-role
+    app.kubernetes.io/component: rbac
+    app.kubernetes.io/created-by: operator
+    app.kubernetes.io/part-of: operator
+    app.kubernetes.io/managed-by: kustomize
+  name: opensearchuser-viewer-role
+rules:
+- apiGroups:
+  - clusterresources.instaclustr.com
+  resources:
+  - opensearchusers
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - clusterresources.instaclustr.com
+  resources:
+  - opensearchusers/status
+  verbs:
+  - get