move cluster resources to platform cluster

Diaphteiros · Diaphteiros · commit 2e7beeaaf535 · 2025-05-14T13:52:49.000+02:00
diff --git a/api/clusters/v1alpha1/accessrequest_types.go b/api/clusters/v1alpha1/accessrequest_types.go
@@ -12,6 +12,12 @@ type AccessRequestSpec struct {
 	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="clusterRef is immutable"
 	ClusterRef NamespacedObjectReference `json:"clusterRef"`
 
+	// RequestRef is the reference to the ClusterRequest for whose Cluster access is requested.
+	// Exactly one of clusterRef or requestRef must be set.
+	// This value is immutable.
+	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="requestRef is immutable"
+	RequestRef NamespacedObjectReference `json:"requestRef"`
+
 	// Permissions are the requested permissions.
 	Permissions []PermissionsRequest `json:"permissions"`
 }
@@ -34,12 +40,13 @@ type AccessRequestStatus struct {
 	// Phase is the current phase of the request.
 	Phase RequestPhase `json:"phase"`
 
-	// TODO: expose actual access information
+	// SecretRef holds the reference to the secret that contains the actual credentials.
+	SecretRef *NamespacedObjectReference `json:"secretRef,omitempty"`
 }
 
 // +kubebuilder:object:root=true
 // +kubebuilder:subresource:status
-// +kubebuilder:metadata:labels="openmcp.cloud/cluster=onboarding"
+// +kubebuilder:metadata:labels="openmcp.cloud/cluster=platform"
 
 // AccessRequest is the Schema for the accessrequests API
 type AccessRequest struct {
diff --git a/api/clusters/v1alpha1/cluster_types.go b/api/clusters/v1alpha1/cluster_types.go
@@ -81,7 +81,7 @@ const (
 
 // +kubebuilder:object:root=true
 // +kubebuilder:subresource:status
-// +kubebuilder:metadata:labels="openmcp.cloud/cluster=onboarding"
+// +kubebuilder:metadata:labels="openmcp.cloud/cluster=platform"
 // +kubebuilder:selectablefield:JSONPath=".spec.clusterProfileRef.name"
 // +kubebuilder:printcolumn:JSONPath=".spec.purposes",name="Purposes",type=string
 // +kubebuilder:printcolumn:JSONPath=`.status.phase`,name="Phase",type=string
diff --git a/api/clusters/v1alpha1/clusterprofile_types.go b/api/clusters/v1alpha1/clusterprofile_types.go
@@ -6,9 +6,6 @@ import (
 
 // ClusterProfileSpec defines the desired state of Provider.
 type ClusterProfileSpec struct {
-	// Environment is the environment in which the ClusterProvider resides.
-	Environment string `json:"environment"`
-
 	// ProviderRef is a reference to the ClusterProvider
 	ProviderRef ObjectReference `json:"providerRef"`
 
@@ -30,11 +27,9 @@ type SupportedK8sVersion struct {
 
 // +kubebuilder:object:root=true
 // +kubebuilder:resource:scope=Cluster,shortName=cprof;profile
-// +kubebuilder:metadata:labels="openmcp.cloud/cluster=onboarding"
-// +kubebuilder:selectablefield:JSONPath=".spec.environment"
+// +kubebuilder:metadata:labels="openmcp.cloud/cluster=platform"
 // +kubebuilder:selectablefield:JSONPath=".spec.providerRef.name"
 // +kubebuilder:selectablefield:JSONPath=".spec.providerConfigRef.name"
-// +kubebuilder:printcolumn:JSONPath=".spec.environment",name="Env",type=string
 // +kubebuilder:printcolumn:JSONPath=".spec.providerRef.name",name="Provider",type=string
 // +kubebuilder:printcolumn:JSONPath=".spec.providerConfigRef.name",name="Config",type=string
 
diff --git a/api/clusters/v1alpha1/clusterrequest_types.go b/api/clusters/v1alpha1/clusterrequest_types.go
@@ -30,7 +30,7 @@ type RequestPhase string
 // +kubebuilder:object:root=true
 // +kubebuilder:subresource:status
 // +kubebuilder:resource:shortName=cr;creq;request
-// +kubebuilder:metadata:labels="openmcp.cloud/cluster=onboarding"
+// +kubebuilder:metadata:labels="openmcp.cloud/cluster=platform"
 // +kubebuilder:selectablefield:JSONPath=".spec.purpose"
 // +kubebuilder:selectablefield:JSONPath=".status.phase"
 // +kubebuilder:printcolumn:JSONPath=".spec.purpose",name="Purpose",type=string
diff --git a/api/clusters/v1alpha1/zz_generated.deepcopy.go b/api/clusters/v1alpha1/zz_generated.deepcopy.go
diff --git a/api/crds/manifests/clusters.openmcp.cloud_accessrequests.yaml b/api/crds/manifests/clusters.openmcp.cloud_accessrequests.yaml
@@ -5,7 +5,7 @@ metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.17.3
   labels:
-    openmcp.cloud/cluster: onboarding
+    openmcp.cloud/cluster: platform
   name: accessrequests.clusters.openmcp.cloud
 spec:
   group: clusters.openmcp.cloud
@@ -125,9 +125,30 @@ spec:
                   - rules
                   type: object
                 type: array
+              requestRef:
+                description: |-
+                  RequestRef is the reference to the ClusterRequest for whose Cluster access is requested.
+                  Exactly one of clusterRef or requestRef must be set.
+                  This value is immutable.
+                properties:
+                  name:
+                    description: Name is the name of the referenced resource.
+                    minLength: 1
+                    type: string
+                  namespace:
+                    description: Namespace is the namespace of the referenced resource.
+                    type: string
+                required:
+                - name
+                - namespace
+                type: object
+                x-kubernetes-validations:
+                - message: requestRef is immutable
+                  rule: self == oldSelf
             required:
             - clusterRef
             - permissions
+            - requestRef
             type: object
           status:
             description: AccessRequestStatus defines the observed state of AccessRequest
@@ -187,6 +208,21 @@ spec:
                 description: Reason is expected to contain a CamelCased string that
                   provides further information in a machine-readable format.
                 type: string
+              secretRef:
+                description: SecretRef holds the reference to the secret that contains
+                  the actual credentials.
+                properties:
+                  name:
+                    description: Name is the name of the referenced resource.
+                    minLength: 1
+                    type: string
+                  namespace:
+                    description: Namespace is the namespace of the referenced resource.
+                    type: string
+                required:
+                - name
+                - namespace
+                type: object
             required:
             - lastReconcileTime
             - observedGeneration
diff --git a/api/crds/manifests/clusters.openmcp.cloud_clusterprofiles.yaml b/api/crds/manifests/clusters.openmcp.cloud_clusterprofiles.yaml
@@ -5,7 +5,7 @@ metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.17.3
   labels:
-    openmcp.cloud/cluster: onboarding
+    openmcp.cloud/cluster: platform
   name: clusterprofiles.clusters.openmcp.cloud
 spec:
   group: clusters.openmcp.cloud
@@ -20,9 +20,6 @@ spec:
   scope: Cluster
   versions:
   - additionalPrinterColumns:
-    - jsonPath: .spec.environment
-      name: Env
-      type: string
     - jsonPath: .spec.providerRef.name
       name: Provider
       type: string
@@ -53,10 +50,6 @@ spec:
           spec:
             description: ClusterProfileSpec defines the desired state of Provider.
             properties:
-              environment:
-                description: Environment is the environment in which the ClusterProvider
-                  resides.
-                type: string
               providerConfigRef:
                 description: ProviderConfigRef is a reference to the provider-specific
                   configuration.
@@ -94,14 +87,12 @@ spec:
                   type: object
                 type: array
             required:
-            - environment
             - providerConfigRef
             - providerRef
             - supportedVersions
             type: object
         type: object
     selectableFields:
-    - jsonPath: .spec.environment
     - jsonPath: .spec.providerRef.name
     - jsonPath: .spec.providerConfigRef.name
     served: true
diff --git a/api/crds/manifests/clusters.openmcp.cloud_clusterrequests.yaml b/api/crds/manifests/clusters.openmcp.cloud_clusterrequests.yaml
@@ -5,7 +5,7 @@ metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.17.3
   labels:
-    openmcp.cloud/cluster: onboarding
+    openmcp.cloud/cluster: platform
   name: clusterrequests.clusters.openmcp.cloud
 spec:
   group: clusters.openmcp.cloud
diff --git a/api/crds/manifests/clusters.openmcp.cloud_clusters.yaml b/api/crds/manifests/clusters.openmcp.cloud_clusters.yaml
@@ -5,7 +5,7 @@ metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.17.3
   labels:
-    openmcp.cloud/cluster: onboarding
+    openmcp.cloud/cluster: platform
   name: clusters.clusters.openmcp.cloud
 spec:
   group: clusters.openmcp.cloud
diff --git a/cmd/openmcp-operator/app/run.go b/cmd/openmcp-operator/app/run.go
@@ -287,7 +287,7 @@ func (o *RunOptions) Run(ctx context.Context) error {
 
 	// setup cluster scheduler
 	if slices.Contains(o.Controllers, strings.ToLower(scheduler.ControllerName)) {
-		sc, err := scheduler.NewClusterScheduler(&setupLog, o.Clusters.Onboarding, o.Config.Scheduler)
+		sc, err := scheduler.NewClusterScheduler(&setupLog, o.Clusters.Platform, o.Config.Scheduler)
 		if err != nil {
 			return fmt.Errorf("unable to initialize cluster scheduler: %w", err)
 		}
diff --git a/internal/controllers/scheduler/controller.go b/internal/controllers/scheduler/controller.go
@@ -12,17 +12,14 @@ import (
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
-	"sigs.k8s.io/controller-runtime/pkg/handler"
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
-	"sigs.k8s.io/controller-runtime/pkg/source"
 
 	"github.com/openmcp-project/controller-utils/pkg/clusters"
 	"github.com/openmcp-project/controller-utils/pkg/collections/filters"
 	ctrlutils "github.com/openmcp-project/controller-utils/pkg/controller"
 	errutils "github.com/openmcp-project/controller-utils/pkg/errors"
 	"github.com/openmcp-project/controller-utils/pkg/logging"
-	testutils "github.com/openmcp-project/controller-utils/pkg/testing"
 
 	clustersv1alpha1 "github.com/openmcp-project/openmcp-operator/api/clusters/v1alpha1"
 	cconst "github.com/openmcp-project/openmcp-operator/api/clusters/v1alpha1/constants"
@@ -31,8 +28,8 @@ import (
 
 const ControllerName = "Scheduler"
 
-func NewClusterScheduler(setupLog *logging.Logger, onboardingCluster *clusters.Cluster, config *config.SchedulerConfig) (*ClusterScheduler, error) {
-	if onboardingCluster == nil {
+func NewClusterScheduler(setupLog *logging.Logger, platformCluster *clusters.Cluster, config *config.SchedulerConfig) (*ClusterScheduler, error) {
+	if platformCluster == nil {
 		return nil, fmt.Errorf("onboarding cluster must not be nil")
 	}
 	if config == nil {
@@ -42,14 +39,14 @@ func NewClusterScheduler(setupLog *logging.Logger, onboardingCluster *clusters.C
 		setupLog.WithName(ControllerName).Info("Initializing cluster scheduler", "scope", string(config.Scope), "strategy", string(config.Strategy), "knownPurposes", strings.Join(sets.List(sets.KeySet(config.PurposeMappings)), ","))
 	}
 	return &ClusterScheduler{
-		OnboardingCluster: onboardingCluster,
-		Config:            config,
+		PlatformCluster: platformCluster,
+		Config:          config,
 	}, nil
 }
 
 type ClusterScheduler struct {
-	OnboardingCluster *clusters.Cluster
-	Config            *config.SchedulerConfig
+	PlatformCluster *clusters.Cluster
+	Config          *config.SchedulerConfig
 }
 
 var _ reconcile.Reconciler = &ClusterScheduler{}
@@ -73,13 +70,13 @@ func (r *ClusterScheduler) Reconcile(ctx context.Context, req reconcile.Request)
 			return clustersv1alpha1.REQUEST_GRANTED, nil
 		}).
 		Build().
-		UpdateStatus(ctx, r.OnboardingCluster.Client(), rr)
+		UpdateStatus(ctx, r.PlatformCluster.Client(), rr)
 }
 
 func (r *ClusterScheduler) reconcile(ctx context.Context, log logging.Logger, req reconcile.Request) ReconcileResult {
 	// get ClusterRequest resource
 	cr := &clustersv1alpha1.ClusterRequest{}
-	if err := r.OnboardingCluster.Client().Get(ctx, req.NamespacedName, cr); err != nil {
+	if err := r.PlatformCluster.Client().Get(ctx, req.NamespacedName, cr); err != nil {
 		if apierrors.IsNotFound(err) {
 			log.Info("Resource not found")
 			return ReconcileResult{}
@@ -97,7 +94,7 @@ func (r *ClusterScheduler) reconcile(ctx context.Context, log logging.Logger, re
 				return ReconcileResult{}
 			case clustersv1alpha1.OperationAnnotationValueReconcile:
 				log.Debug("Removing reconcile operation annotation from resource")
-				if err := ctrlutils.EnsureAnnotation(ctx, r.OnboardingCluster.Client(), cr, clustersv1alpha1.OperationAnnotation, "", true, ctrlutils.DELETE); err != nil {
+				if err := ctrlutils.EnsureAnnotation(ctx, r.PlatformCluster.Client(), cr, clustersv1alpha1.OperationAnnotation, "", true, ctrlutils.DELETE); err != nil {
 					return ReconcileResult{ReconcileError: errutils.WithReason(fmt.Errorf("error removing operation annotation: %w", err), cconst.ReasonOnboardingClusterInteractionProblem)}
 				}
 			}
@@ -118,7 +115,7 @@ func (r *ClusterScheduler) reconcile(ctx context.Context, log logging.Logger, re
 		// ensure finalizer
 		if controllerutil.AddFinalizer(cr, clustersv1alpha1.ClusterRequestFinalizer) {
 			log.Info("Adding finalizer")
-			if err := r.OnboardingCluster.Client().Patch(ctx, cr, client.MergeFrom(rr.OldObject)); err != nil {
+			if err := r.PlatformCluster.Client().Patch(ctx, cr, client.MergeFrom(rr.OldObject)); err != nil {
 				rr.ReconcileError = errutils.WithReason(fmt.Errorf("error patching finalizer on resource '%s': %w", req.NamespacedName.String(), err), cconst.ReasonOnboardingClusterInteractionProblem)
 				return rr
 			}
@@ -149,7 +146,7 @@ func (r *ClusterScheduler) reconcile(ctx context.Context, log logging.Logger, re
 			namespace = cDef.Template.Namespace
 		}
 		clusterList := &clustersv1alpha1.ClusterList{}
-		if err := r.OnboardingCluster.Client().List(ctx, clusterList, client.InNamespace(namespace), client.MatchingLabelsSelector{Selector: cDef.CompletedSelector}); err != nil {
+		if err := r.PlatformCluster.Client().List(ctx, clusterList, client.InNamespace(namespace), client.MatchingLabelsSelector{Selector: cDef.CompletedSelector}); err != nil {
 			rr.ReconcileError = errutils.WithReason(fmt.Errorf("error listing Clusters: %w", err), cconst.ReasonOnboardingClusterInteractionProblem)
 			return rr
 		}
@@ -235,7 +232,7 @@ func (r *ClusterScheduler) reconcile(ctx context.Context, log logging.Logger, re
 			fin := cr.FinalizerForCluster()
 			if controllerutil.AddFinalizer(cluster, fin) {
 				log.Debug("Adding finalizer to cluster", "clusterName", cluster.Name, "clusterNamespace", cluster.Namespace, "finalizer", fin)
-				if err := r.OnboardingCluster.Client().Patch(ctx, cluster, client.MergeFrom(oldCluster)); err != nil {
+				if err := r.PlatformCluster.Client().Patch(ctx, cluster, client.MergeFrom(oldCluster)); err != nil {
 					rr.ReconcileError = errutils.WithReason(fmt.Errorf("error patching finalizer '%s' on cluster '%s/%s': %w", fin, cluster.Namespace, cluster.Name, err), cconst.ReasonOnboardingClusterInteractionProblem)
 					return rr
 				}
@@ -301,7 +298,7 @@ func (r *ClusterScheduler) reconcile(ctx context.Context, log logging.Logger, re
 			}
 
 			// create Cluster resource
-			if err := r.OnboardingCluster.Client().Create(ctx, cluster); err != nil {
+			if err := r.PlatformCluster.Client().Create(ctx, cluster); err != nil {
 				if apierrors.IsAlreadyExists(err) {
 					rr.ReconcileError = errutils.WithReason(fmt.Errorf("Cluster '%s/%s' already exists, this is not supposed to happen", cluster.Namespace, cluster.Name), cconst.ReasonInternalError)
 					return rr
@@ -324,7 +321,7 @@ func (r *ClusterScheduler) reconcile(ctx context.Context, log logging.Logger, re
 		// fetch all clusters and filter for the ones that have a finalizer from this request
 		fin := cr.FinalizerForCluster()
 		clusterList := &clustersv1alpha1.ClusterList{}
-		if err := r.OnboardingCluster.Client().List(ctx, clusterList, client.MatchingLabelsSelector{Selector: r.Config.CompletedSelectors.Clusters}); err != nil {
+		if err := r.PlatformCluster.Client().List(ctx, clusterList, client.MatchingLabelsSelector{Selector: r.Config.CompletedSelectors.Clusters}); err != nil {
 			rr.ReconcileError = errutils.WithReason(fmt.Errorf("error listing Clusters: %w", err), cconst.ReasonOnboardingClusterInteractionProblem)
 			return rr
 		}
@@ -346,7 +343,7 @@ func (r *ClusterScheduler) reconcile(ctx context.Context, log logging.Logger, re
 			log.Debug("Removing finalizer from cluster", "clusterName", c.Name, "clusterNamespace", c.Namespace, "finalizer", fin)
 			oldCluster := c.DeepCopy()
 			if controllerutil.RemoveFinalizer(c, fin) {
-				if err := r.OnboardingCluster.Client().Patch(ctx, c, client.MergeFrom(oldCluster)); err != nil {
+				if err := r.PlatformCluster.Client().Patch(ctx, c, client.MergeFrom(oldCluster)); err != nil {
 					errs.Append(errutils.WithReason(fmt.Errorf("error patching finalizer '%s' on cluster '%s/%s': %w", fin, c.Namespace, c.Name, err), cconst.ReasonOnboardingClusterInteractionProblem))
 				}
 			}
@@ -359,7 +356,7 @@ func (r *ClusterScheduler) reconcile(ctx context.Context, log logging.Logger, re
 		// remove finalizer
 		if controllerutil.RemoveFinalizer(cr, clustersv1alpha1.ClusterRequestFinalizer) {
 			log.Info("Removing finalizer")
-			if err := r.OnboardingCluster.Client().Patch(ctx, cr, client.MergeFrom(rr.OldObject)); err != nil {
+			if err := r.PlatformCluster.Client().Patch(ctx, cr, client.MergeFrom(rr.OldObject)); err != nil {
 				rr.ReconcileError = errutils.WithReason(fmt.Errorf("error patching finalizer on resource '%s': %w", req.NamespacedName.String(), err), cconst.ReasonOnboardingClusterInteractionProblem)
 				return rr
 			}
@@ -374,11 +371,9 @@ func (r *ClusterScheduler) reconcile(ctx context.Context, log logging.Logger, re
 // SetupWithManager sets up the controller with the Manager.
 func (r *ClusterScheduler) SetupWithManager(mgr ctrl.Manager) error {
 	return ctrl.NewControllerManagedBy(mgr).
-		Named("clusterrequest").
 		// watch ClusterRequest resources
-		WatchesRawSource(source.Kind(r.OnboardingCluster.Cluster().GetCache(), &clustersv1alpha1.ClusterRequest{}, handler.TypedEnqueueRequestsFromMapFunc(func(ctx context.Context, ls *clustersv1alpha1.ClusterRequest) []ctrl.Request {
-			return []ctrl.Request{testutils.RequestFromObject(ls)}
-		}), ctrlutils.ToTypedPredicate[*clustersv1alpha1.ClusterRequest](predicate.And(
+		For(&clustersv1alpha1.ClusterRequest{}).
+		WithEventFilter(predicate.And(
 			ctrlutils.LabelSelectorPredicate(r.Config.CompletedSelectors.ClusterRequests),
 			predicate.Or(
 				predicate.GenerationChangedPredicate{},
@@ -388,6 +383,6 @@ func (r *ClusterScheduler) SetupWithManager(mgr ctrl.Manager) error {
 			predicate.Not(
 				ctrlutils.HasAnnotationPredicate(clustersv1alpha1.OperationAnnotation, clustersv1alpha1.OperationAnnotationValueIgnore),
 			),
-		)))).
+		)).
 		Complete(r)
 }

Original file line number	Diff line number	Diff line change
`@@ -287,7 +287,7 @@ func (o *RunOptions) Run(ctx context.Context) error {`
`287`	`287`
`288`	`288`	`// setup cluster scheduler`
`289`	`289`	`if slices.Contains(o.Controllers, strings.ToLower(scheduler.ControllerName)) {`
`290`		`- sc, err := scheduler.NewClusterScheduler(&setupLog, o.Clusters.Onboarding, o.Config.Scheduler)`
	`290`	`+ sc, err := scheduler.NewClusterScheduler(&setupLog, o.Clusters.Platform, o.Config.Scheduler)`
`291`	`291`	`if err != nil {`
`292`	`292`	`return fmt.Errorf("unable to initialize cluster scheduler: %w", err)`
`293`	`293`	`}`