feat(openstack-sync): full CRUD plugin for Neutron router flavors

components/openstack-sync-operator/crds/neutron.understack.rackspace.net_neutronrouterflavors.yaml

@@ -24,9 +24,9 @@ spec:
     - name: ServiceType
       type: string
       jsonPath: .spec.service_type
-    - name: Driver
-      type: string
-      jsonPath: .spec.driver
+    - name: Enabled
+      type: boolean
+      jsonPath: .spec.is_enabled
     - name: SyncStatus
       type: string
       jsonPath: .status.syncStatus
@@ -35,7 +35,13 @@ spec:
       jsonPath: .metadata.creationTimestamp
     schema:
       openAPIV3Schema:
-        description: NeutronRouterFlavor defines one Neutron router flavor and its service profile.
+        description: >-
+          NeutronRouterFlavor defines one Neutron router flavor and the
+          service profiles bound to it. Neutron supports many-to-one from
+          flavor to service_profile, so ``spec.service_profiles`` is a
+          list of profile specs. The operator find-or-creates each profile
+          by ``(driver, meta_info)`` and reconciles the flavor's set of
+          bound profiles to match.
         type: object
         required:
         - spec
@@ -50,14 +56,14 @@ spec:
             type: object
             required:
             - name
-            - driver
+            - service_profiles
             - cloudCredentialsRef
             properties:
               cloudCredentialsRef:
                 description: >-
                   cloudCredentialsRef points to a Kubernetes Secret containing
                   an OpenStack clouds.yaml file. The operator reads this secret
-                  directly at reconcile time — no volume mount is required.
+                  directly at reconcile time; no volume mount is required.
                 type: object
                 required:
                 - secretName
@@ -85,54 +91,73 @@ spec:
                 maxLength: 255
                 pattern: ^[A-Za-z0-9._-]+$
               service_type:
-                description: Neutron service type for the flavor.
+                description: >-
+                  Neutron service type for the flavor. For router flavors this
+                  is always L3_ROUTER_NAT (plugin_constants.L3 in neutron-lib).
                 type: string
                 enum:
                 - L3_ROUTER_NAT
                 minLength: 1
                 maxLength: 255
                 default: L3_ROUTER_NAT
-              service_provider:
-                description: Optional Neutron service provider name used when generating Neutron configuration.
-                type: string
-                minLength: 1
-                maxLength: 255
-                pattern: ^[A-Za-z0-9._-]+$
+              is_enabled:
+                description: >-
+                  Whether the Neutron router flavor is enabled. The operator
+                  reconciles drift toward this value, so setting it to false
+                  disables an operator-managed flavor without deleting it.
+                type: boolean
+                default: true
               description:
                 description: Description stored on the Neutron router flavor.
                 type: string
                 maxLength: 1024
-              driver:
-                description: Service profile driver class.
-                type: string
-                minLength: 1
-                maxLength: 1024
-                pattern: ^[A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*)+$
-              profile_description:
-                description: Description stored on the Neutron service profile.
-                type: string
-                maxLength: 1024
-              profile_id:
-                description: Existing Neutron service profile ID to attach instead of creating or discovering one.
-                type: string
-                format: uuid
-              meta_info:
-                description: Service profile metainfo payload.
-                type: object
-                properties:
-                  resource_class:
-                    description: Resource class consumed by a physical router provider.
-                    type: string
-                    minLength: 1
-                    maxLength: 255
-                    pattern: ^[A-Za-z0-9._:-]+$
-                  vni_alloc:
-                    description: VNI allocation mode for VRF router providers.
-                    type: string
-                    enum:
-                    - "off"
-                    - "on"
-                    - auto
+              service_profiles:
+                description: >-
+                  Service profiles to associate with this flavor. Neutron
+                  supports multiple profiles per flavor and the operator
+                  reconciles the full set: profiles listed here are
+                  find-or-created and associated, and any operator-managed
+                  profile currently attached to the flavor but absent from
+                  this list is disassociated. Unmanaged profiles attached
+                  out-of-band are left untouched.
+                type: array
+                minItems: 1
+                items:
+                  type: object
+                  required:
+                  - driver
+                  properties:
+                    driver:
+                      description: Service profile driver class.
+                      type: string
+                      minLength: 1
+                      maxLength: 1024
+                      pattern: ^[A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*)+$
+                    description:
+                      description: Description stored on the Neutron service profile.
+                      type: string
+                      maxLength: 1024
+                    is_enabled:
+                      description: Whether the service profile is enabled in Neutron.
+                      type: boolean
+                      default: true
+                    meta_info:
+                      description: Service profile metadata payload.
+                      type: object
+                      properties:
+                        resource_class:
+                          description: Resource class consumed by a physical router provider.
+                          type: string
+                          minLength: 1
+                          maxLength: 255
+                          pattern: ^[A-Za-z0-9._:-]+$
+                        vni_alloc:
+                          description: VNI allocation mode for VRF router providers.
+                          type: string
+                          enum:
+                          - "off"
+                          - "on"
+                          - auto
           status:
             description: NeutronRouterFlavorStatus defines the observed sync state.
             type: object

components/openstack-sync-operator/examples/extra-rbac-rules-values.yaml

@@ -0,0 +1,39 @@
+# Example values override for a future plugin that needs Kubernetes resources
+# outside the chart-generated defaults.
+#
+# Use with:
+#   helm template openstack-sync-operator ../ -f extra-rbac-rules-values.yaml
+#
+# Default RBAC
+# ------------
+# Without rbac.rules, the chart generates the permissions it can infer:
+#
+# 1. Secret read access, always:
+#      apiGroups: [""]
+#      resources: ["secrets"]
+#      verbs: ["get"]
+#
+# 2. For each enabled plugin, CRD read/watch access from pluginData.<name>.hook.crd:
+#      verbs: ["get", "list", "watch"]
+#
+# 3. For each enabled plugin whose CRD defines a status subresource:
+#      resources: ["<plural>/status"]
+#      verbs: ["get", "patch", "update"]
+#
+# For example, enabling plugins.neutronRouterFlavors adds access to:
+#   - neutronrouterflavors
+#   - neutronrouterflavors/status
+#
+# Extra RBAC
+# ----------
+# rbac.rules is only for resources the chart cannot infer from plugin CRDs.
+# Each item is appended verbatim to the generated Role or ClusterRole.
+#
+# When rbac.clusterWide is false, these rules go into a namespaced Role.
+# When rbac.clusterWide is true, these rules go into a ClusterRole.
+
+rbac:
+  rules:
+    - apiGroups: [""]
+      resources: ["configmaps"]
+      verbs: ["get", "list", "watch"]

components/openstack-sync-operator/templates/_crd.tpl

@@ -7,19 +7,19 @@ Read hook CRD metadata used by RBAC and shell-operator environment wiring.
 {{- $hook := index . 2 -}}
 {{- $crdPath := get $hook "crd" -}}
 {{- if not $crdPath -}}
-{{- fail (printf "hooks.%s.crd is required for CRD metadata" $hookName) -}}
+{{- fail (printf "pluginData.%s.hook.crd is required for CRD metadata" $hookName) -}}
 {{- end -}}
-{{- $crdYaml := required (printf "hooks.%s.crd file %s is empty or missing" $hookName $crdPath) ($root.Files.Get $crdPath) -}}
+{{- $crdYaml := required (printf "pluginData.%s.hook.crd file %s is empty or missing" $hookName $crdPath) ($root.Files.Get $crdPath) -}}
 {{- $crd := fromYaml $crdYaml -}}
 {{- if ne $crd.kind "CustomResourceDefinition" -}}
-{{- fail (printf "hooks.%s.crd must point to a CustomResourceDefinition" $hookName) -}}
+{{- fail (printf "pluginData.%s.hook.crd must point to a CustomResourceDefinition" $hookName) -}}
 {{- end -}}
-{{- $group := required (printf "hooks.%s.crd spec.group is required" $hookName) $crd.spec.group -}}
-{{- $kind := required (printf "hooks.%s.crd spec.names.kind is required" $hookName) $crd.spec.names.kind -}}
-{{- $plural := required (printf "hooks.%s.crd spec.names.plural is required" $hookName) $crd.spec.names.plural -}}
+{{- $group := required (printf "pluginData.%s.hook.crd spec.group is required" $hookName) $crd.spec.group -}}
+{{- $kind := required (printf "pluginData.%s.hook.crd spec.names.kind is required" $hookName) $crd.spec.names.kind -}}
+{{- $plural := required (printf "pluginData.%s.hook.crd spec.names.plural is required" $hookName) $crd.spec.names.plural -}}
 {{- $storageVersion := "" -}}
 {{- $hasStatus := false -}}
-{{- range $version := required (printf "hooks.%s.crd spec.versions is required" $hookName) $crd.spec.versions }}
+{{- range $version := required (printf "pluginData.%s.hook.crd spec.versions is required" $hookName) $crd.spec.versions }}
 {{- if $version.storage -}}
 {{- $storageVersion = $version.name -}}
 {{- end -}}
@@ -28,7 +28,7 @@ Read hook CRD metadata used by RBAC and shell-operator environment wiring.
 {{- end -}}
 {{- end -}}
 {{- if not $storageVersion -}}
-{{- fail (printf "hooks.%s.crd must define a storage version" $hookName) -}}
+{{- fail (printf "pluginData.%s.hook.crd must define a storage version" $hookName) -}}
 {{- end -}}
 {{- dict
   "apiVersion" (printf "%s/%s" $group $storageVersion)

components/openstack-sync-operator/templates/_helpers.tpl

@@ -69,7 +69,7 @@ required because shell-operator reads hook watches only when the pod starts.
 {{- end }}
 
 {{/*
-Normalize built-in plugin hooks and direct hook definitions.
+Normalize built-in plugin hooks.
 */}}
 {{- define "openstack-sync-operator.configuredHooks" -}}
 {{- $hooks := dict -}}
@@ -91,8 +91,5 @@ Normalize built-in plugin hooks and direct hook definitions.
 {{- $_2 := set $hooks $pluginName $hookValues -}}
 {{- end -}}
 {{- end -}}
-{{- range $hookName, $hook := default dict .Values.hooks -}}
-{{- $_ := set $hooks $hookName $hook -}}
-{{- end -}}
 {{- $hooks | toYaml -}}
 {{- end }}

components/openstack-sync-operator/templates/deployment.yaml.tpl

@@ -27,6 +27,13 @@
 {{- end }}
 {{- end }}
 {{- end -}}
+{{- $operatorEnv := dict "LOG_LEVEL" "info" -}}
+{{- range $envName, $envValue := default dict .Values.env }}
+{{- if hasKey $hookEnv $envName }}
+{{- fail (printf "duplicate operator environment variable %s" $envName) }}
+{{- end }}
+{{- $_ = set $operatorEnv $envName $envValue -}}
+{{- end }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -65,7 +72,7 @@ spec:
         - |
           missing=0
           {{- range $hookName, $hook := $enabledHooks }}
-          {{- $hookPath := required (printf "hooks.%s.path is required when hook is enabled" $hookName) $hook.path }}
+          {{- $hookPath := required (printf "pluginData.%s.hook.path is required when hook is enabled" $hookName) $hook.path }}
           if [ ! -x {{ $hookPath | quote }} ]; then
             echo {{ printf "enabled hook %s missing or not executable: %s" $hookName $hookPath | quote }} >&2
             missing=1
@@ -104,6 +111,10 @@ spec:
         - name: {{ $envName }}
           value: {{ get $hookEnv $envName | quote }}
         {{- end }}
+        {{- range $envName := keys $operatorEnv | sortAlpha }}
+        - name: {{ $envName }}
+          value: {{ get $operatorEnv $envName | quote }}
+        {{- end }}
         {{- with .Values.resources }}
         resources:
           {{- toYaml . | nindent 12 }}