Support external LINSTOR Controllers

CHANGELOG.md

@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- Ability to skip deploying the LINSTOR Controller by setting `LinstorCluster.spec.externalController`.
+
 ## [v2.0.1] - 2023-03-08
 
 ### Added

api/v1/linstorcluster_types.go

@@ -27,6 +27,12 @@ type LinstorClusterSpec struct {
 	// +kubebuilder:validation:Optional
 	Repository string `json:"repository,omitempty"`
 
+	// ExternalController references an external controller.
+	// When set, the Operator will skip deploying a LINSTOR Controller and instead use the external cluster
+	// to register satellites.
+	// +kubebuilder:validation:Optional
+	ExternalController *LinstorExternalControllerRef `json:"externalController,omitempty"`
+
 	// NodeSelector selects the nodes on which LINSTOR Satellites will be deployed.
 	// See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
 	// +kubebuilder:validation:Optional
@@ -76,6 +82,12 @@ type LinstorClusterSpec struct {
 	ApiTLS *LinstorClusterApiTLS `json:"apiTLS,omitempty"`
 }
 
+type LinstorExternalControllerRef struct {
+	// URL of the external controller.
+	//+kubebuilder:validation:MinLength=3
+	URL string `json:"url"`
+}
+
 type LinstorClusterApiTLS struct {
 	// ApiSecretName references a secret holding the TLS key and certificate used to protect the API.
 	// Defaults to "linstor-api-tls".

api/v1/linstorcluster_webhook.go

@@ -17,6 +17,7 @@ limitations under the License.
 package v1
 
 import (
+	"net/url"
 	"strconv"
 
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
@@ -72,11 +73,25 @@ func (r *LinstorCluster) ValidateDelete() error {
 }
 
 func (r *LinstorCluster) validate(old *LinstorCluster) field.ErrorList {
-	errs := ValidateNodeSelector(r.Spec.NodeSelector, field.NewPath("spec", "nodeSelector"))
+	errs := ValidateExternalController(r.Spec.ExternalController, field.NewPath("spec", "externalController"))
+	errs = append(errs, ValidateNodeSelector(r.Spec.NodeSelector, field.NewPath("spec", "nodeSelector"))...)
 	errs = append(errs, ValidateControllerProperties(r.Spec.Properties, field.NewPath("spec", "properties"))...)
 	for i := range r.Spec.Patches {
 		errs = append(errs, r.Spec.Patches[i].validate(field.NewPath("spec", "patches", strconv.Itoa(i)))...)
 	}
 
 	return errs
 }
+
+func ValidateExternalController(ref *LinstorExternalControllerRef, path *field.Path) field.ErrorList {
+	var result field.ErrorList
+
+	if ref != nil {
+		_, err := url.Parse(ref.URL)
+		if err != nil {
+			result = append(result, field.Invalid(path.Child("url"), ref.URL, err.Error()))
+		}
+	}
+
+	return result
+}

api/v1/linstorcluster_webhook_test.go

@@ -104,4 +104,18 @@ var _ = Describe("LinstorCluster webhook", func() {
 		Expect(statusErr.ErrStatus.Details).NotTo(BeNil())
 		Expect(statusErr.ErrStatus.Details.Causes).To(HaveLen(2))
 	})
+
+	It("should reject invalid external URLs", func(ctx context.Context) {
+		clusterConfig := &piraeusv1.LinstorCluster{
+			TypeMeta:   typeMeta,
+			ObjectMeta: metav1.ObjectMeta{Name: "invalid-labels"},
+			Spec: piraeusv1.LinstorClusterSpec{
+				ExternalController: &piraeusv1.LinstorExternalControllerRef{
+					URL: ":::///&&aabb",
+				},
+			},
+		}
+		err := k8sClient.Patch(ctx, clusterConfig, client.Apply, client.FieldOwner("test"), client.ForceOwnership)
+		Expect(err).To(HaveOccurred())
+	})
 })

api/v1/linstorsatellite_types.go

@@ -72,6 +72,11 @@ type ClusterReference struct {
 
 	// ClientSecretName references the secret used by the operator to validate the https endpoint.
 	ClientSecretName string `json:"clientSecretName,omitempty"`
+
+	// ExternalController references an external controller.
+	// When set, the Operator uses the external cluster to register satellites.
+	// +kubebuilder:validation:Optional
+	ExternalController *LinstorExternalControllerRef `json:"externalController,omitempty"`
 }
 
 // LinstorSatellite is the Schema for the linstorsatellites API

api/v1/linstorsatellite_webhook.go

@@ -77,7 +77,8 @@ func (r *LinstorSatellite) validate(old *LinstorSatellite) field.ErrorList {
 		oldSPs = old.Spec.StoragePools
 	}
 
-	errs := ValidateStoragePools(r.Spec.StoragePools, oldSPs, field.NewPath("spec", "storagePools"))
+	errs := ValidateExternalController(r.Spec.ClusterRef.ExternalController, field.NewPath("spec", "clusterRef", "externalController"))
+	errs = append(errs, ValidateStoragePools(r.Spec.StoragePools, oldSPs, field.NewPath("spec", "storagePools"))...)
 	errs = append(errs, ValidateNodeProperties(r.Spec.Properties, field.NewPath("spec", "properties"))...)
 	for i := range r.Spec.Patches {
 		errs = append(errs, r.Spec.Patches[i].validate(field.NewPath("spec", "patches", strconv.Itoa(i)))...)

charts/piraeus/templates/crds.yaml

@@ -79,6 +79,18 @@ spec:
                       state. Defaults to "linstor-csi-node-tls".
                     type: string
                 type: object
+              externalController:
+                description: ExternalController references an external controller.
+                  When set, the Operator will skip deploying a LINSTOR Controller
+                  and instead use the external cluster to register satellites.
+                properties:
+                  url:
+                    description: URL of the external controller.
+                    minLength: 3
+                    type: string
+                required:
+                - url
+                type: object
               internalTLS:
                 description: "InternalTLS secures the connection between LINSTOR Controller
                   and Satellite. \n This configures the client certificate used when
@@ -658,6 +670,18 @@ spec:
                     description: ClientSecretName references the secret used by the
                       operator to validate the https endpoint.
                     type: string
+                  externalController:
+                    description: ExternalController references an external controller.
+                      When set, the Operator uses the external cluster to register
+                      satellites.
+                    properties:
+                      url:
+                        description: URL of the external controller.
+                        minLength: 3
+                        type: string
+                    required:
+                    - url
+                    type: object
                   name:
                     description: Name of the LinstorCluster resource controlling this
                       satellite.

config/crd/bases/piraeus.io_linstorclusters.yaml

@@ -78,6 +78,18 @@ spec:
                       state. Defaults to "linstor-csi-node-tls".
                     type: string
                 type: object
+              externalController:
+                description: ExternalController references an external controller.
+                  When set, the Operator will skip deploying a LINSTOR Controller
+                  and instead use the external cluster to register satellites.
+                properties:
+                  url:
+                    description: URL of the external controller.
+                    minLength: 3
+                    type: string
+                required:
+                - url
+                type: object
               internalTLS:
                 description: "InternalTLS secures the connection between LINSTOR Controller
                   and Satellite. \n This configures the client certificate used when

config/crd/bases/piraeus.io_linstorsatellites.yaml

@@ -43,6 +43,18 @@ spec:
                     description: ClientSecretName references the secret used by the
                       operator to validate the https endpoint.
                     type: string
+                  externalController:
+                    description: ExternalController references an external controller.
+                      When set, the Operator uses the external cluster to register
+                      satellites.
+                    properties:
+                      url:
+                        description: URL of the external controller.
+                        minLength: 3
+                        type: string
+                    required:
+                    - url
+                    type: object
                   name:
                     description: Name of the LinstorCluster resource controlling this
                       satellite.

controllers/linstorcluster_controller.go

@@ -292,6 +292,10 @@ func (r *LinstorClusterReconciler) kustomizeResources(lcluster *piraeusiov1.Lins
 // * pull secret (if any)
 // * user defined patches
 func (r *LinstorClusterReconciler) kustomizeControllerResources(lcluster *piraeusiov1.LinstorCluster) (resmap.ResMap, error) {
+	if lcluster.Spec.ExternalController != nil {
+		return resmap.New(), nil
+	}
+
 	var patches []kusttypes.Patch
 	resourceDirs := []string{"controller"}
 
@@ -383,6 +387,13 @@ func (r *LinstorClusterReconciler) kustomizeCsiResources(lcluster *piraeusiov1.L
 		return nil, err
 	}
 
+	endpointPatches, err := ClusterApiEndpointPatch(LinstorControllerUrl(lcluster))
+	if err != nil {
+		return nil, err
+	}
+
+	patches = append(patches, endpointPatches...)
+
 	if lcluster.Spec.ApiTLS != nil {
 		controllerSecret := lcluster.Spec.ApiTLS.GetCsiControllerSecretName()
 		nodeSecret := lcluster.Spec.ApiTLS.GetCsiNodeSecretName()
@@ -478,8 +489,9 @@ func (r *LinstorClusterReconciler) kustomizeLinstorSatellite(lcluster *piraeusio
 		Op:   utils.Replace,
 		Path: "/spec/clusterRef",
 		Value: &piraeusiov1.ClusterReference{
-			Name:             lcluster.Name,
-			ClientSecretName: clientSecret,
+			Name:               lcluster.Name,
+			ClientSecretName:   clientSecret,
+			ExternalController: lcluster.Spec.ExternalController,
 		},
 	}
 
@@ -589,6 +601,7 @@ func (r *LinstorClusterReconciler) reconcileClusterState(ctx context.Context, lc
 		r.Namespace,
 		lcluster.Name,
 		clientSecret,
+		lcluster.Spec.ExternalController,
 		linstorhelper.Logr(log.FromContext(ctx)),
 	)
 	if err != nil || lc == nil {
@@ -606,7 +619,7 @@ func (r *LinstorClusterReconciler) reconcileClusterState(ctx context.Context, lc
 		return err
 	}
 
-	conds.AddSuccess(conditions.Available, fmt.Sprintf("Deployed Controller %s (API: %s, Git: %s)", version.Version, version.RestApiVersion, version.GitHash))
+	conds.AddSuccess(conditions.Available, fmt.Sprintf("Controller %s (API: %s, Git: %s) reachable at '%s'", version.Version, version.RestApiVersion, version.GitHash, lc.BaseURL()))
 
 	current, err := lc.Controller.GetProps(ctx)
 	if err != nil {
@@ -736,6 +749,18 @@ func PodReady(pod *corev1.Pod) bool {
 	return false
 }
 
+func LinstorControllerUrl(cluster *piraeusiov1.LinstorCluster) string {
+	if cluster.Spec.ExternalController != nil {
+		return cluster.Spec.ExternalController.URL
+	}
+
+	if cluster.Spec.ApiTLS != nil {
+		return "https://linstor-controller:3371"
+	}
+
+	return "http://linstor-controller:3370"
+}
+
 // SetupWithManager sets up the controller with the Manager.
 func (r *LinstorClusterReconciler) SetupWithManager(mgr ctrl.Manager, opts controller.Options) error {
 	kustomizer, err := resources.NewKustomizer(&cluster.Resources, krusty.MakeDefaultOptions())

controllers/linstorcluster_test.go

@@ -266,6 +266,45 @@ var _ = Describe("LinstorCluster controller", func() {
 		}, DefaultTimeout, DefaultCheckInterval).Should(Succeed())
 	})
 
+	It("should not deploy a controller when using external controller ref", func(ctx context.Context) {
+		DeferCleanup(func(ctx context.Context) {
+			err := k8sClient.DeleteAllOf(ctx, &piraeusiov1.LinstorCluster{})
+			Expect(err).NotTo(HaveOccurred())
+		})
+
+		err := k8sClient.Create(ctx, &piraeusiov1.LinstorCluster{
+			ObjectMeta: metav1.ObjectMeta{Name: "default"},
+			Spec: piraeusiov1.LinstorClusterSpec{
+				ExternalController: &piraeusiov1.LinstorExternalControllerRef{
+					URL: "http://linstor-controller.invalid:3370",
+				},
+			},
+		})
+		Expect(err).NotTo(HaveOccurred())
+
+		Eventually(func(g Gomega) {
+			var csiControllerDeployment appsv1.Deployment
+			err := k8sClient.Get(ctx, types.NamespacedName{Name: "linstor-csi-controller", Namespace: Namespace}, &csiControllerDeployment)
+			g.Expect(err).NotTo(HaveOccurred())
+			container := GetContainer(csiControllerDeployment.Spec.Template.Spec.Containers, "linstor-csi")
+			g.Expect(container).NotTo(BeNil())
+			g.Expect(container.Env[0]).To(Equal(corev1.EnvVar{Name: "LS_CONTROLLERS", Value: "http://linstor-controller.invalid:3370"}))
+		}, DefaultTimeout, DefaultCheckInterval).Should(Succeed())
+
+		Eventually(func(g Gomega) {
+			var csiDaemonSet appsv1.DaemonSet
+			err := k8sClient.Get(ctx, types.NamespacedName{Name: "linstor-csi-node", Namespace: Namespace}, &csiDaemonSet)
+			g.Expect(err).NotTo(HaveOccurred())
+			container := GetContainer(csiDaemonSet.Spec.Template.Spec.Containers, "linstor-csi")
+			g.Expect(container).NotTo(BeNil())
+			g.Expect(container.Env[0]).To(Equal(corev1.EnvVar{Name: "LS_CONTROLLERS", Value: "http://linstor-controller.invalid:3370"}))
+		}, DefaultTimeout, DefaultCheckInterval).Should(Succeed())
+
+		var controllerDeployment appsv1.Deployment
+		err = k8sClient.Get(ctx, types.NamespacedName{Name: "linstor-controller", Namespace: Namespace}, &controllerDeployment)
+		Expect(err).NotTo(BeNil())
+	})
+
 	It("should add TLS secrets to the LINSTOR Components, configuring HTTPS access", func(ctx context.Context) {
 		DeferCleanup(func(ctx context.Context) {
 			err := k8sClient.DeleteAllOf(ctx, &piraeusiov1.LinstorCluster{})

controllers/linstorsatellite_controller.go

@@ -280,6 +280,7 @@ func (r *LinstorSatelliteReconciler) reconcileLinstorSatelliteState(ctx context.
 		r.Namespace,
 		lsatellite.Spec.ClusterRef.Name,
 		lsatellite.Spec.ClusterRef.ClientSecretName,
+		lsatellite.Spec.ClusterRef.ExternalController,
 		linstorhelper.Logr(log.FromContext(ctx)),
 	)
 	if err != nil || lc == nil {
@@ -480,6 +481,7 @@ func (r *LinstorSatelliteReconciler) deleteSatellite(ctx context.Context, lsatel
 		r.Namespace,
 		lsatellite.Spec.ClusterRef.Name,
 		lsatellite.Spec.ClusterRef.ClientSecretName,
+		lsatellite.Spec.ClusterRef.ExternalController,
 		linstorhelper.Logr(log.FromContext(ctx)),
 	)
 	if err != nil {

controllers/patches.go

@@ -85,6 +85,15 @@ func ClusterApiTLSCertManagerPatch(secretName string, issuer *cmmetav1.ObjectRef
 		})
 }
 
+func ClusterApiEndpointPatch(url string) ([]kusttypes.Patch, error) {
+	return render(
+		cluster.Resources,
+		"patches/api-endpoint.yaml",
+		map[string]any{
+			"LINSTOR_CONTROLLER_URL": url,
+		})
+}
+
 func ClusterCSIApiTLSPatch(controllerSecret, nodeSecret string) ([]kusttypes.Patch, error) {
 	return render(
 		cluster.Resources,