Implements User controller #368

stefanhipfel · 2025-06-12T12:42:10Z

Proposed Changes

Implement User controller which handles the creation of user accounts in a bmc

…d webhook and validation logic

internal/controller/bmcuser_controller.go

api/v1alpha1/bmc_types.go

nagadeesh-nagaraja · 2025-11-17T10:49:36Z

internal/controller/user_controller.go

+	// Add this check once we use the user CRD also for BMC admin users
+	/*if bmcObj.Spec.AdminUserRef == nil {
+		return ctrl.Result{}, fmt.Errorf("BMC %s does not have an admin user reference set", bmcObj.Name)
+	}
+	*/


can be removed?

nagadeesh-nagaraja · 2025-11-17T10:53:17Z

internal/controller/user_controller.go

+		}, nil
+	}
+	log.Info("Rotating BMC user password", "User", user.Name)
+	newPassword, err := GenerateRandomPassword(16)


vendors have very complicated requirement for the password generation, ideally we would like to expose it as a spec....
length, special char, and numbers etc.

I have added a vendor specific password generation

nagadeesh-nagaraja · 2025-11-17T10:55:08Z

internal/controller/bmcuser_controller.go

+
+	invalidCredentials, err := r.bmcConnectionTest(secret, bmcObj)
+	if err != nil {
+		return fmt.Errorf("failed to test BMC connection with BMCSecret %s: %w", secret.Name, err)


Should enter a failed state at this point?

we do not have this state yet defined for the User CRD in our architecture.
Maybe we should think about adding an error state

api/v1alpha1/user_types.go

internal/controller/user_controller.go

nagadeesh-nagaraja · 2025-11-17T11:21:54Z

internal/controller/user_controller.go

+	log.V(1).Info("Deleting User", "User", user.Name)
+	if user.Status.EffectiveBMCSecretRef != nil {
+		log.V(1).Info("Removing effective BMCSecret reference from User", "User", user.Name)
+		if err := r.removeEffectiveSecret(ctx, log, user); err != nil {


why is this necessary? wont it get deleted as the resource creating it is anyway deleted?

if we want to delete it, we should delete the BMC Secret ref from Spec which we created, along with the Ref in status

I forgot to comment out the delete function call, since we did not decide if the controller should also remove users on CRD deletion.
It kind of makes sense to do it, but what if that user was the metal-operators admin user?! maybe an immutable flag is needed for those kind of users

nagadeesh-nagaraja · 2025-11-17T11:41:50Z

internal/controller/user_controller.go

+	return nil
+}
+
+func (r *UserReconciler) handleRotatingPassword(ctx context.Context, log logr.Logger, user *metalv1alpha1.User, bmcClient bmc.BMC) (ctrl.Result, error) {


just a proposal
Why dont we off load the password rotation to the bmcSecret?
something in line of:
if bmcSecretRef is provided in Spec. password rotation is enabled.
EffectiveBMCSecretRef is a seperate BMCSecretRef object ( so we will have two secret) (we copy the content when we call updateEffectiveSecret, instead patching with of local obj ref)
if someone patches bmcSecretRef with new password....
we check if password is changed....
it has not changed if status effectiveBMCSecretRef password matches with BMCSpecRef and the name of both the secret are same.

if spec bmcSecretRef password is changed, we issue a update of password to BMC and then sync the status and spec..
that way user resource does not have to worry about the password rotation directly... someone else will patch the BMCSecret Ref with new password ( in our case, we will sync with vault)...and password will be rotated automatically..

hm the rotation can also be triggered by the BMC password policy or an annotation via User CRD.

Currently someone else just sets a new bmcSecretRef on the user and password will be rotated. Only if the rotation on BMC was successful the EffectiveSecretRef will be updated. I think that should stay with the user CRD.

internal/webhook/v1alpha1/bmcsecret_webhook_test.go

internal/webhook/v1alpha1/bmcsecret_webhook.go

…ccounts - Implemented GetAccountService method in the BMC interface. - Updated user controller to utilize the new GetAccountService method for password generation. - Added secure password generation logic with vendor-specific constraints. - Updated tests to verify password length against the maximum allowed length.

…ic, and improve webhook validation tests

…letion and account management

bmc/redfish_local.go

Nuckal777

Thanks, PR still needs some cleanup though.

bmc/redfish.go

Nuckal777 · 2025-12-02T13:50:25Z

bmc/redfish.go

+	for _, a := range accounts {
+		// make sure we delete the correct account
+		if a.UserName == userName && a.ID == id {
+			service.PostWithResponse(a.ODataID, nil) // nolint: errcheck


Why do we ignore the return values? Besides the err being silently dropped, the docs of the PostWithResponse function suggest that the response body needs to be closed by us.

config/rbac/account_editor_role.yaml

config/rbac/account_viewer_role.yaml

config/samples/metal_v1alpha1_account.yaml

dist/chart/templates/rbac/account_editor_role.yaml

dist/chart/templates/rbac/account_viewer_role.yaml

config/samples/metal_v1alpha1_bmcuser.yaml

Nuckal777 · 2025-12-02T14:07:19Z

dist/chart/templates/crd/metal.ironcore.dev_users.yaml

@@ -0,0 +1,130 @@
+{{- if .Values.crd.enable }}


Is this file a leftover?

internal/controller/bmcuser_controller.go

…ated references; remove unused RBAC roles and sample configurations

nagadeesh-nagaraja · 2025-12-23T10:11:10Z

bmc/redfish.go

+}
+
+// Vendor-specific constraints map.
+var manufacturerPasswordConfigs = map[Manufacturer]ManufacturerPasswordConfig{


for future improvement. this needs to be changeable (in config map, or a user input spec) as this changes based on some settings and preference.

nagadeesh-nagaraja · 2025-12-23T10:12:26Z

bmc/redfish_local.go

improvement for next PR: we need to move these to our mock server setup.

nagadeesh-nagaraja · 2025-12-23T10:14:51Z

api/v1alpha1/bmcuser_types.go

+	RotationPeriod *metav1.Duration `json:"rotationPeriod,omitempty"`
+	// if not set, the operator will generate a secure password based on BMC manufacturer requirements.
+	BMCSecretRef *v1.LocalObjectReference `json:"bmcSecretRef,omitempty"`
+	BMCRef       *v1.LocalObjectReference `json:"bmcRef,omitempty"`


can add kubebuilder validation to be not nil?

stefanhipfel added 5 commits March 10, 2025 10:12

account types

8cea054

adds accounts

0298ade

Refactor account handling to use 'User' terminology and update relate…

a8882d4

…d webhook and validation logic

Merge branch 'main' into accounts

d32698f

Implement user account management and update webhook configurations

a2a77cb

github-project-automation bot added this to Roadmap Jun 12, 2025

github-actions bot added size/XXL api-change labels Jun 12, 2025

Merge branch 'main' into accounts

26d9bb8

afritzler added this to the v0.1 milestone Jun 25, 2025

hardikdr added the area/metal-automation label Jun 25, 2025

Merge branch 'main' into accounts

d29eb01

stefanhipfel marked this pull request as ready for review July 9, 2025 08:55

stefanhipfel requested review from Nuckal777 and afritzler July 9, 2025 08:55

make docs && make helm

3ea85d2

github-actions bot added the documentation Improvements or additions to documentation label Jul 10, 2025

stefanhipfel added 2 commits July 10, 2025 10:17

Merge branch 'main' into accounts

acc60ab

removes unneeded main file

f37a4ee

afritzler removed this from the v0.1.0 milestone Jul 22, 2025

stefanhipfel added 6 commits August 18, 2025 13:52

adds PasswordExpiration

be73cfa

Merge main into accounts

e275d74

Update CRD descriptions and remove deprecated fields

1e52da5

creates helm; improves tests

7b392c5

updates docs

b83fef1

updates codegen

3d1cab6

Nuckal777 reviewed Sep 4, 2025

View reviewed changes

internal/controller/bmcuser_controller.go Show resolved Hide resolved

stefanhipfel added 3 commits September 10, 2025 14:26

Merge branch 'main' into accounts

8f594f7

add test mockups for user controller

75085f5

Merge branch 'main' into accounts

05769e1

stefanhipfel requested review from Nuckal777 and davidgrun November 6, 2025 09:26

nagadeesh-nagaraja requested changes Nov 17, 2025

View reviewed changes

stefanhipfel added 5 commits November 19, 2025 14:15

Fix typos in comments and documentation, update password handling log…

96b59b9

…ic, and improve webhook validation tests

Remove AdminUserRef from BMCSpec and update related logic for user de…

e3b8f11

…letion and account management

Merge branch 'main' into accounts

7813f82

renames to BMCUser; uses new test setup

40599b0

Nuckal777 reviewed Dec 2, 2025

View reviewed changes

bmc/redfish_local.go Outdated Show resolved Hide resolved

Nuckal777 requested changes Dec 2, 2025

View reviewed changes

Nuckal777 reviewed Dec 2, 2025

View reviewed changes

internal/controller/bmcuser_controller.go Outdated Show resolved Hide resolved

Rename RotationPolicy to RotationPeriod in BMCUserSpec and update rel…

7319449

…ated references; remove unused RBAC roles and sample configurations

stefanhipfel requested a review from a team as a code owner December 19, 2025 13:46

Merge branch 'main' into accounts

2336927

stefanhipfel requested a review from Nuckal777 December 22, 2025 14:45

nagadeesh-nagaraja approved these changes Dec 23, 2025

View reviewed changes

Implements User controller #368

Are you sure you want to change the base?

Implements User controller #368

Uh oh!

Conversation

stefanhipfel commented Jun 12, 2025

Proposed Changes

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Nuckal777 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants