Attribute Schema Reconciler

[lukidoescode]

Motivation

LldapAttributeSchema CRDs allow declarative management of lldap's custom attribute definitions. This ensures attribute schemas exist before users/groups try to reference them.

Definition of Done

• On Apply:
  1. Query lldap's schema to check if the attribute already exists.
  2. If not exists: call addUserAttribute or addGroupAttribute (based on target field).
  3. If exists: verify the definition matches (type, isList, isVisible, isEditable). If it differs, set a Conflict condition (lldap does not support modifying attribute schemas — they must be deleted and recreated).
  4. Update status with observedGeneration and conditions.
• On Cleanup:
  1. Call deleteUserAttribute(name) or deleteGroupAttribute(name).
  2. This removes the attribute from ALL users/groups in lldap. The operator should emit a Warning event to make this destructive action visible.
  3. If attribute not found, treat as success.
• Validation:
  • Attribute names must match lldap's allowed characters: a-z, A-Z, 0-9, - only.
  • Reject attempts to create attributes with names matching hardcoded attributes (user_id, mail, display_name, creation_date, etc.).
• Emit events for schema create/delete/conflict/error.
• Documentation: Update the CRD Reference with LldapAttributeSchema usage. Document the immutability limitation and the delete-recreate workflow. Add examples showing custom attribute definition and usage on users/groups.

Technical Details

• Use Server-Side Apply for all status patches (see Ticket Reconciliation Robustness and Startup Behavior #15).
• Finalizer name: lldap-operator.lukidoescode.com/attr-schema-cleanup
• Since lldap cannot modify attribute schemas in-place, the reconciler should clearly communicate in conditions when there's a mismatch and require the user to delete and recreate the CRD.
• Ordering dependency: LldapUser (Ticket User Reconciler #11) and LldapGroup (Ticket Group Reconciler #13) reconcilers implement the dependency check — they verify referenced custom attributes have a corresponding LldapAttributeSchema in Ready state before attempting to set attribute values. The attribute schema reconciler should watches() or trigger dependent user/group CRDs when a schema transitions to Ready, so pending resources are re-triggered.