Group Reconciler

[lukidoescode]

Motivation

The group reconciler synchronizes LldapGroup CRDs with lldap group records. It must handle both user-created groups and auto-created virtual groups for built- in lldap groups.

Definition of Done

• On Apply (create or update):
  1. If the group carries the built-in annotation (lldap-resources- operator.lukidoescode.com/built-in: "true"): refuse spec modifications, only update status.
  2. For user-created groups: check if group exists in lldap (query by display name). Create via createGroupWithDetails if not exists, update via updateGroup if changed.
  3. Handle custom attributes: insert/remove as needed. If the group spec references custom attributes, verify that each referenced attribute has a corresponding LldapAttributeSchema CRD in Ready state. If not, set DependencyNotReady condition and requeue.
  4. Detect duplicate displayName conflicts: if another user-created LldapGroup CRD (different metadata.name) targets the same displayName, set a Conflict condition. lldap allows duplicate display names, but two CRDs managing the same display name would cause undefined behavior.
  5. Update status: set groupId, uuid, observedGeneration, conditions.
• On Cleanup:
  1. If built-in group: remove finalizer without deleting from lldap.
  2. For user-created groups: delete from lldap via deleteGroup(groupId).
  3. Idempotent: "not found" = success.
• On operator startup (this ticket owns virtual CRD creation — Ticket Reconciliation Robustness and Startup Behavior #15 calls into this logic as part of the startup sequence):
  1. Query lldap for built-in groups by known display names (lldap_admin, lldap_password_manager, lldap_strict_readonly).
  2. For each built-in group, ensure an LldapGroup CRD exists in the operator's watched namespace with the instance label. Create if missing, update status if exists.
  3. These virtual CRDs carry an annotation lldap-resources- operator.lukidoescode.com/built-in: "true" and the operator rejects mutations to their spec.
• Emit events for group create/update/delete/error.
• Documentation: Update the CRD Reference with LldapGroup usage. Document the built-in group virtual CRD behavior. Add examples showing both custom group creation and membership assignment to built-in groups.

Technical Details

• Use Server-Side Apply for all status patches (see Ticket Reconciliation Robustness and Startup Behavior #15).
• Finalizer name: lldap-operator.lukidoescode.com/group-cleanup
• Built-in group detection: query all groups on startup and check display_name against known built-in names (lldap_admin, lldap_password_manager, lldap_strict_readonly). Do NOT rely on group IDs — only display names are stable across lldap versions.
• Virtual CRD namespace: configurable via env var or Helm value (LLDAP_VIRTUAL_GROUP_NAMESPACE). Defaults to the operator's own namespace.
• The group reconciler must handle the case where a user tries to create an LldapGroup with the same displayName as a built-in group: reject with a condition message explaining it conflicts with a built-in.
• ObservedGeneration short-circuit applies here too.