feat: expose Vault group ID in Group CRD status#327
Merged
Conversation
After creating or updating a Vault identity group, read back the group from Vault and persist its ID in status.id. This allows other resources (e.g., KRO ResourceGraphDefinitions) to reference the group ID for nesting groups via memberGroupIDs. Introduces a VaultStatusEnricher interface so other CRDs can opt into similar status enrichment without changing the generic reconciler flow. Closes redhat-cop#326
Collaborator
|
if you are still interested in this, can you rebase it? |
Contributor
Author
|
@raffaelespazzoli All set |
Collaborator
|
there seem to be some compilation issues. |
Contributor
Author
|
@raffaelespazzoli missed the existing test file, sorry. Shuffled. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
After creating or updating a Vault identity group, read back the group from Vault and persist its UUID in
status.id. This enables other tools that compose Group resources (e.g., KRO ResourceGraphDefinitions using CEL expressions) to reference the Vault-assigned group ID — for example, to nest an external group inside an internal group viamemberGroupIDs.Changes
api/v1alpha1/group_types.go— AddedID stringfield toGroupStatus; implementedEnrichStatuson Group to read the ID from Vault after reconcile.api/v1alpha1/utils/vaultobject.go— AddedVaultStatusEnricherinterface (optional, non-breaking).controllers/vaultresourcecontroller/vaultresourcereconciler.go— After successful reconcile, check if the object implementsVaultStatusEnricherand callEnrichStatusbefore updating status.Motivation
Without
status.id, consumers that need to compose groups have no way to reference the Vault-assigned group ID. This forces workarounds like duplicating policies across multiple groups instead of nesting them.Closes #326