Original source: https://input.scs.community/scs-operator-hackathon-images-flavors#

Yaook SCS Operator Hackathon - Manage OpenStack resources in K8s

OSISM Image/Flavor Manager

• Commandline tool which is supposed to be run manually
• Integration in k8s would require some amount of glue code
• qick and dirty solution: CronJob with configuration in a ConfiMap
• awkward user interface

PoC OpenStack Resource Controller

Rough Steps

export ORC_RELEASE="https://github.com/k-orc/openstack-resource-controller/releases/download/v2.4.0/install.yaml"
kubectl apply --server-side -f $ORC_RELEASE

kubectl create -n orc-system secret generic openstack-clouds \
    --from-file=clouds.yaml=./orc_clouds.yaml

clouds:
  local-admin:
    auth:
      auth_url: https://keystone.yaook.svc:5000/v3
      password: geheim
      project_domain_name: Default
      project_name: admin
      user_domain_name: Default
      username: yaook-sys-maint
    endpoint_type: internal

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: glance-api
    state.yaook.cloud/component: api_deployment
    state.yaook.cloud/parent-group: yaook.cloud
    state.yaook.cloud/parent-name: glance
    state.yaook.cloud/parent-plural: glancedeployments
    state.yaook.cloud/parent-version: v1
  name: glance-api
  namespace: yaook
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      state.yaook.cloud/component: api_deployment
      state.yaook.cloud/parent-group: yaook.cloud
      state.yaook.cloud/parent-name: glance
      state.yaook.cloud/parent-plural: glancedeployments
      state.yaook.cloud/parent-version: v1
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      annotations:
        config-timestamp: 2026-02-24T19:44:46.002795Z+JJXKSZ2trz0
      creationTimestamp: null
      labels:
        state.yaook.cloud/component: api_deployment
        state.yaook.cloud/parent-group: yaook.cloud
        state.yaook.cloud/parent-name: glance
        state.yaook.cloud/parent-plural: glancedeployments
        state.yaook.cloud/parent-version: v1
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: image.yaook.cloud/api
                operator: Exists
            - matchExpressions:
              - key: any.yaook.cloud/api
                operator: Exists
      automountServiceAccountToken: false
      containers:
      - env:
        - name: REQUESTS_CA_BUNDLE
          value: /etc/pki/tls/certs/ca-bundle.crt
        - name: HTTP_PROXY
          value: http://10.65.117.35:3128
        - name: NO_PROXY
          value: .svc,.cluster,10.0.0.0/8
        image: registry.yaook.cloud/yaook/glance-2025.1:1.1.151
        imagePullPolicy: IfNotPresent
        lifecycle:
          preStop:
            exec:
              command:
              - /bin/sleep
              - "5"
        livenessProbe:
          exec:
            command:
            - curl
            - --fail
            - localhost:8080
          failureThreshold: 3
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 5
        name: glance-api
        readinessProbe:
          exec:
            command:
            - curl
            - --fail
            - localhost:8080
          failureThreshold: 3
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 5
        resources: {}
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /etc/glance
          name: glance-config-volumev2
        - mountPath: /etc/pki/tls/certs
          name: ca-certs
        - mountPath: /etc/ceph/ceph.conf
          name: glance-ceph-conf-volume
          subPath: ceph.conf
        - mountPath: /etc/ceph/keyfile
          name: glance-ceph-keyfile-volume
          subPath: keyfile
      - env:
        - name: SERVICE_PORT
          value: "9292"
        - name: LOCAL_PORT
          value: "8080"
        - name: METRICS_PORT
          value: "9090"
        - name: REQUESTS_CA_BUNDLE
          value: /etc/ssl/certs/ca-certificates.crt
        - name: MAX_BODY_SIZE_MB
          value: "0"
        - name: READ_TIMEOUT
          value: "7200"
        image: registry.yaook.cloud/yaook/ssl-terminator:1.2.116
        imagePullPolicy: IfNotPresent
        livenessProbe:
          failureThreshold: 3
          httpGet:
            path: /.yaook.cloud/ssl-terminator-healthcheck
            port: 9292
            scheme: HTTPS
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        name: ssl-terminator
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /
            port: 9292
            scheme: HTTPS
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        resources: {}
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /config
          name: ssl-terminator-config
        - mountPath: /data
          name: tls-secret
        - mountPath: /etc/ssl/certs/ca-certificates.crt
          name: ca-certs
          subPath: ca-bundle.crt
      - env:
        - name: SERVICE_PORT
          value: "9293"
        - name: LOCAL_PORT
          value: "8080"
        - name: METRICS_PORT
          value: "9091"
        - name: REQUESTS_CA_BUNDLE
          value: /etc/ssl/certs/ca-certificates.crt
        - name: MAX_BODY_SIZE_MB
          value: "0"
        - name: READ_TIMEOUT
          value: "7200"
        image: registry.yaook.cloud/yaook/ssl-terminator:1.2.116
        imagePullPolicy: IfNotPresent
        livenessProbe:
          failureThreshold: 3
          httpGet:
            path: /.yaook.cloud/ssl-terminator-healthcheck
            port: 9293
            scheme: HTTPS
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        name: ssl-terminator-external
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /
            port: 9293
            scheme: HTTPS
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        resources: {}
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /config
          name: ssl-terminator-external-config
        - mountPath: /data
          name: tls-secret-external
        - mountPath: /etc/ssl/certs/ca-certificates.crt
          name: ca-certs
          subPath: ca-bundle.crt
      - args:
        - /data/
        env:
        - name: YAOOK_SERVICE_RELOAD_MODULE
          value: traefik
        image: registry.yaook.cloud/yaook/service-reload:1.0.102
        imagePullPolicy: IfNotPresent
        name: service-reload
        resources: {}
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /config
          name: ssl-terminator-config
        - mountPath: /data
          name: tls-secret
      - args:
        - /data/
        env:
        - name: YAOOK_SERVICE_RELOAD_MODULE
          value: traefik
        image: registry.yaook.cloud/yaook/service-reload:1.0.102
        imagePullPolicy: IfNotPresent
        name: service-reload-external
        resources: {}
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /config
          name: ssl-terminator-external-config
        - mountPath: /data
          name: tls-secret-external
      dnsPolicy: ClusterFirst
      enableServiceLinks: false

apiVersion: openstack.k-orc.cloud/v1alpha1
kind: Image
metadata:
  name: cirros
  namespace: orc-system
spec:
  cloudCredentialsRef:
    cloudName: local-admin
    secretName: openstack-clouds
  resource:
    name: cirros
    protected: false
    properties:
      architecture: x86_64
    content:
      diskFormat: raw
      download:
        url: https://download.cirros-cloud.net/0.6.3/cirros-0.6.3-x86_64-disk.img

yaml apiVersion: openstack.k-orc.cloud/v1alpha1 kind: Flavor metadata: name: test-flavor namespace: orc-system spec: cloudCredentialsRef: cloudName: local-admin secretName: openstack-clouds resource: name: armin-1234-flavor ram: 4123 vcpus: 2 disk: 50 isPublic: true

First Impressions

• Wiring Keystone authentication needs some plumbing
• General Keystone connectivity was achieved