feat: centrally managed connections via cluster-scoped ClusterConnection CRD

Namespaced resources can now reference a ClusterConnection (spec.connection.
clusterRef) instead of a per-namespace connection secret. The admin
credentials Secret lives only in the operator's namespace and
allowedNamespaces restricts which namespaces may use the connection.

- ConnectionRef: secretRef and clusterRef, exactly one required
- chart: clusterconnections RBAC, optional rbac.clusterWideSecrets, plus a
  namespaced Role for operator-namespace secrets
- e2e: clusterRef bucket converges; disallowed namespace is rejected

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: CoderYellow

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "rustfs-operator"
-version = "0.1.0"
+version = "0.2.0"
 edition = "2024"
 rust-version = "1.92"
 license = "MIT OR Apache-2.0"

README.md

@@ -8,26 +8,40 @@ the [`rc-core`](https://crates.io/crates/rc-core) /
 
 ## CRDs (`rustfs.com/v1alpha1`)
 
-| Kind     | Short name | Manages                                             |
-|----------|------------|-----------------------------------------------------|
-| `Bucket` | `rfb`      | bucket existence, versioning, hard quota            |
-| `User`   | `rfu`      | IAM user, enabled/disabled, attached policies       |
-| `Policy` | `rfp`      | IAM policy document (inline YAML/JSON)              |
+| Kind                | Short name | Scope      | Manages                                       |
+|---------------------|------------|------------|-----------------------------------------------|
+| `Bucket`            | `rfb`      | namespaced | bucket existence, versioning, hard quota      |
+| `User`              | `rfu`      | namespaced | IAM user, enabled/disabled, attached policies |
+| `Policy`            | `rfp`      | namespaced | IAM policy document (inline YAML/JSON)        |
+| `ClusterConnection` | `rfcc`     | cluster    | centrally managed RustFS server connection    |
 
-Every resource references a connection Secret in its own namespace:
+Namespaced resources select a RustFS server via `spec.connection`, in one of
+two mutually exclusive ways:
+
+**Centrally managed (recommended for multi-tenant clusters)** — reference a
+cluster-scoped `ClusterConnection`; the admin credentials Secret lives only
+in the operator's namespace, and `allowedNamespaces` restricts who may use
+it:
+
+```yaml
+spec:
+  connection:
+    clusterRef: prod
+```
+
+**Self-service** — reference a connection Secret in the resource's own
+namespace (keys: `endpoint`, `accessKey`, `secretKey`; optional `region`,
+`insecure`):
 
 ```yaml
-stringData:
-  endpoint: http://rustfs.storage.svc:9000
-  accessKey: rustfsadmin
-  secretKey: rustfsadmin
-  # region: us-east-1   # optional
-  # insecure: "true"    # optional
+spec:
+  connection:
+    secretRef: rustfs-conn
 ```
 
-See `deploy/example.yaml` for a complete example. Each resource supports
-`deletionPolicy: Delete` (default; the remote resource is removed via
-finalizer when the CR is deleted) or `Retain`.
+See `deploy/example.yaml` for complete examples of both. Each resource
+supports `deletionPolicy: Delete` (default; the remote resource is removed
+via finalizer when the CR is deleted) or `Retain`.
 
 ## Install
 

charts/rustfs-operator/crds/crds.yaml

@@ -33,13 +33,20 @@ spec:
                 nullable: true
                 type: string
               connection:
-                description: Reference to the connection Secret (same namespace as the resource).
+                description: |-
+                  Reference to a RustFS server. Exactly one of `secretRef` / `clusterRef`
+                  must be set (validated at reconcile time).
                 properties:
+                  clusterRef:
+                    description: Name of a cluster-scoped ClusterConnection.
+                    nullable: true
+                    type: string
                   secretRef:
-                    description: Name of the Secret holding `endpoint`, `accessKey` and `secretKey`.
+                    description: |-
+                      Name of a Secret in the resource's namespace holding `endpoint`,
+                      `accessKey` and `secretKey` (optional: `region`, `insecure`).
+                    nullable: true
                     type: string
-                required:
-                - secretRef
                 type: object
               deletionPolicy:
                 default: Delete
@@ -123,13 +130,20 @@ spec:
                 nullable: true
                 type: string
               connection:
-                description: Reference to the connection Secret (same namespace as the resource).
+                description: |-
+                  Reference to a RustFS server. Exactly one of `secretRef` / `clusterRef`
+                  must be set (validated at reconcile time).
                 properties:
+                  clusterRef:
+                    description: Name of a cluster-scoped ClusterConnection.
+                    nullable: true
+                    type: string
                   secretRef:
-                    description: Name of the Secret holding `endpoint`, `accessKey` and `secretKey`.
+                    description: |-
+                      Name of a Secret in the resource's namespace holding `endpoint`,
+                      `accessKey` and `secretKey` (optional: `region`, `insecure`).
+                    nullable: true
                     type: string
-                required:
-                - secretRef
                 type: object
               deletionPolicy:
                 default: Delete
@@ -225,13 +239,20 @@ spec:
             description: An IAM policy in RustFS.
             properties:
               connection:
-                description: Reference to the connection Secret (same namespace as the resource).
+                description: |-
+                  Reference to a RustFS server. Exactly one of `secretRef` / `clusterRef`
+                  must be set (validated at reconcile time).
                 properties:
+                  clusterRef:
+                    description: Name of a cluster-scoped ClusterConnection.
+                    nullable: true
+                    type: string
                   secretRef:
-                    description: Name of the Secret holding `endpoint`, `accessKey` and `secretKey`.
+                    description: |-
+                      Name of a Secret in the resource's namespace holding `endpoint`,
+                      `accessKey` and `secretKey` (optional: `region`, `insecure`).
+                    nullable: true
                     type: string
-                required:
-                - secretRef
                 type: object
               deletionPolicy:
                 default: Delete
@@ -278,3 +299,69 @@ spec:
     storage: true
     subresources:
       status: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: clusterconnections.rustfs.com
+spec:
+  group: rustfs.com
+  names:
+    categories: []
+    kind: ClusterConnection
+    plural: clusterconnections
+    shortNames:
+    - rfcc
+    singular: clusterconnection
+  scope: Cluster
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .spec.endpoint
+      name: Endpoint
+      type: string
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: Auto-generated derived type for ClusterConnectionSpec via `CustomResource`
+        properties:
+          spec:
+            description: |-
+              A centrally managed connection to a RustFS server. Cluster-scoped; the
+              referenced credentials Secret lives in the operator's own namespace, so
+              application namespaces never see admin credentials.
+            properties:
+              allowedNamespaces:
+                description: |-
+                  Namespaces whose resources may use this connection.
+                  Absent means all namespaces are allowed.
+                items:
+                  type: string
+                nullable: true
+                type: array
+              credentialsSecretRef:
+                description: |-
+                  Name of the Secret in the operator's namespace holding `accessKey`
+                  and `secretKey`.
+                type: string
+              endpoint:
+                description: RustFS endpoint URL, e.g. `http://rustfs.storage.svc:9000`.
+                type: string
+              insecure:
+                default: false
+                description: Skip TLS verification.
+                type: boolean
+              region:
+                description: AWS region; defaults to `us-east-1`.
+                nullable: true
+                type: string
+            required:
+            - credentialsSecretRef
+            - endpoint
+            type: object
+        required:
+        - spec
+        title: ClusterConnection
+        type: object
+    served: true
+    storage: true
+    subresources: {}

charts/rustfs-operator/templates/rbac.yaml

@@ -12,10 +12,16 @@ rules:
   - apiGroups: ["rustfs.com"]
     resources: ["buckets/status", "users/status", "policies/status"]
     verbs: ["get", "patch", "update"]
-  # connection and user-credential secrets
+  - apiGroups: ["rustfs.com"]
+    resources: ["clusterconnections"]
+    verbs: ["get", "list", "watch"]
+  {{- if .Values.rbac.clusterWideSecrets }}
+  # needed for connection.secretRef (per-namespace connection secrets);
+  # set rbac.clusterWideSecrets=false if you only use ClusterConnection
   - apiGroups: [""]
     resources: ["secrets"]
     verbs: ["get"]
+  {{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -31,4 +37,34 @@ subjects:
   - kind: ServiceAccount
     name: {{ include "rustfs-operator.serviceAccountName" . }}
     namespace: {{ .Release.Namespace }}
+---
+# Secrets in the operator's own namespace (ClusterConnection credentials)
+# are always readable, regardless of rbac.clusterWideSecrets.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "rustfs-operator.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "rustfs-operator.labels" . | nindent 4 }}
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "rustfs-operator.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "rustfs-operator.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "rustfs-operator.fullname" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "rustfs-operator.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
 {{- end }}

charts/rustfs-operator/values.yaml

@@ -16,6 +16,12 @@ serviceAccount:
 
 rbac:
   create: true
+  # Grants cluster-wide Secret read. Needed for `connection.secretRef`
+  # (per-namespace connection secrets) and for `User.spec.secretKeyRef`
+  # Secrets in application namespaces. Set to false for the strictest setup:
+  # everything uses `connection.clusterRef` and User resources live in the
+  # operator's namespace; the operator then only reads Secrets there.
+  clusterWideSecrets: true
 
 # value for RUST_LOG
 logLevel: info