Add Host controller with Ironic power management

Implement a controller that watches Host CRs (from osac-operator) and
reconciles spec.online to Ironic power on/off. Filters on
spec.hostManagementClass == "openstack" and syncs status.poweredOn.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: DanNiESh

.devcontainer/devcontainer.json

@@ -20,4 +20,4 @@ jobs:
       - name: Run linter
         uses: golangci/golangci-lint-action@v8
         with:
-          version: v2.1.0
+          version: v2.7.2

.devcontainer/post-install.sh

@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM golang:1.24 AS builder
+FROM golang:1.25 AS builder
 ARG TARGETOS
 ARG TARGETARCH
 
@@ -15,6 +15,7 @@ RUN go mod download
 COPY cmd/main.go cmd/main.go
 COPY api/ api/
 COPY internal/ internal/
+COPY pkg/ pkg/
 
 # Build
 # the GOARCH has not a default value to allow the binary be built according to the host where the command

.github/workflows/lint.yml

@@ -185,7 +185,7 @@ CONTROLLER_TOOLS_VERSION ?= v0.18.0
 ENVTEST_VERSION ?= $(shell go list -m -f "{{ .Version }}" sigs.k8s.io/controller-runtime | awk -F'[v.]' '{printf "release-%d.%d", $$2, $$3}')
 #ENVTEST_K8S_VERSION is the version of Kubernetes to use for setting up ENVTEST binaries (i.e. 1.31)
 ENVTEST_K8S_VERSION ?= $(shell go list -m -f "{{ .Version }}" k8s.io/api | awk -F'[v.]' '{printf "1.%d", $$3}')
-GOLANGCI_LINT_VERSION ?= v2.1.0
+GOLANGCI_LINT_VERSION ?= v2.7.2
 
 .PHONY: kustomize
 kustomize: $(KUSTOMIZE) ## Download kustomize locally if necessary.

.github/workflows/test-e2e.yml

@@ -1,8 +1,131 @@
-# public_template
+# host-management-openstack
 
-Use this repository as the template for public-facing repositories. Please keep the following warning at the top of the repository README:
+Kubernetes controller that manages bare metal nodes via OpenStack Ironic. Watches Host CRs (defined in [osac-operator](https://github.com/DanNiESh/osac-operator)) and reconciles the desired state to Ironic.
 
-> [!WARNING]
-> Be mindful of the content you commit to this repository. Do not commit any
-> material containing Red Hat confidential content, including information about
-> future product development plans.
+## Description
+
+This controller filters Host CRs where `spec.hostManagementClass == "openstack"` and uses `spec.id` as the Ironic node UUID to manage node lifecycle through Ironic.
+
+## Test locally (with Ironic)
+
+Run the host controller on your machine and point it at your Ironic API. You need a Kubernetes API (e.g. a `kind` cluster) so the controller can watch Host CRs; the controller runs locally and talks to Ironic from your local machine.
+
+### 1. Create a kind cluster
+
+```bash
+kind create cluster --name host-mgmt-test
+```
+
+### 2. Install the Host CRD from osac-operator
+
+The Host CR is defined in the [osac-operator](https://github.com/DanNiESh/osac-operator) `host-operator` branch.
+
+```bash
+kubectl apply -f <path-to-osac-operator>/config/crd/bases/osac.openshift.io_hosts.yaml
+```
+
+### 3. Set Ironic URL and token
+
+```bash
+export IRONIC_URL="https://ironic-url"
+export OSAC_AUTH_TOKEN="token"  # e.g. openstack token issue -f value -c id
+export IRONIC_INSECURE=true     # optional, if using self-signed certs
+```
+
+### 4. Run the controller
+
+```bash
+make run
+```
+
+The controller will use `IRONIC_URL` and `OSAC_AUTH_TOKEN` to connect to Ironic.
+
+### 5. Apply a sample Host CR
+
+In another terminal:
+
+```bash
+kubectl apply -f config/samples/v1alpha1_host.yaml
+```
+
+### 6. Verify
+
+```bash
+# Check Host status
+kubectl get host host-sample -n osac-namespace -o yaml
+
+# Watch controller logs for reconciliation
+```
+
+## Getting Started
+
+### Prerequisites
+- go version v1.25.0+
+- docker version 17.03+
+- kubectl version v1.11.3+
+- Access to a Kubernetes v1.11.3+ cluster
+- Access to an OpenStack Ironic endpoint
+
+### To Deploy on the cluster
+**Build and push your image to the location specified by `IMG`:**
+
+```sh
+make docker-build docker-push IMG=<some-registry>/host-management-openstack:tag
+```
+
+**Install the Host CRD (from osac-operator):**
+
+```sh
+kubectl apply -f <path-to-osac-operator>/config/crd/bases/osac.openshift.io_hosts.yaml
+```
+
+**Deploy the Manager to the cluster with the image specified by `IMG`:**
+
+```sh
+make deploy IMG=<some-registry>/host-management-openstack:tag
+```
+
+> **NOTE**: If you encounter RBAC errors, you may need to grant yourself cluster-admin
+privileges or be logged in as admin.
+
+**Create instances of your solution**
+You can apply the samples (examples) from the config/sample:
+
+```sh
+kubectl apply -k config/samples/
+```
+
+### To Uninstall
+**Delete the instances (CRs) from the cluster:**
+
+```sh
+kubectl delete -k config/samples/
+```
+
+**UnDeploy the controller from the cluster:**
+
+```sh
+make undeploy
+```
+
+## Contributing
+
+**NOTE:** Run `make help` for more information on all potential `make` targets
+
+More information can be found via the [Kubebuilder Documentation](https://book.kubebuilder.io/introduction.html)
+
+## License
+
+Copyright 2026.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

Dockerfile

@@ -36,6 +36,10 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/metrics/filters"
 	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
 	"sigs.k8s.io/controller-runtime/pkg/webhook"
+
+	"github.com/osac-project/host-management-openstack/internal/controller"
+	"github.com/osac-project/host-management-openstack/pkg/ironic"
+	osacopenshiftiov1alpha1 "github.com/osac-project/osac-operator/api/v1alpha1"
 	// +kubebuilder:scaffold:imports
 )
 
@@ -46,7 +50,7 @@ var (
 
 func init() {
 	utilruntime.Must(clientgoscheme.AddToScheme(scheme))
-
+	utilruntime.Must(osacopenshiftiov1alpha1.AddToScheme(scheme))
 	// +kubebuilder:scaffold:scheme
 }
 
@@ -116,7 +120,7 @@ func main() {
 			filepath.Join(webhookCertPath, webhookCertKey),
 		)
 		if err != nil {
-			setupLog.Error(err, "Failed to initialize webhook certificate watcher")
+			setupLog.Error(err, "failed to initialize webhook certificate watcher")
 			os.Exit(1)
 		}
 
@@ -165,7 +169,7 @@ func main() {
 			filepath.Join(metricsCertPath, metricsCertKey),
 		)
 		if err != nil {
-			setupLog.Error(err, "to initialize metrics certificate watcher", "error", err)
+			setupLog.Error(err, "failed to initialize metrics certificate watcher", "error", err)
 			os.Exit(1)
 		}
 
@@ -198,6 +202,34 @@ func main() {
 		os.Exit(1)
 	}
 
+	// Ironic client for bare metal power management
+	var ironicClient *ironic.Client
+	if ironicURLStr := os.Getenv("IRONIC_URL"); ironicURLStr != "" {
+		authToken := os.Getenv("OSAC_AUTH_TOKEN")
+		if authToken == "" {
+			setupLog.Error(nil, "OSAC_AUTH_TOKEN required when IRONIC_URL is set")
+			os.Exit(1)
+		}
+		ironicOpts := ironic.ClientOptions{InsecureSkipVerify: os.Getenv("IRONIC_INSECURE") == "true"}
+		var ironicErr error
+		ironicClient, ironicErr = ironic.NewClientWithToken(ironicURLStr, authToken, ironicOpts)
+		if ironicErr != nil {
+			setupLog.Error(ironicErr, "failed to create Ironic client")
+			os.Exit(1)
+		}
+		setupLog.Info("Ironic client configured", "url", ironicURLStr)
+	} else {
+		setupLog.Info("IRONIC_URL not set")
+	}
+
+	if err := (&controller.HostReconciler{
+		Client:       mgr.GetClient(),
+		Scheme:       mgr.GetScheme(),
+		IronicClient: ironicClient,
+	}).SetupWithManager(mgr); err != nil {
+		setupLog.Error(err, "unable to create controller", "controller", "Host")
+		os.Exit(1)
+	}
 	// +kubebuilder:scaffold:builder
 
 	if metricsCertWatcher != nil {

Makefile

@@ -9,29 +9,29 @@ namespace: host-management-openstack-system
 namePrefix: host-management-openstack-
 
 # Labels to add to all resources and selectors.
-#labels:
-#- includeSelectors: true
-#  pairs:
-#    someName: someValue
+# labels:
+# - includeSelectors: true
+#   pairs:
+#     someName: someValue
 
 resources:
-#- ../crd
+# - ../crd
 - ../rbac
 - ../manager
 # [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
 # crd/kustomization.yaml
-#- ../webhook
+# - ../webhook
 # [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. 'WEBHOOK' components are required.
-#- ../certmanager
+# - ../certmanager
 # [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
-#- ../prometheus
+# - ../prometheus
 # [METRICS] Expose the controller manager metrics service.
 - metrics_service.yaml
 # [NETWORK POLICY] Protect the /metrics endpoint and Webhook Server with NetworkPolicy.
 # Only Pod(s) running a namespace labeled with 'metrics: enabled' will be able to gather the metrics.
 # Only CR(s) which requires webhooks and are applied on namespaces labeled with 'webhooks: enabled' will
 # be able to communicate with the Webhook Server.
-#- ../network-policy
+# - ../network-policy
 
 # Uncomment the patches line if you enable Metrics
 patches:
@@ -44,19 +44,19 @@ patches:
 # Uncomment the patches line if you enable Metrics and CertManager
 # [METRICS-WITH-CERTS] To enable metrics protected with certManager, uncomment the following line.
 # This patch will protect the metrics with certManager self-signed certs.
-#- path: cert_metrics_manager_patch.yaml
-#  target:
-#    kind: Deployment
+# - path: cert_metrics_manager_patch.yaml
+#   target:
+#     kind: Deployment
 
 # [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
 # crd/kustomization.yaml
-#- path: manager_webhook_patch.yaml
-#  target:
-#    kind: Deployment
+# - path: manager_webhook_patch.yaml
+#   target:
+#     kind: Deployment
 
 # [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER' prefix.
 # Uncomment the following replacements to add the cert-manager CA injection annotations
-#replacements:
+# replacements:
 # - source: # Uncomment the following block to enable certificates for metrics
 #     kind: Service
 #     version: v1