EVEREST-496 Multi namespace support

api/v1alpha1/backupstorage_types.go

@@ -45,10 +45,14 @@ type BackupStorageSpec struct {
 	Description string `json:"description,omitempty"`
 	// CredentialsSecretName is the name of the secret with credentials.
 	CredentialsSecretName string `json:"credentialsSecretName"`
+	// TargetNamespaces is the list of namespaces where the operator will copy secrets provided in the CredentialsSecretsName.
+	TargetNamespaces []string `json:"targetNamespaces"`
 }
 
 // BackupStorageStatus defines the observed state of BackupStorage.
-type BackupStorageStatus struct{}
+type BackupStorageStatus struct {
+	Namespaces map[string]bool `json:"usedNamespaces"`
+}
 
 //+kubebuilder:object:root=true
 //+kubebuilder:subresource:status
@@ -74,3 +78,21 @@ type BackupStorageList struct {
 func init() {
 	SchemeBuilder.Register(&BackupStorage{}, &BackupStorageList{})
 }
+func (b *BackupStorage) UpdateNamespacesList(namespace string) {
+	if b.Status.Namespaces == nil {
+		b.Status.Namespaces = make(map[string]bool)
+	}
+	b.Status.Namespaces[namespace] = true
+}
+func (b *BackupStorage) IsNamespaceAllowed(namespace string) bool {
+	if len(b.Spec.TargetNamespaces) == 0 {
+		return true
+	}
+	for _, ns := range b.Spec.TargetNamespaces {
+		ns := ns
+		if ns == namespace {
+			return true
+		}
+	}
+	return false
+}

config/manager/manager.yaml

@@ -103,7 +103,7 @@ spec:
             cpu: 10m
             memory: 64Mi
         env:
-        - name: WATCH_NAMESPACE
+        - name: EVEREST_NAMESPACE
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace

config/manifests/bases/everest-operator.clusterserviceversion.yaml

@@ -56,9 +56,9 @@ spec:
     type: OwnNamespace
   - supported: true
     type: SingleNamespace
-  - supported: false
-    type: MultiNamespace
   - supported: true
+    type: MultiNamespace
+  - supported: false
     type: AllNamespaces
   keywords:
   - everest

controllers/databasecluster_controller.go

@@ -141,7 +141,8 @@ var (
 // DatabaseClusterReconciler reconciles a DatabaseCluster object.
 type DatabaseClusterReconciler struct {
 	client.Client
-	Scheme *runtime.Scheme
+	Scheme           *runtime.Scheme
+	everestNamespace string
 }
 
 //+kubebuilder:rbac:groups=everest.percona.com,resources=databaseclusters,verbs=get;list;watch;create;update;patch;delete
@@ -329,6 +330,12 @@ func (r *DatabaseClusterReconciler) genPSMDBBackupSpec(
 		if err != nil {
 			return psmdbv1.BackupSpec{Enabled: false}, errors.Join(err, fmt.Errorf("failed to get backup storage %s", backup.Spec.BackupStorageName))
 		}
+		if database.Namespace != r.everestNamespace {
+			if err := r.reconcileSecret(ctx, backupStorage, database); err != nil {
+				return psmdbv1.BackupSpec{Enabled: false}, err
+			}
+
+		}
 
 		switch backupStorage.Spec.Type {
 		case everestv1alpha1.BackupStorageTypeS3:
@@ -2614,6 +2621,9 @@ func (r *DatabaseClusterReconciler) addPGToScheme(scheme *runtime.Scheme) error
 	builder := runtime.NewSchemeBuilder(r.addPGKnownTypes)
 	return builder.AddToScheme(scheme)
 }
+func (r *DatabaseClusterReconciler) SetEverestNamespace(namespace string) {
+	r.everestNamespace = namespace
+}
 
 // SetupWithManager sets up the controller with the Manager.
 func (r *DatabaseClusterReconciler) SetupWithManager(mgr ctrl.Manager) error {
@@ -3234,3 +3244,27 @@ func (r *DatabaseClusterReconciler) defaultPSMDBSpec() *psmdbv1.PerconaServerMon
 		},
 	}
 }
+func (r *DatabaseClusterReconciler) reconcileSecret(ctx context.Context, backupStorage *everestv1alpha1.BackupStorage, database *everestv1alpha1.DatabaseCluster) error {
+	secret := &corev1.Secret{}
+	err := r.Get(ctx, types.NamespacedName{Name: backupStorage.Spec.CredentialsSecretName, Namespace: database.Namespace}, secret)
+	if err != nil && !k8serrors.IsNotFound(err) {
+		return err
+	}
+	err = r.Get(ctx, types.NamespacedName{Name: backupStorage.Spec.CredentialsSecretName, Namespace: r.everestNamespace}, secret)
+	if err != nil {
+		return err
+	}
+	secret.Namespace = database.Namespace
+	if !backupStorage.IsNamespaceAllowed(database.Namespace) {
+		return fmt.Errorf("%s namespace is not allowed to use for %s backup storage", database.Namespace, backupStorage.Name)
+	}
+	err = r.Create(ctx, secret)
+	if err != nil {
+		return err
+	}
+	backupStorage.UpdateNamespacesList(database.Namespace)
+	if err := r.Status().Update(ctx, backupStorage); err != nil {
+		return err
+	}
+	return nil
+}

main.go

@@ -23,10 +23,12 @@ import (
 	"flag"
 	"fmt"
 	"os"
+	"strings"
 
 	"k8s.io/apimachinery/pkg/runtime"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
+
 	// Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.)
 	// to ensure that exec-entrypoint and run can make use of them.
 	_ "k8s.io/client-go/plugin/pkg/client/auth"
@@ -40,7 +42,10 @@ import (
 	"github.com/percona/everest-operator/controllers"
 )
 
-const watchNamespaceEnvVar = "WATCH_NAMESPACE"
+const (
+	everestNamespaceEnvVar = "EVEREST_NAMESPACE"
+	watchNamespacesEnvVar  = "WATCH_NAMESPACES"
+)
 
 var (
 	scheme   = runtime.NewScheme()
@@ -70,12 +75,23 @@ func main() {
 	flag.Parse()
 
 	ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts)))
-	ns, found := os.LookupEnv(watchNamespaceEnvVar)
+	ns, found := os.LookupEnv(everestNamespaceEnvVar)
 	if !found {
-		setupLog.Error(errors.New("failed to get namespace"), fmt.Sprintf("%s must be set", watchNamespaceEnvVar))
+		setupLog.Error(errors.New("failed to get everest watch namespace namespace"), fmt.Sprintf("%s must be set", everestNamespaceEnvVar))
 
 		os.Exit(1)
 	}
+	rawNamespaces, found := os.LookupEnv(watchNamespacesEnvVar)
+	if !found {
+		setupLog.Error(errors.New("failed to get everest watch namespace namespace"), fmt.Sprintf("%s must be set", everestNamespaceEnvVar))
+
+	}
+	cacheConfig := map[string]cache.Config{
+		ns: {},
+	}
+	for _, ns := range strings.Split(rawNamespaces, ",") {
+		cacheConfig[ns] = cache.Config{}
+	}
 
 	mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
 		Scheme: scheme,
@@ -106,14 +122,15 @@ func main() {
 		setupLog.Error(err, "unable to start manager")
 		os.Exit(1)
 	}
-
-	if err = (&controllers.DatabaseClusterReconciler{
+	dbReconciler := &controllers.DatabaseClusterReconciler{
 		Client: mgr.GetClient(),
 		Scheme: mgr.GetScheme(),
-	}).SetupWithManager(mgr); err != nil {
+	}
+	if err := dbReconciler.SetupWithManager(mgr); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "DatabaseCluster")
 		os.Exit(1)
 	}
+	dbReconciler.SetEverestNamespace(ns)
 	if err = (&controllers.DatabaseEngineReconciler{
 		Client: mgr.GetClient(),
 		Scheme: mgr.GetScheme(),