ApplicationCredential Additional Documentation

On-behalf-of: SAP nils.gondermann@sap.com

Author: gndrmnn

README.md

@@ -73,6 +73,7 @@ kubectl delete -f $ORC_RELEASE
 
 | **controller**              | **1.x** | **2.x** | **main** |
 |:---------------------------:|:-------:|:-------:|:--------:|
+| application credential      |         |    ◐    |     ◐    |
 | addressscope                |         |    ✔    |     ✔    |
 | domain                      |         |    ✔    |     ✔    |
 | endpoint                    |         |    ◐    |     ◐    |

api/v1alpha1/applicationcredential_types.go

@@ -65,6 +65,7 @@ type ApplicationCredentialResourceSpec struct {
 	Description *string `json:"description,omitempty"`
 
 	// userRef is a reference to the ORC User which this resource is associated with.
+	// Note: Due to the nature of the OpenStack API, managing application credentials for a user different than the one ORC is authenticated against can be computationally expensive. In the worst case, all application credentials of all users have to be queried.
 	// +required
 	UserRef KubernetesNameRef `json:"userRef,omitempty"`
 
@@ -105,6 +106,7 @@ type ApplicationCredentialSecretSpec struct {
 // +kubebuilder:validation:MinProperties:=2
 type ApplicationCredentialFilter struct {
 	// userRef is a reference to the ORC User which this resource is associated with.
+	// Note: Due to the nature of the OpenStack API, managing application credentials for a user different than the one ORC is authenticated against can be computationally expensive. In the worst case, all application credentials of all users have to be queried.
 	// +required
 	UserRef KubernetesNameRef `json:"userRef,omitempty"`
 

cmd/models-schema/zz_generated.openapi.go

@@ -102,8 +102,9 @@ spec:
                         pattern: ^[^,]+$
                         type: string
                       userRef:
-                        description: userRef is a reference to the ORC User which
-                          this resource is associated with.
+                        description: |-
+                          userRef is a reference to the ORC User which this resource is associated with.
+                          Note: Due to the nature of the OpenStack API, managing application credentials for a user different than the one ORC is authenticated against can be computationally expensive. In the worst case, all application credentials of all users have to be queried.
                         maxLength: 253
                         minLength: 1
                         type: string
@@ -245,8 +246,9 @@ spec:
                       application credentials or trusts
                     type: boolean
                   userRef:
-                    description: userRef is a reference to the ORC User which this
-                      resource is associated with.
+                    description: |-
+                      userRef is a reference to the ORC User which this resource is associated with.
+                      Note: Due to the nature of the OpenStack API, managing application credentials for a user different than the one ORC is authenticated against can be computationally expensive. In the worst case, all application credentials of all users have to be queried.
                     maxLength: 253
                     minLength: 1
                     type: string

config/crd/bases/openstack.k-orc.cloud_applicationcredentials.yaml

@@ -328,7 +328,7 @@ _Appears in:_
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `userRef` _[KubernetesNameRef](#kubernetesnameref)_ | userRef is a reference to the ORC User which this resource is associated with. |  | MaxLength: 253 <br />MinLength: 1 <br />Required: \{\} <br /> |
+| `userRef` _[KubernetesNameRef](#kubernetesnameref)_ | userRef is a reference to the ORC User which this resource is associated with.<br />Note: Due to the nature of the OpenStack API, managing application credentials for a user different than the one ORC is authenticated against can be computationally expensive. In the worst case, all application credentials of all users have to be queried. |  | MaxLength: 253 <br />MinLength: 1 <br />Required: \{\} <br /> |
 | `name` _[OpenStackName](#openstackname)_ | name of the existing resource |  | MaxLength: 255 <br />MinLength: 1 <br />Pattern: `^[^,]+$` <br />Optional: \{\} <br /> |
 | `description` _string_ | description of the existing resource |  | MaxLength: 1024 <br />Optional: \{\} <br /> |
 
@@ -368,7 +368,7 @@ _Appears in:_
 | --- | --- | --- | --- |
 | `name` _[OpenStackName](#openstackname)_ | name will be the name of the created resource. If not specified, the<br />name of the ORC object will be used. |  | MaxLength: 255 <br />MinLength: 1 <br />Pattern: `^[^,]+$` <br />Optional: \{\} <br /> |
 | `description` _string_ | description is a human-readable description for the resource. |  | MaxLength: 255 <br />MinLength: 1 <br />Optional: \{\} <br /> |
-| `userRef` _[KubernetesNameRef](#kubernetesnameref)_ | userRef is a reference to the ORC User which this resource is associated with. |  | MaxLength: 253 <br />MinLength: 1 <br />Required: \{\} <br /> |
+| `userRef` _[KubernetesNameRef](#kubernetesnameref)_ | userRef is a reference to the ORC User which this resource is associated with.<br />Note: Due to the nature of the OpenStack API, managing application credentials for a user different than the one ORC is authenticated against can be computationally expensive. In the worst case, all application credentials of all users have to be queried. |  | MaxLength: 253 <br />MinLength: 1 <br />Required: \{\} <br /> |
 | `unrestricted` _boolean_ | unrestricted is a flag indicating whether the application credential may be used for creation or destruction of other application credentials or trusts |  | Optional: \{\} <br /> |
 | `secret` _[ApplicationCredentialSecretSpec](#applicationcredentialsecretspec)_ | secret used to authenticate against the API |  | MaxProperties: 1 <br />MinProperties: 1 <br />Required: \{\} <br /> |
 | `roleRefs` _[KubernetesNameRef](#kubernetesnameref) array_ | roleRefs may only contain roles that the user has assigned on the project. If not provided, the roles assigned to the application credential will be the same as the roles in the current token. |  | MaxItems: 256 <br />MaxLength: 253 <br />MinLength: 1 <br />Optional: \{\} <br /> |