[b/r] Add backup/restore labels to ControlPlane controller

Wire the BackupConfig reconciliation into the ControlPlane controller
with proper condition handling (OpenStackControlPlaneBackupConfigReady).
Add backup/restore labels to CA cert secrets via SecretTemplate, and
restore=false labels to internal service cert requests. Add the
ReconcileBackupConfig call, secret watch with annotation change
predicate, and RBAC for openstackbackupconfigs. Set BackupConfig spec
defaults in the CreateOrPatch mutate function.

Label custom Issuers for backup/restore in addIssuerLabelAnnotation
after removeIssuerLabel so the MatchingLabels query only uses CA
selector labels. Remove getCertSecretBackupLabels wrapper, call
backup.GetCertSecretBackupLabels directly. Return error from
GetCertSecretBackupLabels for non-NotFound errors. Rename GetConfig
parameter from gvk to crdName.

Jira: OSPRH-22912
Jira: OSPRH-22913

Author: stuggi

api/bases/core.openstack.org_openstackcontrolplanes.yaml

@@ -4,6 +4,10 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.18.0
+  labels:
+    backup.openstack.org/category: controlplane
+    backup.openstack.org/restore: "true"
+    backup.openstack.org/restore-order: "30"
   name: openstackcontrolplanes.core.openstack.org
 spec:
   group: core.openstack.org

api/bases/core.openstack.org_openstackversions.yaml

@@ -4,6 +4,10 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.18.0
+  labels:
+    backup.openstack.org/category: controlplane
+    backup.openstack.org/restore: "true"
+    backup.openstack.org/restore-order: "20"
   name: openstackversions.core.openstack.org
 spec:
   group: core.openstack.org

api/bases/dataplane.openstack.org_openstackdataplanenodesets.yaml

@@ -4,6 +4,10 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.18.0
+  labels:
+    backup.openstack.org/category: dataplane
+    backup.openstack.org/restore: "true"
+    backup.openstack.org/restore-order: "60"
   name: openstackdataplanenodesets.dataplane.openstack.org
 spec:
   group: dataplane.openstack.org

api/bases/dataplane.openstack.org_openstackdataplaneservices.yaml

@@ -4,6 +4,10 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.18.0
+  labels:
+    backup.openstack.org/category: dataplane
+    backup.openstack.org/restore: "true"
+    backup.openstack.org/restore-order: "40"
   name: openstackdataplaneservices.dataplane.openstack.org
 spec:
   group: dataplane.openstack.org

api/core/v1beta1/conditions.go

@@ -166,6 +166,9 @@ const (
 	// Infrastructure includes: CAs, DNSMasq, RabbitMQ, Galera (MariaDB), Memcached, and OVN databases
 	// This condition is set to True when deployment-stage annotation is "infrastructure-only" and all infrastructure is ready
 	OpenStackControlPlaneInfrastructureReadyCondition condition.Type = "OpenStackControlPlaneInfrastructureReady"
+
+	// OpenStackControlPlaneBackupConfigReadyCondition Status=True condition which indicates if OpenStackBackupConfig is reconciled
+	OpenStackControlPlaneBackupConfigReadyCondition condition.Type = "OpenStackControlPlaneBackupConfigReady"
 )
 
 // Common Messages used by API objects.
@@ -501,6 +504,15 @@ const (
 	// OpenStackControlPlaneOpenStackVersionInitializationReadyErrorMessage
 	OpenStackControlPlaneOpenStackVersionInitializationReadyErrorMessage = "OpenStackControlPlane OpenStackVersion initialization error occured %s"
 
+	// OpenStackControlPlaneBackupConfigReadyInitMessage
+	OpenStackControlPlaneBackupConfigReadyInitMessage = "OpenStackControlPlane BackupConfig not started"
+
+	// OpenStackControlPlaneBackupConfigReadyMessage
+	OpenStackControlPlaneBackupConfigReadyMessage = "OpenStackControlPlane BackupConfig ready"
+
+	// OpenStackControlPlaneBackupConfigReadyErrorMessage
+	OpenStackControlPlaneBackupConfigReadyErrorMessage = "OpenStackControlPlane BackupConfig error occured %s"
+
 	// OpenStackControlPlaneWatcherReadyInitMessage
 	OpenStackControlPlaneWatcherReadyInitMessage = "OpenStackControlPlane Watcher not started"
 

api/core/v1beta1/openstackcontrolplane_types.go

@@ -1118,6 +1118,9 @@ type TLSCAStatus struct {
 // +kubebuilder:resource:shortName=osctlplane;osctlplanes;oscp;oscps
 // +kubebuilder:printcolumn:name="Status",type="string",JSONPath=".status.conditions[0].status",description="Status"
 // +kubebuilder:printcolumn:name="Message",type="string",JSONPath=".status.conditions[0].message",description="Message"
+// +kubebuilder:metadata:labels=backup.openstack.org/restore=true
+// +kubebuilder:metadata:labels=backup.openstack.org/category=controlplane
+// +kubebuilder:metadata:labels=backup.openstack.org/restore-order=30
 
 // OpenStackControlPlane is the Schema for the openstackcontrolplanes API
 type OpenStackControlPlane struct {
@@ -1192,6 +1195,7 @@ func (instance *OpenStackControlPlane) InitConditions() {
 		condition.UnknownCondition(OpenStackControlPlaneOpenStackVersionInitializationReadyCondition, condition.InitReason, OpenStackControlPlaneOpenStackVersionInitializationReadyInitMessage),
 		condition.UnknownCondition(OpenStackControlPlaneWatcherReadyCondition, condition.InitReason, OpenStackControlPlaneWatcherReadyInitMessage),
 		condition.UnknownCondition(OpenStackControlPlaneInfrastructureReadyCondition, condition.InitReason, OpenStackControlPlaneInfrastructureReadyInitMessage),
+		condition.UnknownCondition(OpenStackControlPlaneBackupConfigReadyCondition, condition.InitReason, OpenStackControlPlaneBackupConfigReadyInitMessage),
 
 		// Also add the overall status condition as Unknown
 		condition.UnknownCondition(condition.ReadyCondition, condition.InitReason, condition.ReadyInitMessage),

api/core/v1beta1/openstackversion_types.go

@@ -218,6 +218,9 @@ type OpenStackVersionStatus struct {
 // +kubebuilder:printcolumn:name="Target Version",type=string,JSONPath=`.spec.targetVersion`
 // +kubebuilder:printcolumn:name="Available Version",type=string,JSONPath=`.status.availableVersion`
 // +kubebuilder:printcolumn:name="Deployed Version",type=string,JSONPath=`.status.deployedVersion`
+// +kubebuilder:metadata:labels=backup.openstack.org/restore=true
+// +kubebuilder:metadata:labels=backup.openstack.org/category=controlplane
+// +kubebuilder:metadata:labels=backup.openstack.org/restore-order=20
 
 // OpenStackVersion defines the Schema for the openstackversionupdates API
 type OpenStackVersion struct {

api/dataplane/v1beta1/openstackdataplanenodeset_types.go

@@ -94,6 +94,9 @@ type OpenStackDataPlaneNodeSetSpec struct {
 // +kubebuilder:resource:shortName=osdpns;osdpnodeset;osdpnodesets
 // +kubebuilder:printcolumn:name="Status",type="string",JSONPath=".status.conditions[0].status",description="Status"
 // +kubebuilder:printcolumn:name="Message",type="string",JSONPath=".status.conditions[0].message",description="Message"
+// +kubebuilder:metadata:labels=backup.openstack.org/restore=true
+// +kubebuilder:metadata:labels=backup.openstack.org/category=dataplane
+// +kubebuilder:metadata:labels=backup.openstack.org/restore-order=60
 
 // OpenStackDataPlaneNodeSet is the Schema for the openstackdataplanenodesets API
 // OpenStackDataPlaneNodeSet name must be a valid RFC1123 as it is used in labels

api/dataplane/v1beta1/openstackdataplaneservice_types.go

@@ -130,6 +130,9 @@ type OpenStackDataPlaneServiceStatus struct {
 // +kubebuilder:subresource:status
 // +kubebuilder:resource:shortName=osdps;osdpservice;osdpservices
 // +operator-sdk:csv:customresourcedefinitions:displayName="OpenStack Data Plane Service"
+// +kubebuilder:metadata:labels=backup.openstack.org/restore=true
+// +kubebuilder:metadata:labels=backup.openstack.org/category=dataplane
+// +kubebuilder:metadata:labels=backup.openstack.org/restore-order=40
 
 // OpenStackDataPlaneService defines the Schema for the openstackdataplaneservices API.
 // OpenStackDataPlaneService name must be a valid RFC1123 as it is used in labels

api/go.mod

@@ -80,7 +80,7 @@ require (
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/openshift/api v3.9.0+incompatible // indirect
-	github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260331122750-ecff41ebb61d // indirect
+	github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260417092244-81c71b39e981 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/prometheus/client_golang v1.22.0 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect