Add BMCUserSet type and controller implementation

PROJECT

@@ -155,6 +155,14 @@ resources:
   kind: BMCUser
   path: github.com/ironcore-dev/metal-operator/api/v1alpha1
   version: v1alpha1
+- api:
+    crdVersion: v1
+  controller: true
+  domain: ironcore.dev
+  group: metal
+  kind: BMCUserSet
+  path: github.com/ironcore-dev/metal-operator/api/v1alpha1
+  version: v1alpha1
 - api:
     crdVersion: v1
   controller: true

api/v1alpha1/bmcuser_types.go

@@ -10,22 +10,7 @@ import (
 
 // BMCUserSpec defines the desired state of BMCUser.
 type BMCUserSpec struct {
-	// UserName is the username of the BMC user.
-	UserName string `json:"userName"`
-
-	// RoleID is the ID of the role to assign to the user.
-	RoleID string `json:"roleID"`
-
-	// Description is a description for the BMC user.
-	Description string `json:"description,omitempty"`
-
-	// RotationPeriod defines how often the password should be rotated.
-	// If not set, the password will not be rotated.
-	RotationPeriod *metav1.Duration `json:"rotationPeriod,omitempty"`
-
-	// BMCSecretRef references the BMCSecret containing the credentials for this user.
-	// If not set, the operator will generate a secure password based on BMC manufacturer requirements.
-	BMCSecretRef *v1.LocalObjectReference `json:"bmcSecretRef,omitempty"`
+	BMCUserTemplate `json:",inline"`
 
 	// BMCRef references the BMC this user should be created on.
 	BMCRef *v1.LocalObjectReference `json:"bmcRef,omitempty"`

api/v1alpha1/bmcuserset_types.go

@@ -0,0 +1,81 @@
+// SPDX-FileCopyrightText: 2025 SAP SE or an SAP affiliate company and IronCore contributors
+// SPDX-License-Identifier: Apache-2.0
+
+package v1alpha1
+
+import (
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// BMCUserTemplate defines the template for the BMCUser Resource to be applied to the BMCs.
+type BMCUserTemplate struct {
+	// Username of the BMC user.
+	// +required
+	// +kubebuilder:validation:MinLength=1
+	UserName string `json:"userName"`
+	// RoleID is the ID of the role to assign to the user.
+	// The available roles depend on the BMC implementation.
+	// For Redfish, common role IDs are "Administrator", "Operator", "ReadOnly".
+	// +required
+	// +kubebuilder:validation:MinLength=1
+	RoleID string `json:"roleID"`
+	// Description is an optional description for the BMC user.
+	Description string `json:"description,omitempty"`
+	// RotationPeriod defines how often the password should be rotated.
+	// if not set, the password will not be rotated.
+	RotationPeriod *metav1.Duration `json:"rotationPeriod,omitempty"`
+	// BMCSecretRef references the BMCSecret containing the credentials for this user.
+	// If not set, the operator will generate a secure password based on BMC manufacturer requirements.
+	BMCSecretRef *corev1.LocalObjectReference `json:"bmcSecretRef,omitempty"`
+}
+
+// BMCUserSetSpec defines the desired state of BMCUserSet.
+type BMCUserSetSpec struct {
+	// BMCSelector specifies a label selector to identify the BMCs that are to be selected.
+	// +required
+	BMCSelector metav1.LabelSelector `json:"bmcSelector"`
+
+	// BMCUserTemplate defines the template for the BMCUser Resource to be applied to the BMCs.
+	// +required
+	BMCUserTemplate BMCUserTemplate `json:"bmcUserTemplate"`
+}
+
+// BMCUserSetStatus defines the observed state of BMCUserSet.
+type BMCUserSetStatus struct {
+	// FullyLabeledBMCs is the number of BMC in the set.
+	FullyLabeledBMCs int32 `json:"fullyLabeledBMCs,omitempty"`
+	// AvailableBMCUsers is the number of BMCUsers currently created by the set.
+	AvailableBMCUsers int32 `json:"availableBMCUsers,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+// +kubebuilder:subresource:status
+// +kubebuilder:resource:scope=Cluster
+// +kubebuilder:printcolumn:name="UserName",type=string,JSONPath=`.spec.bmcUserTemplate.userName`
+// +kubebuilder:printcolumn:name="RoleID",type=string,JSONPath=`.spec.bmcUserTemplate.roleID`
+// +kubebuilder:printcolumn:name="TotalBMCs",type="integer",JSONPath=`.status.fullyLabeledBMCs`
+// +kubebuilder:printcolumn:name="AvailableBMCUsers",type="integer",JSONPath=`.status.availableBMCUsers`
+// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp"
+
+// BMCUserSet is the Schema for the bmcusersets API.
+type BMCUserSet struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   BMCUserSetSpec   `json:"spec,omitempty"`
+	Status BMCUserSetStatus `json:"status,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+
+// BMCUserSetList contains a list of BMCUserSet.
+type BMCUserSetList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []BMCUserSet `json:"items"`
+}
+
+func init() {
+	SchemeBuilder.Register(&BMCUserSet{}, &BMCUserSetList{})
+}

cmd/main.go

@@ -597,6 +597,13 @@ func main() { // nolint: gocyclo
 		setupLog.Error(err, "Failed to create controller", "controller", "BMCSettingsSet")
 		os.Exit(1)
 	}
+	if err := (&controller.BMCUserSetReconciler{
+		Client: mgr.GetClient(),
+		Scheme: mgr.GetScheme(),
+	}).SetupWithManager(mgr); err != nil {
+		setupLog.Error(err, "unable to create controller", "controller", "BMCUserSet")
+		os.Exit(1)
+	}
 	if err = (&controller.BMCUserReconciler{
 		Client:             mgr.GetClient(),
 		Scheme:             mgr.GetScheme(),

config/crd/bases/metal.ironcore.dev_bmcusers.yaml

@@ -92,18 +92,23 @@ spec:
                 type: object
                 x-kubernetes-map-type: atomic
               description:
-                description: Description is a description for the BMC user.
+                description: Description is an optional description for the BMC user.
                 type: string
               roleID:
-                description: RoleID is the ID of the role to assign to the user.
+                description: |-
+                  RoleID is the ID of the role to assign to the user.
+                  The available roles depend on the BMC implementation.
+                  For Redfish, common role IDs are "Administrator", "Operator", "ReadOnly".
+                minLength: 1
                 type: string
               rotationPeriod:
                 description: |-
                   RotationPeriod defines how often the password should be rotated.
-                  If not set, the password will not be rotated.
+                  if not set, the password will not be rotated.
                 type: string
               userName:
-                description: UserName is the username of the BMC user.
+                description: Username of the BMC user.
+                minLength: 1
                 type: string
             required:
             - roleID