Waldur Site Agent - K8s UT Namespace Plugin
This plugin enables integration between Waldur Site Agent and Kubernetes clusters for managing
ManagedNamespace custom resources (CRD: provisioning.hpc.ut.ee/v1) with optional Keycloak
RBAC group integration.
Features
- ManagedNamespace Lifecycle: Creates, updates, and deletes
ManagedNamespacecustom resources - Resource Quotas: Sets CPU, memory, storage, and GPU limits as namespace quotas
- Role-Based Access Control: Creates 3 Keycloak groups per namespace (admin, readwrite, readonly)
- Waldur Role Mapping: Maps Waldur roles to namespace access levels automatically
- User Management: Adds/removes users from Keycloak groups, reconciles role changes
- Usage Reporting: Reports namespace quota allocations back to Waldur
- Status Operations: Supports downscale (minimal quota), pause (zero quota), and restore
Architecture
The plugin follows the Waldur Site Agent plugin architecture and consists of:
- K8sUtNamespaceBackend: Main backend implementation that orchestrates namespace and user management
- K8sUtNamespaceClient: Handles Kubernetes API operations for
ManagedNamespaceCRs - KeycloakClient: Manages Keycloak groups and user memberships (shared package)
Role Mapping
Waldur roles are mapped to namespace access levels. The default mapping is:
| Waldur Role | Namespace Role |
|---|---|
manager |
admin |
admin |
admin |
member |
readwrite |
This mapping is configurable via the role_mapping setting in backend_settings.
Custom entries are merged with the defaults, so you only need to specify overrides or additions:
1 2 3 4 | |
Users whose Waldur role is not in the mapping fall back to default_role (default: readwrite).
Component Mapping
Waldur component keys are mapped to Kubernetes quota fields. The default mapping is:
| Waldur Component | K8s Quota Field | Unit Format |
|---|---|---|
cpu |
cpu |
Integer |
ram |
memory |
{value}Gi |
storage |
storage |
{value}Gi |
gpu |
gpu |
Integer |
This mapping is configurable via the component_quota_mapping setting in backend_settings.
Custom entries are merged with the defaults:
1 2 3 | |
Installation
Install the plugin using uv:
1 | |
The plugin will be automatically discovered via Python entry points.
Setup Requirements
Kubernetes Cluster Setup
- Kubernetes Cluster: Accessible cluster with the
ManagedNamespaceCRD installed (provisioning.hpc.ut.ee/v1) - Access Method: Either a kubeconfig file or in-cluster service account
- CR Namespace: A namespace where
ManagedNamespaceCRs will be created (default:waldur-system)
Keycloak Setup (Optional)
Required for RBAC group integration:
- Keycloak Server: Accessible Keycloak instance
- Target Realm: Where user accounts and groups will be managed
- Service User: User with group management permissions
Creating Keycloak Service User
- Login to Keycloak Admin Console
- Select Target Realm
- Create User:
- Username:
waldur-site-agent-k8s - Email Verified: Yes
- Enabled: Yes
- Set Password: In Credentials tab (temporary: No)
- Assign Roles: In Role Mappings tab
- Client Roles ->
realm-management - Add:
manage-users(sufficient for group operations)
Waldur Marketplace Setup
- Marketplace Offering: Created with appropriate type (e.g.,
Marketplace.Basic) - Components: Configured via
waldur_site_load_components - Offering State: Must be
Activefor order processing
Configuration
Minimal Configuration (K8s Only)
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 | |
Full Configuration (with Keycloak)
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 | |
Configuration Reference
Backend Settings
| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
kubeconfig_path |
string | No | - | Path to kubeconfig file (omit for in-cluster config) |
cr_namespace |
string | No | waldur-system |
Namespace where ManagedNamespace CRs are created |
namespace_prefix |
string | No | waldur- |
Prefix for created namespace names |
default_role |
string | No | readwrite |
Default namespace role for users without explicit role |
role_mapping |
object | No | See Role Mapping | Custom Waldur role to namespace role mapping (merged with defaults) |
component_quota_mapping |
object | No | See Component Mapping | Custom component to K8s quota field mapping |
keycloak_use_user_id |
boolean | No | true |
Use Keycloak user ID for lookup (false = use username) |
sync_users_to_cr |
boolean | No | false |
Sync user emails to CR adminUsers/rwUsers/roUsers fields |
Keycloak Settings (Optional)
| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
keycloak_enabled |
boolean | No | false |
Enable Keycloak RBAC integration |
keycloak.keycloak_url |
string | Conditional | - | Keycloak server URL |
keycloak.keycloak_realm |
string | Conditional | - | Keycloak realm name |
keycloak.keycloak_user_realm |
string | Conditional | - | Keycloak user realm for auth |
keycloak.keycloak_username |
string | Conditional | - | Keycloak admin username |
keycloak.keycloak_password |
string | Conditional | - | Keycloak admin password |
keycloak.keycloak_ssl_verify |
boolean | No | true |
Whether to verify SSL certificates |
Usage
Running the Agent
Start the agent with your configuration file:
1 | |
Diagnostics
Run diagnostics to check connectivity:
1 | |
Supported Agent Modes
- order_process: Creates and manages ManagedNamespace CRs based on Waldur resource orders
- membership_sync: Synchronizes user memberships between Waldur and Keycloak groups
- report: Reports namespace quota allocations to Waldur
Resource Lifecycle
Namespace Creation
When a Waldur resource order is processed:
- Resource slug is validated (required for naming)
- Three Keycloak groups are created:
ns_{slug}_admin,ns_{slug}_readwrite,ns_{slug}_readonly - A
ManagedNamespaceCR is created with quota and group references in the spec - The namespace name is
{namespace_prefix}{slug}(e.g.,waldur-my-project) - If CR creation fails, Keycloak groups are cleaned up (compensating transaction)
Namespace Deletion
When a Waldur resource termination order is processed:
- The
ManagedNamespaceCR is deleted - All 3 Keycloak groups are deleted
Limit Updates
When resource limits are updated in Waldur:
- Limits are converted to K8s resource quantities
- The CR's
spec.quotais patched with the new values
User Management
When users are added to a Waldur resource:
- Each user's Waldur role is mapped to a namespace role (admin/readwrite/readonly)
- User is looked up in Keycloak
- User is removed from any incorrect role groups (role reconciliation)
- User is added to the correct role group
Direct CR User Sync
When sync_users_to_cr is enabled, user emails from Waldur are written directly to the
ManagedNamespace CR's adminUsers, rwUsers, and roUsers fields.
The managed-namespace-operator then creates RoleBindings with these emails as
OIDC User subjects.
Each user's Waldur role is mapped to a namespace role using the same
role_mapping configuration (see Role Mapping), and the
email is placed in the corresponding CR field:
| Namespace Role | CR Field |
|---|---|
admin |
adminUsers |
readwrite |
rwUsers |
readonly |
roUsers |
On each membership sync cycle, the full current set of team members from Waldur is written to the CR. Users removed from the Waldur project team are automatically removed from the CR on the next sync, because empty lists are sent for roles with no members.
This can be used alongside Keycloak groups (both mechanisms populate the
same RoleBindings) or without Keycloak (keycloak_enabled: false) for
deployments that rely solely on OIDC email-based authentication.
1 2 3 | |
When users are removed:
- User is removed from all 3 Keycloak groups
Status Operations
| Operation | Effect |
|---|---|
| Downscale | Quota set to minimal: cpu=1, memory=1Gi, storage=1Gi |
| Pause | Quota set to zero: cpu=0, memory=0Gi, storage=0Gi |
| Restore | No-op (limits should be re-set via a separate update order) |
Error Handling
- Kubernetes connectivity issues are logged and raised as
BackendError - Keycloak initialization failure logs a warning; user management operations become no-ops
- CR creation failure triggers automatic Keycloak group cleanup
- Missing users in Keycloak are logged as warnings and skipped
- Missing backend ID on deletion is logged and skipped gracefully
Development
Running Tests
1 | |
Code Quality
1 | |