Allow creation & deletion of users with the operator

[coro]

This PR allows for the creation & deletion of users. Update of users & their credentials is not currently supported.

TODOs:

- Generate a Secret containing the credentials for the user
- We can make the user controller own the generated Secret, so that any updates to it will trigger the User controller to reconcile again
- Add a Status to the User object, with a .status.credentials key pointing to a credentials Secret

• Allow the provision of the user with a pre-defined password through a Secret supplied in the object Spec
• Allow a User to be updated, either by:
  • Updating the User Spec in the User object
  • Updating the credential Secret generated when the User is first created

This closes #3

Note to reviewers: remember to look at the commits in this PR and consider if they can be squashed

[MirahImage]

I'm wondering about the secret structure and how it's likely to be used, including potentially conforming to provisioned service secret specification to allow for ducktyping. In particular, I suspect that we would like to have the secret contain both username and password fields (potentially decoupling the resource name from the username).

[ChunyiLyu]

See comments. Overall looks good

[ChunyiLyu]

Question: what would happen if the created credential secret was modified (.data or annotations/labels)? Does that trigger a reconcile() since the controller is watching object? Would you ended up having a newly generated user secret as a result of that?

[coro]

Question: what would happen if the created credential secret was modified (.data or annotations/labels)? Does that trigger a reconcile() since the controller is watching object? Would you ended up having a newly generated user secret as a result of that?

What I'd like to happen is it triggers the reconcile, and is treated as the ultimate source of truth. So a new secret is not created, and the password hash of the user is regenerated and updated if the secret data was changed.

Having said that, what happens if the data for the username is changed? You then would be left with a User object that is tied to a Secret containing credentials for a different user. Not quite sure how to deal with that just yet.