Read configuration from env into typed options structs

charts/openstack-hypervisor-operator/values.yaml

@@ -4,12 +4,6 @@ controllerManager:
     - --metrics-bind-address=:8443
     - --leader-elect
     - --health-probe-bind-address=:8081
-    - --certificate-namespace=$(CERTIFICATE_NAMESPACE)
-    - --certificate-issuer-name=$(CERTIFICATE_ISSUER_NAME)
-    - --label-selector=$(LABEL_SELECTOR)
-    - --agent-namespaces=$(AGENT_NAMESPACES)
-    - --eviction-concurrency=$(EVICTION_CONCURRENCY)
-    - --eviction-trait-concurrency=$(EVICTION_TRAIT_CONCURRENCY)
     containerSecurityContext:
       allowPrivilegeEscalation: false
       capabilities:
@@ -23,8 +17,13 @@ controllerManager:
       # Default maximum number of VM migrations to run concurrently while draining a hypervisor.
       # Keep this quoted because it is rendered as an environment variable.
       evictionConcurrency: "1"
-      # Optional comma-separated TRAIT=N overrides for per-host migration concurrency.
-      # The lowest matching trait limit wins, e.g. "CUSTOM_HANA_EXCLUSIVE_HOST=1,CUSTOM_FOO=2".
+      # Optional comma-separated TRAIT:N overrides for per-host migration concurrency.
+      # The lowest matching trait limit wins, e.g. "CUSTOM_HANA_EXCLUSIVE_HOST:1,CUSTOM_FOO:2".
+      # Native integers use base 0: 0x10 is 16, and 010 is 8.
+      # To override individual keys, repeat CLI flags in manager.args:
+      # --eviction-trait-concurrency=CUSTOM_HANA_EXCLUSIVE_HOST:1
+      # --eviction-trait-concurrency=CUSTOM_FOO:2
+      # Empty CLI values are invalid. An empty environment value supplies no overrides.
       evictionTraitConcurrency: ""
       osAuthUrl: ""
       osProjectDomainName: ""

cmd/main.go

@@ -20,15 +20,15 @@ package main
 import (
 	"crypto/sha256"
 	"crypto/tls"
-	"errors"
 	"flag"
 	"fmt"
 	"os"
 	gruntime "runtime"
-	"strconv"
-	"strings"
 
+	"github.com/kelseyhightower/envconfig"
+	"github.com/octago/sflags/gen/gflag"
 	"github.com/sapcc/go-api-declarations/bininfo"
+
 	// Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.)
 	// to ensure that exec-entrypoint and run can make use of them.
 	_ "k8s.io/client-go/plugin/pkg/client/auth"
@@ -55,7 +55,6 @@ import (
 	"github.com/cobaltcore-dev/openstack-hypervisor-operator/internal/controller"
 	"github.com/cobaltcore-dev/openstack-hypervisor-operator/internal/controller/eviction"
 	"github.com/cobaltcore-dev/openstack-hypervisor-operator/internal/controller/ready"
-	"github.com/cobaltcore-dev/openstack-hypervisor-operator/internal/global"
 	"github.com/cobaltcore-dev/openstack-hypervisor-operator/internal/logger"
 
 	// +kubebuilder:scaffold:imports
@@ -77,6 +76,27 @@ func init() {
 	utilruntime.Must(cmapi.AddToScheme(scheme))
 }
 
+type options struct {
+	controller.Shared
+	Certificate controller.CertificateOptions
+	Eviction    eviction.Options
+}
+
+func (o *options) loadFromEnv() error {
+	// Each module owns its settings; process each struct with an empty prefix
+	// so env names come from the envconfig tags verbatim.
+	if err := envconfig.Process("", &o.Shared); err != nil {
+		return err
+	}
+	if err := envconfig.Process("", &o.Certificate); err != nil {
+		return err
+	}
+	if err := envconfig.Process("", &o.Eviction); err != nil {
+		return err
+	}
+	return nil
+}
+
 func main() {
 	var version bool
 	var metricsAddr string
@@ -85,8 +105,6 @@ func main() {
 	var secureMetrics bool
 	var enableHTTP2 bool
 	var tlsOpts []func(*tls.Config)
-	var certificateNamespace string
-	var certificateIssuerName string
 
 	flag.BoolVar(&version, "version", false,
 		"Print the version and exit.")
@@ -100,23 +118,20 @@ func main() {
 		"If set, the metrics endpoint is served securely via HTTPS. Use --metrics-secure=false to use HTTP instead.")
 	flag.BoolVar(&enableHTTP2, "enable-http2", false,
 		"If set, HTTP/2 will be enabled for the metrics and webhook servers")
-	flag.StringVar(&global.LabelSelector, "label-selector", "", "Label selector to filter watched resources (namely nodes).")
 
-	var agentNamespacesFlag string
-	flag.StringVar(&agentNamespacesFlag, "agent-namespaces", "",
-		"Comma-separated list of namespaces to search for agent pods (nova-compute, neutron) during offboarding.")
-
-	flag.IntVar(&global.EvictionConcurrency, "eviction-concurrency", 1,
-		"Default maximum number of VM migrations to run concurrently while draining a hypervisor. Defaults to 1 (serial).")
-
-	var evictionTraitConcurrencyFlag string
-	flag.StringVar(&evictionTraitConcurrencyFlag, "eviction-trait-concurrency", "",
-		"Comma-separated TRAIT=N overrides for per-host migration concurrency, e.g. "+
-			"CUSTOM_HANA_EXCLUSIVE_HOST=1,CUSTOM_FOO=2. The lowest matching trait limit wins.")
+	var cfg options
+	if err := cfg.loadFromEnv(); err != nil {
+		fmt.Fprintf(os.Stderr, "invalid configuration: %v\n", err)
+		os.Exit(1)
+	}
 
-	flag.StringVar(&certificateNamespace, "certificate-namespace", "monsoon3", "The namespace for the certificates. ")
-	flag.StringVar(&certificateIssuerName, "certificate-issuer-name", "nova-hypervisor-agents-ca-issuer",
-		"Name of the certificate issuer.")
+	// Register CLI flags from the env-filled structs so that explicit
+	// command-line arguments override environment values; the current
+	// (env-derived) field values become the flag defaults.
+	if err := gflag.ParseTo(&cfg, flag.CommandLine); err != nil {
+		fmt.Fprintf(os.Stderr, "invalid configuration: %v\n", err)
+		os.Exit(1)
+	}
 
 	opts := ctrlzap.Options{
 		Development:     true,
@@ -137,62 +152,23 @@ func main() {
 		os.Exit(0)
 	}
 
-	if agentNamespacesFlag != "" {
-		// Deduplicate. Without this, repeated entries (e.g. from templated
-		// values) would cause redundant pod-list calls and inflate the
-		// AgentPodsEvicted condition message with duplicate pod names.
-		seen := map[string]struct{}{}
-		for ns := range strings.SplitSeq(agentNamespacesFlag, ",") {
-			ns = strings.TrimSpace(ns)
-			if ns == "" {
-				continue
-			}
-			if _, ok := seen[ns]; ok {
-				continue
-			}
-			seen[ns] = struct{}{}
-			global.AgentNamespaces = append(global.AgentNamespaces, ns)
-		}
-	}
-
-	if len(global.AgentNamespaces) == 0 {
-		setupLog.Error(errors.New("--agent-namespaces is required"), "invalid configuration")
-		os.Exit(1)
-	}
+	ctrl.SetLogger(ctrlzap.New(ctrlzap.UseFlagOptions(&opts)))
 
-	if global.EvictionConcurrency < 1 {
-		setupLog.Error(errors.New("--eviction-concurrency must be >= 1"), "invalid configuration")
+	if err := cfg.Validate(); err != nil {
+		setupLog.Error(err, "invalid configuration")
 		os.Exit(1)
 	}
 
-	for entry := range strings.SplitSeq(evictionTraitConcurrencyFlag, ",") {
-		entry = strings.TrimSpace(entry)
-		if entry == "" {
-			continue
-		}
-		trait, value, ok := strings.Cut(entry, "=")
-		trait = strings.TrimSpace(trait)
-		n, err := strconv.Atoi(strings.TrimSpace(value))
-		if !ok || trait == "" || err != nil || n < 1 {
-			setupLog.Error(errors.New("invalid --eviction-trait-concurrency entry: "+entry),
-				"invalid configuration", "expected", "TRAIT=N with N >= 1")
-			os.Exit(1)
-		}
-		global.EvictionTraitConcurrency[trait] = n
-	}
-
-	if certificateIssuerName == "" {
-		setupLog.Error(errors.New("certificate-issuer-name cannot be empty"), "invalid certificate issuer name")
+	if err := cfg.Eviction.Validate(); err != nil {
+		setupLog.Error(err, "invalid configuration")
 		os.Exit(1)
 	}
 
-	if certificateNamespace == "" {
-		setupLog.Error(errors.New("certificate-namespace cannot be empty"), "invalid certificate namespace")
+	if err := cfg.Certificate.Validate(); err != nil {
+		setupLog.Error(err, "invalid configuration")
 		os.Exit(1)
 	}
 
-	ctrl.SetLogger(ctrlzap.New(ctrlzap.UseFlagOptions(&opts)))
-
 	// if the enable-http2 flag is false (the default), http/2 should be disabled
 	// due to its vulnerabilities. More specifically, disabling http/2 will
 	// prevent from being vulnerable to the HTTP/2 Stream Cancellation and
@@ -260,9 +236,9 @@ func main() {
 			&policyv1.PodDisruptionBudget{}: maintenanceCacheConfig,
 		},
 	}
-	if global.LabelSelector != "" {
-		setupLog.Info("setting up cache with label selector", "selector", global.LabelSelector)
-		selector, err := labels.Parse(global.LabelSelector)
+	if cfg.LabelSelector != "" {
+		setupLog.Info("setting up cache with label selector", "selector", cfg.LabelSelector)
+		selector, err := labels.Parse(cfg.LabelSelector)
 		if err != nil {
 			setupLog.Error(err, "unable to parse label selector")
 			os.Exit(1)
@@ -273,7 +249,7 @@ func main() {
 
 		h := sha256.New()
 		h.Write([]byte(leaderElectionID)) // Seed it with something "unique" to the project
-		h.Write([]byte(global.LabelSelector))
+		h.Write([]byte(cfg.LabelSelector))
 		leaderElectionID = fmt.Sprintf("%x.cloud.sap", h.Sum(nil))
 	}
 
@@ -315,7 +291,7 @@ func main() {
 	if err = (&controller.HypervisorController{
 		Client: mgr.GetClient(),
 		Scheme: mgr.GetScheme(),
-	}).SetupWithManager(mgr); err != nil {
+	}).SetupWithManager(mgr, cfg.Shared); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "Hypervisor")
 		os.Exit(1)
 	}
@@ -331,7 +307,7 @@ func main() {
 	if err = (&eviction.EvictionReconciler{
 		Client: mgr.GetClient(),
 		Scheme: mgr.GetScheme(),
-	}).SetupWithManager(mgr); err != nil {
+	}).SetupWithManager(mgr, cfg.Eviction); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "Eviction")
 		os.Exit(1)
 	}
@@ -355,15 +331,15 @@ func main() {
 	if err = (&controller.NodeCertificateController{
 		Client: mgr.GetClient(),
 		Scheme: mgr.GetScheme(),
-	}).SetupWithManager(mgr, certificateNamespace, certificateIssuerName); err != nil {
+	}).SetupWithManager(mgr, cfg.Certificate); err != nil {
 		setupLog.Error(err, "unable to create controller", "certificate", "NodeCertificate")
 		os.Exit(1)
 	}
 
 	if err = (&controller.GardenerNodeLifecycleController{
 		Client: mgr.GetClient(),
 		Scheme: mgr.GetScheme(),
-	}).SetupWithManager(mgr, certificateNamespace); err != nil {
+	}).SetupWithManager(mgr, cfg.Certificate.Namespace); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "Maintenance")
 		os.Exit(1)
 	}

go.mod

@@ -10,6 +10,8 @@ require (
 	github.com/go-logr/logr v1.4.4
 	github.com/gophercloud/gophercloud/v2 v2.15.0
 	github.com/gophercloud/utils/v2 v2.0.0-20260922174841-b4759ea0529b
+	github.com/kelseyhightower/envconfig v1.4.0
+	github.com/octago/sflags v0.3.1
 	github.com/onsi/ginkgo/v2 v2.33.1
 	github.com/onsi/gomega v1.44.0
 	github.com/sapcc/go-api-declarations v1.25.1

go.sum

@@ -113,6 +113,8 @@ github.com/joshdk/go-junit v1.0.0 h1:S86cUKIdwBHWwA6xCmFlf3RTLfVXYQfvanM5Uh+K6GE
 github.com/joshdk/go-junit v1.0.0/go.mod h1:TiiV0PqkaNfFXjEiyjWM3XXrhVyCa1K4Zfga6W52ung=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/kelseyhightower/envconfig v1.4.0 h1:Im6hONhd3pLkfDFsbRgu68RDNkGF1r3dvMUtDTo2cv8=
+github.com/kelseyhightower/envconfig v1.4.0/go.mod h1:cccZRl6mQpaq41TPp5QxidR+Sa3axMbJDNb//FQX6Gg=
 github.com/klauspost/compress v1.20.1 h1:T7kKElXUMXrUJ2E9QhQhxFtcK5rPyLdsGZvdbLMPdiQ=
 github.com/klauspost/compress v1.20.1/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
@@ -133,6 +135,8 @@ github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFd
 github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/octago/sflags v0.3.1 h1:LW65z20iAQKteEyjsnnc+/lyoCUnIoRuAocggr6RB6A=
+github.com/octago/sflags v0.3.1/go.mod h1:hVUkbnYwMU9kZiZJyOAIVN56YiVMMPxgJ46kRZ19jh0=
 github.com/onsi/ginkgo/v2 v2.33.1 h1:62XfWJbEIjPSCSDYrsCPP/SHcmH7O0M8ne8zfqQ2iz4=
 github.com/onsi/ginkgo/v2 v2.33.1/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=
 github.com/onsi/gomega v1.44.0 h1:eAiGl3Pw5jz5GQdDff0BcxYpAX1JxW8xD7mFUuwNfZQ=

internal/controller/eviction/controller.go

@@ -42,11 +42,56 @@ import (
 	"github.com/cobaltcore-dev/openstack-hypervisor-operator/internal/utils"
 )
 
+// Options configures the eviction controller.
+type Options struct {
+	Concurrency      int            `envconfig:"EVICTION_CONCURRENCY" default:"1" desc:"Default maximum number of VM migrations to run concurrently while draining a hypervisor. Defaults to 1 (serial)."`
+	TraitConcurrency map[string]int `envconfig:"EVICTION_TRAIT_CONCURRENCY" desc:"Per-host migration concurrency overrides. Set EVICTION_TRAIT_CONCURRENCY to comma-separated TRAIT:N entries, e.g. CUSTOM_HANA_EXCLUSIVE_HOST:1,CUSTOM_FOO:2. Integers use base 0 (0x10 is 16, 010 is 8). Repeat --eviction-trait-concurrency=TRAIT:N for CLI overrides of individual keys. Empty CLI values are invalid. The lowest matching trait limit wins."`
+}
+
+// TraitConcurrency maps Placement trait names to migration concurrency limits.
+type TraitConcurrency = map[string]int
+
+// ResolveConcurrency returns the maximum number of concurrent migrations
+// for a host given its traits: the default, lowered by the lowest matching
+// trait limit, and never below 1.
+func (o Options) ResolveConcurrency(traits []string) int {
+	limit := o.Concurrency
+	for _, trait := range traits {
+		if traitLimit, ok := o.TraitConcurrency[trait]; ok && traitLimit < limit {
+			limit = traitLimit
+		}
+	}
+	return max(limit, 1)
+}
+
+// Validate checks that the concurrency and every trait limit are >= 1 and
+// that trait names are non-empty and carry no surrounding whitespace.
+func (o Options) Validate() error {
+	if o.Concurrency < 1 {
+		return fmt.Errorf("--eviction-concurrency (EVICTION_CONCURRENCY) must be >= 1, got %d", o.Concurrency)
+	}
+
+	for trait, limit := range o.TraitConcurrency {
+		if limit < 1 {
+			return fmt.Errorf("--eviction-trait-concurrency (EVICTION_TRAIT_CONCURRENCY): trait %q must have an integer limit >= 1, got %d", trait, limit)
+		}
+		if trait != strings.TrimSpace(trait) {
+			return fmt.Errorf("--eviction-trait-concurrency (EVICTION_TRAIT_CONCURRENCY): trait name %q must not contain surrounding whitespace", trait)
+		}
+		if trait == "" {
+			return errors.New("--eviction-trait-concurrency (EVICTION_TRAIT_CONCURRENCY): trait name must not be empty")
+		}
+	}
+
+	return nil
+}
+
 // EvictionReconciler reconciles a Eviction object
 type EvictionReconciler struct {
 	client.Client
 	Scheme        *runtime.Scheme
 	computeClient *gophercloud.ServiceClient
+	Options       Options
 }
 
 const (
@@ -173,7 +218,7 @@ func (r *EvictionReconciler) handleRunning(ctx context.Context, eviction *kvmv1.
 
 	// That should leave us with "Running" and the hypervisor should be deactivated
 	if len(eviction.Status.OutstandingInstances) > 0 {
-		limit := global.ResolveConcurrency(hypervisor.Status.Traits)
+		limit := r.Options.ResolveConcurrency(hypervisor.Status.Traits)
 		return r.evictNext(ctx, eviction, limit)
 	}
 
@@ -533,7 +578,9 @@ func (r *EvictionReconciler) registerWithManager(mgr ctrl.Manager) error {
 }
 
 // SetupWithManager sets up the controller with the Manager.
-func (r *EvictionReconciler) SetupWithManager(mgr ctrl.Manager) error {
+func (r *EvictionReconciler) SetupWithManager(mgr ctrl.Manager, options Options) error {
+	r.Options = options
+
 	ctx := context.Background()
 
 	var err error