[EPIC] Manage Clusters on OpenStack using CAPO

[kopiczko]

User Story

• As a giant swarm customer I want to create kubernetes clusters on openstack so that I can make use of my existing openstack infrastructure.

Details, Background

When talking to new customers especially in the telecommunication industry, but also in manufacturing and retail we see a demand to manage clusters on existing openstack infrastructure. With our move to Cluster API we will be able to provide this functionality using controllers provided by the upstream community.

Blocked by / depends on

Monitor CAPI workload Clustes #313
Default apps for CAPI Clusters #320

Tasks / Milestones

🍕 Milestone: Alpha 🍕

• Move Management Cluster CRs to giantswarm namespace #576
• Install GS components on CAPO K8s clusters #577
• Install OpenStack CRDs with opsctl #578
• Create a vault App for giantswarm/config secrets encryption (so we don't need a vault machine) #579
• Prepare OpenStack provider for Argo #580
• Create app collection for OpenStack #581
• Create K8s clusters in OpenStack in reproducible way #582
• Ingress for CAPO MC #583
• Setup dex in MC #584
• Configure CPI for CAPO clusters #585
• Install CNI in OpenStack clusters #588
• Generate CAPO templates with kubectl-gs #587
• Replace cert-manager installed with clusterctl #575

🍕 Milestone: Beta 🍕

• monitoring for capo clusters #640
• Allow 1.x.x overwrite in config-controller #626
• can we manage capo clusters with helm?  #642
• improve dns-operator-opoenstack-finalizer #782
• Ensure DNS delegations for CAPO Workload Clusters #596
• Ensure SSH access to CAPO MC and WC nodes #634
• Improve Cluster deletion #682
• Configure CAPO clusters OIDC access #586
• Investigate the interaction of GitOps and defaulting/spec updates #595
• Find a way to provision bastion machines for CAPO Workload Clusters #681
• Document CAPO cluster templating in GS docs #594
• Add MachineHealthCheck to cluster-openstack #712
• Support cinder csi volume snapshots. #752
• Get rid of ClusterClass #860
• Change capo SC to delete as default instead of retain #735
• https://github.com/giantswarm/giantswarm/issues/20527

🍕 Milestone: GA 🍕

• Create an App installing CAPO controllers #598
• Integrate vault with opsctl #591
• Add volumes metadata #710
• Opsctl integration #643
• Optionally attach existing network to capo cluster #773

🍕 GA: Security 🍕

• Configure audit for configuration secrets vault #632
• Turn vault script into a managed app managed by ArgoCD #592
• Configure kube-proxy on par with k8scloudconfig #790
• Encryption Keys #868
• Configure encryption at rest configuration #1116
• Epic: Central vault for ssh access to CAPI cluster nodes #709
• IP Whitelisting for API server in CAPO  #921
• use flatcar as base OS on capo clusters #778
• Support Audit log for CAPO #1117
• Support PodSecurityPolicies in CAPO #1148
• Support bastion updates #924
• Configure kubelet and API server flags for CAPO clusters #687
• Use retagged upstream image for CAPI #754
• Install k8s resources currently managed in k8s cloud config #675

🍕 GA: Monitoring 🍕

• Remove vault metrics for CAPI #1003
• Replace docker metrics with containerd metrics for CAPI #1002
• Adapt inhibition rules to work with CAPI #930
• Monitoring improvements for CAPO for GA #1030
• Bastion monitoring for CAPO #1001
• service monitor for CAP(O|I) components #1209
• giantswarm/giantswarm#22875

🍕 GA: Release Automation & testing 🍕

• Build OpenStack images for CAPI #597
• CNCF Conformance tests for CAPO clusters #686

🍕 GA: Documentation 🍕

• giantswarm/giantswarm#23706
• https://github.com/giantswarm/giantswarm/issues/22193

🍕 GA: Networking 🍕

• Replace kube proxy by cilium and ebpf #1072
• Support proxy for CAPO #1783

🍕 GA: Operation 🍕

• Check if etcd backup operator is working

🍕 Milestone: Cleanup 🍕

• Move OpenStack clusters to use flux #809
• Restore externalTrafficPolicy: Local for ingress LBs #625
• Stop using shared auto-unseal token #633
• Optimize requests for Managment Clusters #649
• Cleanup nginx IC services. #858
• Use opsctl vault run in capo-mc-boostrap #837
• Update calico-app to latest version #711
• https://github.com/giantswarm/giantswarm/issues/20778
• Update etcd certificate secrets for vault #874
• https://github.com/giantswarm/giantswarm/issues/22156

Milestone: Later

• Support SubnetPoolId for shared network #893