Switch OVN backups to using Swift.

[awfabian-rs]

JIRA:OSPC-432

[awfabian-rs]

The OVN pod doesn't have Python or a lot of tools. Perl looked like the best thing available for parsing the JSON to get the object-store URL out of the service catalog.

This switches to using Ceph's Swift API to using keystone and Swift.

I tried this out on my test cluster.

[awfabian-rs]

Please review and merge or request changes.

The OVN backup stuff started looking a little cluttered, so I put it in a subdirectory. That also helped me use:

commonLabels:
  app: ovn-backup

to label the resources, which let me do something like:

kubectl apply -k /opt/genestack/kustomize/ovn/ovn-backup \
--prune -l app=ovn-backup \
--prune-allowlist=core/v1/Secret \
--prune-allowlist=core/v1/ConfigMap

to apply changes without collecting old generated Secrets and ConfigMaps.

[cloudnull]

qq - instead of using a set of scripts can we use the openstack client to upload the our backups?

[awfabian-rs]

@cloudnull I mostly did it this way to avoid installing dependencies. From container images generally available, I could get one with the OpenStack command, or one with kubectl-ko to actually do the OVN backup, but not both. So I would need to download and install one or the other, which would put an additional point of failure in the backup process.

So, I see three options:

1. do it with the scripts like this
2. install the openstack command when the backup pod runs
3. make a container image with the tools

3 seems like the cleanest and most logical option, but I don't think we have any really custom-built container images and a location for them set up yet.

Let me know how you think we should proceed here. We might already have a place for our own container images I don't know about yet!

[awfabian-rs]

aedan, maybe the2hill, showed me this in the standup: https://github.com/rackerlabs/genestack/tree/main/Containerfiles

I think the entire process of getting an image there seems a bit involved for this.

Another option seems like running the OpenStack client in a separate container in the pod, and passing it through the /backup file system.

Also, I think we will ultimately end up wanting to use Swift tempauth for things like this, which I think might end up eliminating a lot of the need for the machinery of parsing a service catalog, since I think it just does authentication, gives you a token, and it doesn't give you a service catalog anyway.

[awfabian-rs]

closing in favor of #304