PersonalOrganizationController

​

Overview

1. A personal Organization for each user
2. An OrganizationMembership granting the user owner permissions
3. A default personal Project within the organization

​

Reconciliation Logic

​

1. User Validation

• Fetches the User resource
• Skips reconciliation if user is not found or is being deleted

​

2. Personal Organization Creation

apiVersion: resourcemanager.miloapis.com/v1alpha1
kind: Organization
metadata:
  name: personal-org-<hash>
  annotations:
    kubernetes.io/display-name: "John Doe's Personal Org"
    kubernetes.io/description: "John Doe's Personal Org"
spec:
  type: Personal

• Name is generated using a hash of the user’s UID: personal-org-<hash>
• Display name uses the user’s given name and family name
• Type is set to Personal (cannot be changed)
• Controller reference is set to the User resource (organization is deleted when user is deleted)

​

3. Organization Membership Creation

apiVersion: resourcemanager.miloapis.com/v1alpha1
kind: OrganizationMembership
metadata:
  name: membership-<username>
  namespace: organization-<org-name>
spec:
  organizationRef:
    name: personal-org-<hash>
  userRef:
    name: <username>
  roles:
    - name: datum-cloud-owner
      namespace: datum-assignable-organization-roles

• Created in the organization’s namespace
• Grants the configured owner role to the user
• Default role: datum-cloud-owner in namespace datum-assignable-organization-roles

​

4. Personal Project Creation

apiVersion: resourcemanager.miloapis.com/v1alpha1
kind: Project
metadata:
  name: personal-project-<hash>
  annotations:
    kubernetes.io/display-name: "Personal Project"
    kubernetes.io/description: "John Doe's Personal Project"

• Only created if user’s registration approval is Approved
• Uses user impersonation to trigger project webhook correctly
• Project webhook automatically creates PolicyBinding granting ownership
• Requeues every 5 seconds if user is not yet approved

​

Configuration

​

Example Configuration

apiVersion: config.datumapis.com/v1alpha1
kind: DatumControllerManager
personalOrganizationController:
  roleName: datum-cloud-owner
  roleNamespace: datum-assignable-organization-roles

​

RBAC Permissions

​

Reconciliation Behavior

​

Idempotency

• Organizations are only created once per user
• Existing resources are updated if specifications change
• Safe to run multiple reconciliation loops

​

User Impersonation

• Project webhook sees the correct user identity
• PolicyBinding is created with the right owner
• Proper RBAC validation occurs

impersonatedConfig.Impersonate = rest.ImpersonationConfig{
    UserName: user.Spec.Email,
    UID:      user.Name,
    Groups:   []string{"system:authenticated"},
    Extra: map[string][]string{
        "iam.miloapis.com/parent-name":      {personalOrg.Name},
        "iam.miloapis.com/parent-type":      {"Organization"},
        "iam.miloapis.com/parent-api-group": {"resourcemanager.miloapis.com"},
    },
}

​

Requeue Logic

​

Error Handling

​

User Not Found

if apierrors.IsNotFound(err) {
    logger.Info("User not found, skipping reconciliation")
    return ctrl.Result{}, nil
}

​

Project Already Exists

if apierrors.IsAlreadyExists(err) {
    logger.Info("Personal project already exists (race)")
}

​

User Being Deleted

if !user.DeletionTimestamp.IsZero() {
    logger.Info("User is being deleted, skipping reconciliation")
    return ctrl.Result{}, nil
}

​

Hash Generation

func hashPersonalOrgName(name string) string {
    hasher := fnv.New32a()
    hasher.Write([]byte(name))
    return hex.EncodeToString(hasher.Sum(nil))
}

• Consistent naming across reconciliation loops
• No name collisions between users
• Human-readable hash format (8 hex characters)

​

Watch Configuration

ctrl.NewControllerManagedBy(mgr).
    For(&iamv1alpha1.User{}).
    Named("personal-organization").
    Complete(r)

• User creation
• User updates (e.g., registration approval changes)
• Does NOT watch Organization or Project resources directly

​

Examples

​

Viewing Created Resources

# List all personal organizations
kubectl get organizations -l type=Personal

# Get details for a specific user's organization
kubectl get organization personal-org-<hash> -o yaml

# View organization memberships
kubectl get organizationmemberships -n organization-personal-org-<hash>

# List personal projects
kubectl get projects -l owner=<username>

​

Monitoring Controller Logs

# Follow controller logs
kubectl logs -f deployment/datum-controller-manager -n datum-system

# Filter for personal organization reconciliation
kubectl logs deployment/datum-controller-manager -n datum-system | grep "personal-organization"

​

Source Reference