Add Bucket CORS configuration

[mariomalinditex]

Description of your changes

Add a CORSConfiguration sub-resource to the Bucket managed resource,
following the existing ServerSideEncryptionConfiguration pattern.

• New CORSConfiguration/CORSRule API types and Bucket spec fields
  (corsConfiguration, corsConfigurationDisabled) plus the
  corsConfigurationCondition backend status.
• S3-only implementation via Put/Get/DeleteBucketCors on the S3Client
  interface; no new external dependencies.
• New CORSConfigurationClient sub-resource reconciler wired into the
  bucket controller, autopause checks and per-backend conditions.
• --disable-cors-config-reconcile flag (DISABLE_CORS_CONFIG_RECONCILE).
• Regenerated deepcopy, S3 client fakes and Bucket CRD; added example CR.

I have:

• Run make ready-for-review to ensure this PR is ready for review.
• Run make ceph-chainsaw to validate these changes against Ceph. This step is not always necessary. However, for changes related to S3 calls it is sensible to validate against an actual Ceph cluster. Localstack is used in our CI Chainsaw suite for convenience and there can be disparity in S3 behaviours between it and Ceph. See docs/TESTING.md for information on how to run tests against a Ceph cluster.
• Added backport release-x.y labels to auto-backport this PR if necessary.

How has this code been tested

• Unit tests: Added tests for the CORS helpers (internal/rgw) and the CORSConfigurationClient reconcile flow (internal/controller/bucket) covering create/update, delete, drift, disabled, and unhealthy-backend paths. go test ./... passes.
• Lint & codegen: golangci-lint passes with 0 issues; make generate regenerates the CRD, deepcopy, and S3 client fakes cleanly.
• E2E (Chainsaw): Added CORS coverage (apply corsConfiguration + assert corsConfigurationCondition: Available) to the Localstack suite (e2e/tests/stable, runs in CI) and the Ceph suite (e2e/tests/ceph). Ran the Localstack suite locally against Kind.

[mariomalinditex]

Hi @nolancon , Just checking in on this PR to see if you've had a chance to review it or if there’s anything I can clarify or update.

Thank you!

[nolancon]

Hi @nolancon , Just checking in on this PR to see if you've had a chance to review it or if there’s anything I can clarify or update.

Thank you!

Hi @mariomalinditex and thanks for your contribution!
Apologies for the delay on reviewing this, I've been away recently but will take a look in the coming days.

[Copilot]

Pull request overview

Adds Bucket CORSConfiguration as a first-class subresource (API, controller reconciliation, and S3 backend calls) following the existing ServerSideEncryptionConfiguration pattern, including status conditions and test coverage.

Changes:

• Introduces CORSConfiguration / CORSRule API types and new Bucket spec/status fields (corsConfiguration, corsConfigurationDisabled, corsConfigurationCondition).
• Implements CORS reconciliation against S3 backends via Put/Get/DeleteBucketCors, wiring a new subresource client into the bucket controller and autopause gating.
• Adds unit + e2e coverage, updates generated artifacts (CRD, deepcopy, fakes), and provides a sample manifest.

Reviewed changes

Copilot reviewed 17 out of 19 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
package/crds/provider-ceph.ceph.crossplane.io_buckets.yaml	Regenerated CRD schema to include CORS spec/status fields.
internal/rgw/corsconfiguration.go	Adds RGW helpers for Put/Get/Delete Bucket CORS using S3 client interface.
internal/rgw/corsconfiguration_helpers.go	Adds conversions between CRD CORS types and AWS SDK CORS types + “not found” parsing.
internal/rgw/corsconfiguration_test.go	Unit tests for RGW CORS helper behavior and error handling.
internal/controller/bucket/corsconfiguration.go	New subresource reconciler client for observing/applying/removing CORS per backend.
internal/controller/bucket/corsconfiguration_test.go	Unit tests for CORS subresource observe/handle flows across scenarios.
internal/controller/bucket/subresources.go	Wires the new CORSConfiguration client into the subresource client list.
internal/controller/bucket/helpers.go	Extends autopause criteria to account for CORS availability/removal across backends.
internal/controller/bucket/consts.go	Adds CORS-specific observe/handle error message constants.
internal/controller/bucket/bucket_backends.go	Adds per-backend CORS condition setters/getters + availability/removal checks.
internal/backendstore/backend.go	Extends S3Client interface with Put/Get/DeleteBucketCors methods.
internal/backendstore/backendstorefakes/fake_s3client.go	Regenerates S3 client fake to support new CORS methods.
cmd/provider/main.go	Adds --disable-cors-config-reconcile flag and passes it into bucket connector config.
apis/provider-ceph/v1alpha1/corsconfiguration_types.go	Defines new CORSConfiguration/CORSRule API types.
apis/provider-ceph/v1alpha1/bucket_types.go	Adds CORS fields to Bucket spec and per-backend status.
apis/provider-ceph/v1alpha1/zz_generated.deepcopy.go	Regenerated deepcopy implementations for new fields/types.
examples/sample/bucket-cors.yaml	Adds an example Bucket manifest using corsConfiguration.
e2e/tests/stable/chainsaw-test.yaml	Adds Localstack e2e coverage for CORS config + per-backend condition assertions.
e2e/tests/ceph/chainsaw-test.yaml	Adds Ceph e2e coverage for CORS config + per-backend condition assertions.

Files not reviewed (2)

• apis/provider-ceph/v1alpha1/zz_generated.deepcopy.go: Generated file
• internal/backendstore/backendstorefakes/fake_s3client.go: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[nolancon]

One small comment, otherwise LGTM.

[nolancon]

The vulnerabilities being flagged here are now fixed on main so once conflicts are resolved and CI is happy here then I'm also happy to approve and merge 👍