THREESCALE-11884 - Fix unable to set ApplicationKey by ApplicationAuth CR when using OIDC auth

[tkan145]

What

Close #1078

Fix:

• https://issues.redhat.com/browse/THREESCALE-11884
• https://issues.redhat.com/browse/THREESCALE-11911

Verification steps:

• Checkout this branch
• Prepare local env

make cluster/prepare/local

• Install APIM

export NAMESPACE=3scale-test

cat << EOF | oc create -f -
kind: Secret
apiVersion: v1
metadata:
  name: s3-credentials
  namespace: $NAMESPACE
data:
  AWS_ACCESS_KEY_ID: c29tZXRoaW5nCg==
  AWS_BUCKET: c29tZXRoaW5nCg==
  AWS_REGION: dXMtd2VzdC0xCg==
  AWS_SECRET_ACCESS_KEY: c29tZXRoaW5nCg==
type: Opaque
EOF

DOMAIN=$(oc get routes console -n openshift-console -o json | jq -r '.status.ingress[0].routerCanonicalHostname' | sed 's/router-default.//')
cat << EOF | oc create -f -
kind: APIManager
apiVersion: apps.3scale.net/v1alpha1
metadata:
  name: 3scale
  namespace: $NAMESPACE
spec:
  wildcardDomain: $DOMAIN
  system:
    fileStorage:
      simpleStorageService:
        configurationSecretRef:
          name: s3-credentials
  externalComponents:
    backend:
      redis: true
    system:
      database: true
      redis: true
EOF

• Start the operator and wait for all pods to come online
• Open another terminal and setup the product

Details

DOMAIN=$(oc get routes console -n openshift-console -o json | jq -r '.status.ingress[0].routerCanonicalHostname' | sed 's/router-default.//')
ADMIN_ACCESS_TOKEN=$(oc get secret system-seed -n 3scale-test -o jsonpath="{.data.ADMIN_ACCESS_TOKEN}"| base64 --decode)

cat << EOF |oc apply -f -
---
apiVersion: v1
kind: Secret
metadata:
  name: mytenant
type: Opaque
stringData:
  adminURL: https://3scale-admin.$DOMAIN
  token: $ADMIN_ACCESS_TOKEN
---
apiVersion: v1
kind: Secret
metadata:
  name: myusername01
stringData:
  password: "123456"
EOF

cat << EOF | oc apply -f -
---
apiVersion: capabilities.3scale.net/v1beta1
kind: DeveloperUser
metadata:
  name: developeruser01
  namespace: 3scale-test
  annotations:
    "insecure_skip_verify": "true"
spec:
  developerAccountRef:
    name: developeraccount01
  email: myusername01@example.com
  passwordCredentialsRef:
    name: myusername01
  providerAccountRef:
    name: mytenant
  role: admin
  username: myusername01
EOF

sleep 30

cat << EOF | oc apply -f -
---
apiVersion: capabilities.3scale.net/v1beta1
kind: DeveloperAccount
metadata:
  name: developeraccount01
  namespace: 3scale-test
  annotations:
    "insecure_skip_verify": "true"
spec:
  orgName: 3scale-test
  providerAccountRef:
    name: mytenant
EOF

cat << EOF | oc apply -f -
---
apiVersion: capabilities.3scale.net/v1beta1
kind: Backend
metadata:
  name: backend1-cr
  namespace: 3scale-test
  annotations:
    "insecure_skip_verify": "true"
spec:
  mappingRules:
    - httpMethod: GET
      increment: 1
      last: true
      metricMethodRef: hits
      pattern: /
    - httpMethod: POST
      pattern : "/"
      metricMethodRef: hits
      increment: 1    
  name: backend1
  privateBaseURL: 'http://httpbin.httpbin.svc:8080'
  systemName: backend1
EOF

cat << EOF | oc apply -f -
---
apiVersion: capabilities.3scale.net/v1beta1
kind: Product
metadata:
  name: product1-cr
  namespace: 3scale-test
  annotations:
    "insecure_skip_verify": "true"
spec:
  applicationPlans:
    plan01:
      name: "My Plan 01"
  deployment:
    apicastHosted:
      authentication:
        userkey:
          authUserKey: token
  name: product1
  backendUsages:
    backend1:
      path: /
  mappingRules:
    - httpMethod: GET
      pattern : "/"
      metricMethodRef: hits
      increment: 1
    - httpMethod: POST
      pattern : "/"
      metricMethodRef: hits
      increment: 1    
EOF

cat << EOF | oc apply -f -
---
apiVersion: capabilities.3scale.net/v1beta1
kind: Application
metadata:
  name: application-cr
  namespace: 3scale-test
  annotations:
    "insecure_skip_verify": "true"
spec:
  accountCR: 
    name: developeraccount01
  applicationPlanName: plan01
  productCR: 
    name: product1-cr
  name: testApp
  description: further testing
EOF

cat << EOF | oc apply -f -
---
apiVersion: capabilities.3scale.net/v1beta1
kind: ProxyConfigPromote
metadata:
  name: product1-v1-production
  namespace: 3scale-test
  annotations:
    "insecure_skip_verify": "true"
spec:
  productCRName: product1-cr
  production: true
  deleteCR: true
EOF

sleep 30
echo Product Route: 
echo "https://$(oc get routes | grep product1 |grep production| awk '{print $2}')" 
echo
echo User_key: 
echo $(curl -s -X 'GET' "https://3scale-admin.$DOMAIN/admin/api/applications.xml?access_token=$ADMIN_ACCESS_TOKEN&page=1&per_page=500&service_id=3" -H 'accept: */*' | grep -oP '<user_key>\K[^<]+' | sed 's/\s//g')

NOTE: user_key is set to custom field called token

• Prepare ApplicationAuth CR

Details

cat << EOF | oc create -f -
kind: Secret
apiVersion: v1
metadata:
  name: auth-secret
  namespace: 3scale-test
data:
  ApplicationID: ''
  ApplicationKey: ''
  UserKey: >-
    dGVzdGtleQo=
type: Opaque
EOF

oc apply -f - <<EOF
---
apiVersion: capabilities.3scale.net/v1beta1
kind: ApplicationAuth
metadata:
  name: applicationauthcr1
  namespace: 3scale-test
  annotations:
    "insecure_skip_verify": "true"
spec:
  applicationCRName: application-cr 
  generateSecret: true
  authSecretRef: 
     name: auth-secret-unknown
EOF

• Check ApplicationAuth CR, you should see the

{                                                         
    "lastTransitionTime": "2025-09-01T07:00:46Z",         
    "message": "Secret \"auth-secret-unknown\" not found",
    "status": "True",                                     
    "type": "Failed"                                      
},

• Update ApplicationAuth to use correct secret

oc apply -f - <<EOF
---
apiVersion: capabilities.3scale.net/v1beta1
kind: ApplicationAuth
metadata:
  name: applicationauthcr1
  namespace: 3scale-test
  annotations:
    "insecure_skip_verify": "true"
spec:
  applicationCRName: application-cr 
  generateSecret: true
  authSecretRef: 
     name: auth-secret
EOF

• This time it should reconcile successfully

{                                                                                                                                  
    "lastTransitionTime": "2025-09-01T07:03:14Z",                                                                                  
    "message": "Application authentication has been successfully pushed, any further interactions with this CR will not be applied"
    "status": "True",                                                                                                              
    "type": "Ready"                                                                                                                
}                                                                                                                                  

• Login to admin portal and navigate to

Products -> product1 -> Integration -> Settings 

Under API Key (user_key) Basics you shall see Auth user key is set to token

• Now navigate to

Products -> product1 -> Application -> listing -> testApp

you should see User Key is set to testkey

• Update auth-secret and set UserKey to testkey2
• Delete ApplicationAuth CR
• Recreate ApplicationAuth CR

oc apply -f - <<EOF
---
apiVersion: capabilities.3scale.net/v1beta1
kind: ApplicationAuth
metadata:
  name: applicationauthcr1
  namespace: 3scale-test
  annotations:
    "insecure_skip_verify": "true"
spec:
  applicationCRName: application-cr 
  generateSecret: true
  authSecretRef: 
     name: auth-secret
EOF

• Once the CR is ready, the user_key in the admin portal should be updated to testkey2

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[briangallagher]

🎉 Snyk checks have passed. No issues have been found so far.

✅ security/snyk check is complete. No issues have been found. (View Details)

✅ license/snyk check is complete. No issues have been found. (View Details)

[openshift-ci]

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

@tkan145: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/test-integration	27f62bf	link	true	/test test-integration

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.