Skip to content

Add application credential finalizer management #454

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 1 commit into from
Jun 3, 2026
Merged

Add application credential finalizer management #454

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions api/bases/designate.openstack.org_designateapis.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -442,6 +442,13 @@ spec:
type: object
description: API endpoints
type: object
applicationCredentialSecret:
description: |-
ApplicationCredentialSecret - the AC secret DesignateAPI is currently
consuming and protecting with the openstack.org/designateapi-ac-consumer
finalizer. Tracked so the controller can remove its finalizer from the
old secret when the openstack-operator rotates the reference.
type: string
conditions:
description: Conditions
items:
Expand Down
6 changes: 6 additions & 0 deletions api/v1beta1/designateapi_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -122,6 +122,12 @@ type DesignateAPIStatus struct {
// NetworkAttachments status of the deployment pods
NetworkAttachments map[string][]string `json:"networkAttachments,omitempty"`

// ApplicationCredentialSecret - the AC secret DesignateAPI is currently
// consuming and protecting with the openstack.org/designateapi-ac-consumer
// finalizer. Tracked so the controller can remove its finalizer from the
// old secret when the openstack-operator rotates the reference.
ApplicationCredentialSecret string `json:"applicationCredentialSecret,omitempty"`

// ObservedGeneration - the most recent generation observed for this
// service. If the observed generation is less than the spec generation,
// then the controller has not processed the latest changes injected by
Expand Down
7 changes: 7 additions & 0 deletions config/crd/bases/designate.openstack.org_designateapis.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -442,6 +442,13 @@ spec:
type: object
description: API endpoints
type: object
applicationCredentialSecret:
description: |-
ApplicationCredentialSecret - the AC secret DesignateAPI is currently
consuming and protecting with the openstack.org/designateapi-ac-consumer
finalizer. Tracked so the controller can remove its finalizer from the
old secret when the openstack-operator rotates the reference.
type: string
conditions:
description: Conditions
items:
Expand Down
6 changes: 3 additions & 3 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,11 +13,11 @@ require (
github.com/openshift/api v3.9.0+incompatible
github.com/openstack-k8s-operators/designate-operator/api v0.1.1-0.20240807132522-6c2eca7c6bbb
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260508091801-73f228e6af31
github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260507114237-f0b612d6c21f
github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260520090027-4d7b7a01c0bf
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260518125357-72bdd580c587
github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260506154724-30a976ba8ef0
github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260506154724-30a976ba8ef0
github.com/openstack-k8s-operators/mariadb-operator/api v0.6.1-0.20260503164939-40728ae44d65
github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260518125357-72bdd580c587
github.com/openstack-k8s-operators/mariadb-operator/api v0.6.1-0.20260421135251-4fb605db7d18
gopkg.in/yaml.v2 v2.4.0
k8s.io/api v0.31.14
k8s.io/apimachinery v0.31.14
Expand Down
12 changes: 6 additions & 6 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,18 +132,18 @@ github.com/openshift/api v0.0.0-20250711200046-c86d80652a9e h1:E1OdwSpqWuDPCedyU
github.com/openshift/api v0.0.0-20250711200046-c86d80652a9e/go.mod h1:Shkl4HanLwDiiBzakv+con/aMGnVE2MAGvoKp5oyYUo=
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260508091801-73f228e6af31 h1:FWa0vNs175LpV1eSZ60YOGFdbJ3LqxQ1fxfprBRg7T4=
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260508091801-73f228e6af31/go.mod h1:/S2AN21zV70V1XuL0Of2dCjYWNkKwQSyNI8l/iQVrMs=
github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260507114237-f0b612d6c21f h1:28WYAUIef3uion0Pps6doCSSbgZtIcodGzwG6BHhCOw=
github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260507114237-f0b612d6c21f/go.mod h1:4ryvbSYuoN522BIPijnm0wMemPgJVKf7jCv8BNDq46I=
github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260520090027-4d7b7a01c0bf h1:FoKK0zNo48i4ZMFxScupCK/YAmy6Ps4IILz3CK4BCTI=
github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260520090027-4d7b7a01c0bf/go.mod h1:VNX1Mda2u5+yGxycIyVrgABucitMDR9ct3Lj6ROS92I=
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260518125357-72bdd580c587 h1:p03uEXoSreyu7LpFmb9YyYM8tEx2D2+7qqhLXNWHTq0=
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260518125357-72bdd580c587/go.mod h1:JC04T5G4E/he5ukonV1oCqa0QzFkLv761VbLruVghJM=
github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260506154724-30a976ba8ef0 h1:kMie+G0aHlGwDHjimjj8AUxTl2R7LGfai/8pev2T+TY=
github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260506154724-30a976ba8ef0/go.mod h1:7yqbVpg0k0vW+kZks+TMU/cd1ovoejyHfVPWcyGYLHI=
github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260506154724-30a976ba8ef0 h1:wuzSibIT9F/5RbMmxvBVFj6fy2vtKo58nibzmk5L4PM=
github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260506154724-30a976ba8ef0/go.mod h1:tft3oDiN+v6wX3ILPXGUM/gCLJz6QtrPN63hxpJ3E24=
github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260506154724-30a976ba8ef0 h1:mG3QhS/QWv9Y/AkZZ5OzO6hu6+l5oDXnI/Q5ZUbj6Zs=
github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260506154724-30a976ba8ef0/go.mod h1:ZYG9CQe7cOePOKQbenEZFA28kPdkUOe9QKbDRwGhEV0=
github.com/openstack-k8s-operators/mariadb-operator/api v0.6.1-0.20260503164939-40728ae44d65 h1:MNjmU326MKwYU6xT6AL2aKbr/0ids87wP5B+s5CL2O0=
github.com/openstack-k8s-operators/mariadb-operator/api v0.6.1-0.20260503164939-40728ae44d65/go.mod h1:I2LO+wGIzbirVczQ9qo/49y2F5Zo/MEg/pabkXOrY2M=
github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260518125357-72bdd580c587 h1:jpouKcgs2Kc5z2JHIpvsXMxEonfXLgzX3KswuBoeKQ0=
github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260518125357-72bdd580c587/go.mod h1:nLS2oK4pBo756JNN1cPgr44S0X9V11QScgVla89Ojok=
github.com/openstack-k8s-operators/mariadb-operator/api v0.6.1-0.20260421135251-4fb605db7d18 h1:fMMY6pp7+PEkcsdDoodTfJ6ct2RyGI8VB+toVJxxB5w=
github.com/openstack-k8s-operators/mariadb-operator/api v0.6.1-0.20260421135251-4fb605db7d18/go.mod h1:g/xgMnzNHxdTkqnEgAKwVOv75uPN4nuApbkGqSvASvs=
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
Expand Down
50 changes: 50 additions & 0 deletions internal/controller/designateapi_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -528,6 +528,19 @@ func (r *DesignateAPIReconciler) reconcileDelete(ctx context.Context, instance *
); err != nil {
return ctrlResult, err
}
// Remove consumer finalizer from AC secrets DesignateAPI was consuming.
// Check both status and spec to handle the edge case where the reconciler
// crashed after adding the finalizer but before updating the status.
for _, secretName := range []string{
instance.Status.ApplicationCredentialSecret,
instance.Spec.Auth.ApplicationCredentialSecret,
} {
if err := keystonev1.RemoveACSecretConsumerFinalizer(ctx, helper, instance.Namespace,
secretName, designate.ACConsumerFinalizer); err != nil {
return ctrl.Result{}, err
}
}

// We did all the cleanup on the objects we created so we can remove the
// finalizer from ourselves to allow the deletion
controllerutil.RemoveFinalizer(instance, helper.GetFinalizer())
Expand Down Expand Up @@ -905,6 +918,24 @@ func (r *DesignateAPIReconciler) reconcileNormal(ctx context.Context, instance *
return ctrl.Result{}, nil
}

// Add consumer finalizer to the new AC secret early, before deployment.
// The old secret's finalizer is removed later (after all services deploy)
// so that rapid rotations don't revoke a credential still in use by pods.
if instance.Spec.Auth.ApplicationCredentialSecret != "" {
if err := keystonev1.ManageACSecretFinalizer(ctx, helper, instance.Namespace,
instance.Spec.Auth.ApplicationCredentialSecret,
"",
designate.ACConsumerFinalizer); err != nil {
instance.Status.Conditions.Set(condition.FalseCondition(
condition.ServiceConfigReadyCondition,
condition.ErrorReason,
condition.SeverityWarning,
condition.ServiceConfigReadyErrorMessage,
err.Error()))
return ctrl.Result{}, err
}
}

instance.Status.Conditions.MarkTrue(condition.ServiceConfigReadyCondition, condition.ServiceConfigReadyMessage)

// Create ConfigMaps and Secrets - end
Expand Down Expand Up @@ -1088,6 +1119,25 @@ func (r *DesignateAPIReconciler) reconcileNormal(ctx context.Context, instance *
}
// create Deployment - end

// Manage the old AC secret's finalizer and status tracking.
// On rotation (old != new), only remove the old secret's finalizer after
// all sub-services are ready with the new credentials. This prevents
// premature revocation during rapid rotations.
isRotation := instance.Status.ApplicationCredentialSecret != "" && instance.Status.ApplicationCredentialSecret != instance.Spec.Auth.ApplicationCredentialSecret

if isRotation {
allServicesReady := instance.Status.Conditions.AllSubConditionIsTrue()
if allServicesReady {
if err := keystonev1.RemoveACSecretConsumerFinalizer(ctx, helper, instance.Namespace,
instance.Status.ApplicationCredentialSecret, designate.ACConsumerFinalizer); err != nil {
return ctrl.Result{}, err
}
instance.Status.ApplicationCredentialSecret = instance.Spec.Auth.ApplicationCredentialSecret
}
} else {
instance.Status.ApplicationCredentialSecret = instance.Spec.Auth.ApplicationCredentialSecret
}

// We reached the end of the Reconcile, update the Ready condition based on
// the sub conditions
if instance.Status.Conditions.AllSubConditionIsTrue() {
Expand Down
3 changes: 3 additions & 0 deletions internal/designate/const.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,4 +101,7 @@ const (

// SharedTSIGKeyName is the name of the shared TSIG key used for all non-default pools
SharedTSIGKeyName = "multipool-shared-key"

// ACConsumerFinalizer is added to AC secrets that designate is actively consuming
ACConsumerFinalizer = "openstack.org/designateapi-ac-consumer"
)
Loading