Application Credential support

Deydra71 · xek · commit 373d0245cc6f · 2026-01-28T12:22:11.000+01:00
diff --git a/api/bases/glance.openstack.org_glanceapis.yaml b/api/bases/glance.openstack.org_glanceapis.yaml
@@ -65,6 +65,14 @@ spec:
                 - single
                 - edge
                 type: string
+              auth:
+                description: Auth - Parameters related to authentication
+                properties:
+                  applicationCredentialSecret:
+                    description: ApplicationCredentialSecret - Secret containing Application
+                      Credential ID and Secret
+                    type: string
+                type: object
               containerImage:
                 description: ContainerImage - GlanceAPI Container Image URL
                 type: string
diff --git a/api/bases/glance.openstack.org_glances.yaml b/api/bases/glance.openstack.org_glances.yaml
@@ -1229,6 +1229,14 @@ spec:
                         APITimeout
                       minimum: 1
                       type: integer
+                    auth:
+                      description: Auth - Parameters related to authentication
+                      properties:
+                        applicationCredentialSecret:
+                          description: ApplicationCredentialSecret - Secret containing
+                            Application Credential ID and Secret
+                          type: string
+                      type: object
                     customServiceConfig:
                       description: |-
                         CustomServiceConfig - customize the service config using this parameter to change service defaults,
diff --git a/api/v1beta1/common_types.go b/api/v1beta1/common_types.go
@@ -19,12 +19,12 @@ package v1beta1
 import (
 	"strings"
 
+	topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/service"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/tls"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/util"
-	topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1"
-	"k8s.io/apimachinery/pkg/util/validation/field"
 	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/util/validation/field"
 )
 
 const (
@@ -100,6 +100,11 @@ type GlanceAPITemplate struct {
 	// TLS - Parameters related to the TLS
 	TLS tls.API `json:"tls,omitempty"`
 
+	// +kubebuilder:validation:Optional
+	// +operator-sdk:csv:customresourcedefinitions:type=spec
+	// Auth - Parameters related to authentication
+	Auth AuthSpec `json:"auth,omitempty"`
+
 	// ImageCache - It represents the struct to expose the ImageCache related
 	// parameters (size of the PVC and cronJob schedule)
 	// +kubebuilder:validation:Optional
@@ -147,6 +152,14 @@ type APIOverrideSpec struct {
 	Service map[service.Endpoint]service.RoutedOverrideSpec `json:"service,omitempty"`
 }
 
+// AuthSpec defines authentication parameters
+type AuthSpec struct {
+	// +kubebuilder:validation:Optional
+	// +operator-sdk:csv:customresourcedefinitions:type=spec
+	// ApplicationCredentialSecret - Secret containing Application Credential ID and Secret
+	ApplicationCredentialSecret string `json:"applicationCredentialSecret,omitempty"`
+}
+
 // SetupDefaults - initializes any CRD field defaults based on environment variables (the defaulting mechanism itself is implemented via webhooks)
 func SetupDefaults() {
 	// Acquire environmental defaults and initialize Glance defaults with them
diff --git a/api/v1beta1/glance_webhook.go b/api/v1beta1/glance_webhook.go
@@ -21,6 +21,7 @@ import (
 	"strings"
 
 	"github.com/google/go-cmp/cmp"
+	topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/service"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -29,7 +30,6 @@ import (
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/webhook"
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
-	topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1"
 
 	common_webhook "github.com/openstack-k8s-operators/lib-common/modules/common/webhook"
 )
@@ -157,7 +157,6 @@ func (r *GlanceSpecCore) Default() {
 	}
 }
 
-
 // Check if File is used as a backend for Glance
 func isFileBackend(customServiceConfig string, topLevel bool) bool {
 	availableBackends := GetEnabledBackends(customServiceConfig)
diff --git a/api/v1beta1/glanceapi_webhook.go b/api/v1beta1/glanceapi_webhook.go
@@ -17,13 +17,14 @@ limitations under the License.
 package v1beta1
 
 import (
+	"fmt"
+
+	"github.com/google/go-cmp/cmp"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/runtime"
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/webhook"
-	"fmt"
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
-	"github.com/google/go-cmp/cmp"
-	apierrors "k8s.io/apimachinery/pkg/api/errors"
 )
 
 // GlanceAPIDefaults -
diff --git a/api/v1beta1/zz_generated.deepcopy.go b/api/v1beta1/zz_generated.deepcopy.go
diff --git a/config/crd/bases/glance.openstack.org_glanceapis.yaml b/config/crd/bases/glance.openstack.org_glanceapis.yaml
@@ -65,6 +65,14 @@ spec:
                 - single
                 - edge
                 type: string
+              auth:
+                description: Auth - Parameters related to authentication
+                properties:
+                  applicationCredentialSecret:
+                    description: ApplicationCredentialSecret - Secret containing Application
+                      Credential ID and Secret
+                    type: string
+                type: object
               containerImage:
                 description: ContainerImage - GlanceAPI Container Image URL
                 type: string
diff --git a/config/crd/bases/glance.openstack.org_glances.yaml b/config/crd/bases/glance.openstack.org_glances.yaml
@@ -1229,6 +1229,14 @@ spec:
                         APITimeout
                       minimum: 1
                       type: integer
+                    auth:
+                      description: Auth - Parameters related to authentication
+                      properties:
+                        applicationCredentialSecret:
+                          description: ApplicationCredentialSecret - Secret containing
+                            Application Credential ID and Secret
+                          type: string
+                      type: object
                     customServiceConfig:
                       description: |-
                         CustomServiceConfig - customize the service config using this parameter to change service defaults,
diff --git a/go.mod b/go.mod
@@ -13,7 +13,7 @@ require (
 	github.com/openstack-k8s-operators/glance-operator/api v0.0.0-00010101000000-000000000000
 	github.com/openstack-k8s-operators/horizon-operator/api v0.6.1-0.20260111154931-be9fdcb15911
 	github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260115124008-0121df869109
-	github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260116230254-f54dd51650ac
+	github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260120112029-cd452f0497ba
 	github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20251230215914-6ba873b49a35
 	github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20251230215914-6ba873b49a35
 	github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20251230215914-6ba873b49a35
diff --git a/go.sum b/go.sum
@@ -124,8 +124,8 @@ github.com/openstack-k8s-operators/horizon-operator/api v0.6.1-0.20260111154931-
 github.com/openstack-k8s-operators/horizon-operator/api v0.6.1-0.20260111154931-be9fdcb15911/go.mod h1:j4xehAICMmNT/2VnRcOToMHZA9/Nj0SsiyETceUK7Pc=
 github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260115124008-0121df869109 h1:S+A67nntHZrL1lIL3qr91CpJj+A67M/G4t1cTKzeGdo=
 github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260115124008-0121df869109/go.mod h1:ZXwFlspJCdZEUjMbmaf61t5AMB4u2vMyAMMoe/vJroE=
-github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260116230254-f54dd51650ac h1:DZ/Cw3l4fQXTu2O78HAPIEhSYYZ7cR+QZv893Z+gvNU=
-github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260116230254-f54dd51650ac/go.mod h1:xqvebn9DqLavxp2z8Rz/7i1S6M9MJhxmZVHC+S1uHX0=
+github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260120112029-cd452f0497ba h1:4VaDkZFawGCkzwvfijnFLz0Gduxh17buj9fIwk0WULo=
+github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260120112029-cd452f0497ba/go.mod h1:xqvebn9DqLavxp2z8Rz/7i1S6M9MJhxmZVHC+S1uHX0=
 github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20251230215914-6ba873b49a35 h1:pF3mJ3nwq6r4qwom+rEWZNquZpcQW/iftHlJ1KPIDsk=
 github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20251230215914-6ba873b49a35/go.mod h1:kycZyoe7OZdW1HUghr2nI3N7wSJtNahXf6b/ypD14f4=
 github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20251230215914-6ba873b49a35 h1:IdcI8DFvW8rXtchONSzbDmhhRp1YyO2YaBJDBXr44Gk=
diff --git a/internal/controller/glance_common.go b/internal/controller/glance_common.go
@@ -58,6 +58,7 @@ const (
 	tlsAPIPublicField          = ".spec.tls.api.public.secretName"
 	topologyField              = ".spec.topologyRef.Name"
 	notificationBusSecretField = ".spec.notificationBusSecret"
+	authAppCredSecretField     = ".spec.auth.applicationCredentialSecret" // #nosec G101
 )
 
 var (
@@ -71,6 +72,7 @@ var (
 		tlsAPIPublicField,
 		topologyField,
 		notificationBusSecretField,
+		authAppCredSecretField,
 	}
 )
 
diff --git a/internal/controller/glanceapi_controller.go b/internal/controller/glanceapi_controller.go
@@ -286,6 +286,18 @@ func (r *GlanceAPIReconciler) SetupWithManager(ctx context.Context, mgr ctrl.Man
 		return err
 	}
 
+	// index authAppCredSecretField
+	if err := mgr.GetFieldIndexer().IndexField(context.Background(), &glancev1.GlanceAPI{}, authAppCredSecretField, func(rawObj client.Object) []string {
+		// Extract the application credential secret name from the spec, if one is provided
+		cr := rawObj.(*glancev1.GlanceAPI)
+		if cr.Spec.Auth.ApplicationCredentialSecret == "" {
+			return nil
+		}
+		return []string{cr.Spec.Auth.ApplicationCredentialSecret}
+	}); err != nil {
+		return err
+	}
+
 	// Watch for changes to any CustomServiceConfigSecrets. Global secrets
 	svcSecretFn := func(_ context.Context, o client.Object) []reconcile.Request {
 		var namespace = o.GetNamespace()
@@ -1285,6 +1297,27 @@ func (r *GlanceAPIReconciler) generateServiceConfig(
 		"Wsgi":         wsgi,
 	}
 
+	templateParameters["UseApplicationCredentials"] = false
+	// Try to get Application Credential from the secret specified in the CR
+	if instance.Spec.Auth.ApplicationCredentialSecret != "" {
+		secret := &corev1.Secret{}
+		key := types.NamespacedName{Namespace: instance.Namespace, Name: instance.Spec.Auth.ApplicationCredentialSecret}
+		if err := r.Get(ctx, key, secret); err != nil {
+			if !k8s_errors.IsNotFound(err) {
+				Log.Error(err, "Failed to get ApplicationCredential secret", "secret", key)
+			}
+		} else {
+			acID, okID := secret.Data[keystonev1.ACIDSecretKey]
+			acSecret, okSecret := secret.Data[keystonev1.ACSecretSecretKey]
+			if okID && len(acID) > 0 && okSecret && len(acSecret) > 0 {
+				templateParameters["UseApplicationCredentials"] = true
+				templateParameters["ACID"] = string(acID)
+				templateParameters["ACSecret"] = string(acSecret)
+				Log.Info("Using ApplicationCredentials auth", "secret", key)
+			}
+		}
+	}
+
 	// (OSPRH-18291)Only set EndpointID parameter when the Endpoint has been
 	// created and the associated ID is set in the keystoneapi CR. Because we
 	// have the Keystone CR, we get the Region parameter mirrored in its
diff --git a/templates/common/config/00-config.conf b/templates/common/config/00-config.conf
@@ -41,9 +41,18 @@ default_backend=default_backend
 [keystone_authtoken]
 www_authenticate_uri={{ .KeystonePublicURL }}
 auth_url={{ .KeystoneInternalURL }}
-auth_type=password
-username={{ .ServiceUser }}
+{{ if .UseApplicationCredentials -}}
+auth_type = v3applicationcredential
+application_credential_id = {{ .ACID }}
+application_credential_secret = {{ .ACSecret }}
+{{ else -}}
+auth_type = password
+username = {{ .ServiceUser }}
 password = {{ .ServicePassword }}
+project_domain_name = Default
+user_domain_name = Default
+project_name = service
+{{- end }}
 {{ if (index . "MemcachedServers") }}
 memcached_servers = {{ .MemcachedServers }}
 memcache_pool_dead_retry = 10
@@ -63,7 +72,14 @@ region_name = {{ .Region }}
 {{ end -}}
 
 [service_user]
+{{ if .UseApplicationCredentials -}}
+auth_type = v3applicationcredential
+application_credential_id = {{ .ACID }}
+application_credential_secret = {{ .ACSecret }}
+{{ else -}}
+auth_type = password
 password = {{ .ServicePassword }}
+{{- end }}
 
 [oslo_messaging_notifications]
 {{ if (index . "TransportURL") -}}
@@ -97,11 +113,17 @@ filesystem_store_datadir = /var/lib/glance/os_glance_tasks_store/
 
 [oslo_limit]
 auth_url={{ .KeystoneInternalURL }}
+{{ if .UseApplicationCredentials -}}
+auth_type = v3applicationcredential
+application_credential_id = {{ .ACID }}
+application_credential_secret = {{ .ACSecret }}
+{{ else -}}
 auth_type = password
 username={{ .ServiceUser }}
 password = {{ .ServicePassword }}
 system_scope = all
 user_domain_id = default
+{{- end }}
 {{ if (index . "EndpointID") -}}
 endpoint_id = {{ .EndpointID }}
 {{ end -}}
diff --git a/test/functional/glanceapi_controller_test.go b/test/functional/glanceapi_controller_test.go

Original file line number	Diff line number	Diff line change
`@@ -21,6 +21,7 @@ import (`
`21`	`21`	`"strings"`
`22`	`22`
`23`	`23`	`"github.com/google/go-cmp/cmp"`
	`24`	`+ topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1"`
`24`	`25`	`"github.com/openstack-k8s-operators/lib-common/modules/common/service"`
`25`	`26`	`apierrors "k8s.io/apimachinery/pkg/api/errors"`
`26`	`27`	`"k8s.io/apimachinery/pkg/runtime"`
`@@ -29,7 +30,6 @@ import (`
`29`	`30`	`logf "sigs.k8s.io/controller-runtime/pkg/log"`
`30`	`31`	`"sigs.k8s.io/controller-runtime/pkg/webhook"`
`31`	`32`	`"sigs.k8s.io/controller-runtime/pkg/webhook/admission"`
`32`		`- topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1"`
`33`	`33`
`34`	`34`	`common_webhook "github.com/openstack-k8s-operators/lib-common/modules/common/webhook"`
`35`	`35`	`)`
`@@ -157,7 +157,6 @@ func (r *GlanceSpecCore) Default() {`
`157`	`157`	`}`
`158`	`158`	`}`
`159`	`159`
`160`		`-`
`161`	`160`	`// Check if File is used as a backend for Glance`
`162`	`161`	`func isFileBackend(customServiceConfig string, topLevel bool) bool {`
`163`	`162`	`availableBackends := GetEnabledBackends(customServiceConfig)`