Application Credential support

xek · Deydra71 · cursoragent · Deydra71 · commit a15750f874c0 · 2026-02-02T12:00:01.000+01:00
Co-authored-by: Veronika Fisarova &lt;vfisarov@redhat.com&gt;
Co-authored-by: Cursor &lt;cursoragent@cursor.com&gt;
diff --git a/api/bases/glance.openstack.org_glanceapis.yaml b/api/bases/glance.openstack.org_glanceapis.yaml
@@ -65,6 +65,14 @@ spec:
                 - single
                 - edge
                 type: string
+              auth:
+                description: Auth - Parameters related to authentication
+                properties:
+                  applicationCredentialSecret:
+                    description: ApplicationCredentialSecret - Secret containing Application
+                      Credential ID and Secret
+                    type: string
+                type: object
               containerImage:
                 description: ContainerImage - GlanceAPI Container Image URL
                 type: string
diff --git a/api/bases/glance.openstack.org_glances.yaml b/api/bases/glance.openstack.org_glances.yaml
@@ -1229,6 +1229,14 @@ spec:
                         APITimeout
                       minimum: 1
                       type: integer
+                    auth:
+                      description: Auth - Parameters related to authentication
+                      properties:
+                        applicationCredentialSecret:
+                          description: ApplicationCredentialSecret - Secret containing
+                            Application Credential ID and Secret
+                          type: string
+                      type: object
                     customServiceConfig:
                       description: |-
                         CustomServiceConfig - customize the service config using this parameter to change service defaults,
diff --git a/api/v1beta1/common_types.go b/api/v1beta1/common_types.go
@@ -19,12 +19,12 @@ package v1beta1
 import (
 	"strings"
 
+	topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/service"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/tls"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/util"
-	topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1"
-	"k8s.io/apimachinery/pkg/util/validation/field"
 	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/util/validation/field"
 )
 
 const (
@@ -100,6 +100,11 @@ type GlanceAPITemplate struct {
 	// TLS - Parameters related to the TLS
 	TLS tls.API `json:"tls,omitempty"`
 
+	// +kubebuilder:validation:Optional
+	// +operator-sdk:csv:customresourcedefinitions:type=spec
+	// Auth - Parameters related to authentication
+	Auth AuthSpec `json:"auth,omitempty"`
+
 	// ImageCache - It represents the struct to expose the ImageCache related
 	// parameters (size of the PVC and cronJob schedule)
 	// +kubebuilder:validation:Optional
@@ -147,6 +152,14 @@ type APIOverrideSpec struct {
 	Service map[service.Endpoint]service.RoutedOverrideSpec `json:"service,omitempty"`
 }
 
+// AuthSpec defines authentication parameters
+type AuthSpec struct {
+	// +kubebuilder:validation:Optional
+	// +operator-sdk:csv:customresourcedefinitions:type=spec
+	// ApplicationCredentialSecret - Secret containing Application Credential ID and Secret
+	ApplicationCredentialSecret string `json:"applicationCredentialSecret,omitempty"`
+}
+
 // SetupDefaults - initializes any CRD field defaults based on environment variables (the defaulting mechanism itself is implemented via webhooks)
 func SetupDefaults() {
 	// Acquire environmental defaults and initialize Glance defaults with them
diff --git a/api/v1beta1/glance_webhook.go b/api/v1beta1/glance_webhook.go
@@ -21,6 +21,7 @@ import (
 	"strings"
 
 	"github.com/google/go-cmp/cmp"
+	topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/service"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -29,7 +30,6 @@ import (
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/webhook"
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
-	topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1"
 
 	common_webhook "github.com/openstack-k8s-operators/lib-common/modules/common/webhook"
 )
@@ -157,7 +157,6 @@ func (r *GlanceSpecCore) Default() {
 	}
 }
 
-
 // Check if File is used as a backend for Glance
 func isFileBackend(customServiceConfig string, topLevel bool) bool {
 	availableBackends := GetEnabledBackends(customServiceConfig)
diff --git a/api/v1beta1/glanceapi_webhook.go b/api/v1beta1/glanceapi_webhook.go
@@ -17,13 +17,14 @@ limitations under the License.
 package v1beta1
 
 import (
+	"fmt"
+
+	"github.com/google/go-cmp/cmp"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/runtime"
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/webhook"
-	"fmt"
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
-	"github.com/google/go-cmp/cmp"
-	apierrors "k8s.io/apimachinery/pkg/api/errors"
 )
 
 // GlanceAPIDefaults -
diff --git a/api/v1beta1/zz_generated.deepcopy.go b/api/v1beta1/zz_generated.deepcopy.go
diff --git a/config/crd/bases/glance.openstack.org_glanceapis.yaml b/config/crd/bases/glance.openstack.org_glanceapis.yaml
@@ -65,6 +65,14 @@ spec:
                 - single
                 - edge
                 type: string
+              auth:
+                description: Auth - Parameters related to authentication
+                properties:
+                  applicationCredentialSecret:
+                    description: ApplicationCredentialSecret - Secret containing Application
+                      Credential ID and Secret
+                    type: string
+                type: object
               containerImage:
                 description: ContainerImage - GlanceAPI Container Image URL
                 type: string
diff --git a/config/crd/bases/glance.openstack.org_glances.yaml b/config/crd/bases/glance.openstack.org_glances.yaml
@@ -1229,6 +1229,14 @@ spec:
                         APITimeout
                       minimum: 1
                       type: integer
+                    auth:
+                      description: Auth - Parameters related to authentication
+                      properties:
+                        applicationCredentialSecret:
+                          description: ApplicationCredentialSecret - Secret containing
+                            Application Credential ID and Secret
+                          type: string
+                      type: object
                     customServiceConfig:
                       description: |-
                         CustomServiceConfig - customize the service config using this parameter to change service defaults,
diff --git a/internal/controller/glance_common.go b/internal/controller/glance_common.go
@@ -48,6 +48,8 @@ import (
 // Common static errors for glance controllers
 var (
 	ErrNetworkAttachmentConfig = errors.New("not all pods have interfaces with ips as configured in NetworkAttachments")
+	ErrACSecretNotFound        = errors.New("ApplicationCredential secret not found")
+	ErrACSecretMissingKeys     = errors.New("ApplicationCredential secret missing required keys")
 )
 
 // fields to index to reconcile when change
@@ -58,6 +60,7 @@ const (
 	tlsAPIPublicField          = ".spec.tls.api.public.secretName"
 	topologyField              = ".spec.topologyRef.Name"
 	notificationBusSecretField = ".spec.notificationBusSecret"
+	authAppCredSecretField     = ".spec.auth.applicationCredentialSecret" // #nosec G101
 )
 
 var (
@@ -71,6 +74,7 @@ var (
 		tlsAPIPublicField,
 		topologyField,
 		notificationBusSecretField,
+		authAppCredSecretField,
 	}
 )
 
diff --git a/internal/controller/glanceapi_controller.go b/internal/controller/glanceapi_controller.go
@@ -286,6 +286,18 @@ func (r *GlanceAPIReconciler) SetupWithManager(ctx context.Context, mgr ctrl.Man
 		return err
 	}
 
+	// index authAppCredSecretField
+	if err := mgr.GetFieldIndexer().IndexField(context.Background(), &glancev1.GlanceAPI{}, authAppCredSecretField, func(rawObj client.Object) []string {
+		// Extract the application credential secret name from the spec, if one is provided
+		cr := rawObj.(*glancev1.GlanceAPI)
+		if cr.Spec.Auth.ApplicationCredentialSecret == "" {
+			return nil
+		}
+		return []string{cr.Spec.Auth.ApplicationCredentialSecret}
+	}); err != nil {
+		return err
+	}
+
 	// Watch for changes to any CustomServiceConfigSecrets. Global secrets
 	svcSecretFn := func(_ context.Context, o client.Object) []reconcile.Request {
 		var namespace = o.GetNamespace()
@@ -1285,6 +1297,30 @@ func (r *GlanceAPIReconciler) generateServiceConfig(
 		"Wsgi":         wsgi,
 	}
 
+	templateParameters["UseApplicationCredentials"] = false
+	// Try to get Application Credential from the secret specified in the CR
+	if instance.Spec.Auth.ApplicationCredentialSecret != "" {
+		acSecretObj, _, err := secret.GetSecret(ctx, h, instance.Spec.Auth.ApplicationCredentialSecret, instance.Namespace)
+		if err != nil {
+			if k8s_errors.IsNotFound(err) {
+				Log.Info("ApplicationCredential secret not found, waiting", "secret", instance.Spec.Auth.ApplicationCredentialSecret)
+				return fmt.Errorf("%w: %s", ErrACSecretNotFound, instance.Spec.Auth.ApplicationCredentialSecret)
+			}
+			Log.Error(err, "Failed to get ApplicationCredential secret", "secret", instance.Spec.Auth.ApplicationCredentialSecret)
+			return err
+		}
+		acID, okID := acSecretObj.Data[keystonev1.ACIDSecretKey]
+		acSecretData, okSecret := acSecretObj.Data[keystonev1.ACSecretSecretKey]
+		if !okID || len(acID) == 0 || !okSecret || len(acSecretData) == 0 {
+			Log.Info("ApplicationCredential secret missing required keys", "secret", instance.Spec.Auth.ApplicationCredentialSecret)
+			return fmt.Errorf("%w: %s", ErrACSecretMissingKeys, instance.Spec.Auth.ApplicationCredentialSecret)
+		}
+		templateParameters["UseApplicationCredentials"] = true
+		templateParameters["ACID"] = string(acID)
+		templateParameters["ACSecret"] = string(acSecretData)
+		Log.Info("Using ApplicationCredentials auth", "secret", instance.Spec.Auth.ApplicationCredentialSecret)
+	}
+
 	// (OSPRH-18291)Only set EndpointID parameter when the Endpoint has been
 	// created and the associated ID is set in the keystoneapi CR. Because we
 	// have the Keystone CR, we get the Region parameter mirrored in its
diff --git a/templates/common/config/00-config.conf b/templates/common/config/00-config.conf
@@ -41,9 +41,18 @@ default_backend=default_backend
 [keystone_authtoken]
 www_authenticate_uri={{ .KeystonePublicURL }}
 auth_url={{ .KeystoneInternalURL }}
-auth_type=password
-username={{ .ServiceUser }}
+{{ if .UseApplicationCredentials -}}
+auth_type = v3applicationcredential
+application_credential_id = {{ .ACID }}
+application_credential_secret = {{ .ACSecret }}
+{{- else -}}
+auth_type = password
+username = {{ .ServiceUser }}
 password = {{ .ServicePassword }}
+project_domain_name = Default
+user_domain_name = Default
+project_name = service
+{{- end }}
 {{ if (index . "MemcachedServers") }}
 memcached_servers = {{ .MemcachedServers }}
 memcache_pool_dead_retry = 10
@@ -55,15 +64,19 @@ memcache_tls_keyfile = {{ .MemcachedAuthKey }}
 memcache_tls_cafile = {{ .MemcachedAuthCa }}
 memcache_tls_enabled = true
 {{end}}
-project_domain_name=Default
-user_domain_name=Default
-project_name=service
 {{ if (index . "Region") -}}
 region_name = {{ .Region }}
 {{ end -}}
 
 [service_user]
+{{ if .UseApplicationCredentials -}}
+auth_type = v3applicationcredential
+application_credential_id = {{ .ACID }}
+application_credential_secret = {{ .ACSecret }}
+{{ else -}}
+auth_type = password
 password = {{ .ServicePassword }}
+{{- end }}
 
 [oslo_messaging_notifications]
 {{ if (index . "TransportURL") -}}
@@ -97,11 +110,17 @@ filesystem_store_datadir = /var/lib/glance/os_glance_tasks_store/
 
 [oslo_limit]
 auth_url={{ .KeystoneInternalURL }}
+{{ if .UseApplicationCredentials -}}
+auth_type = v3applicationcredential
+application_credential_id = {{ .ACID }}
+application_credential_secret = {{ .ACSecret }}
+{{ else -}}
 auth_type = password
 username={{ .ServiceUser }}
 password = {{ .ServicePassword }}
 system_scope = all
 user_domain_id = default
+{{- end }}
 {{ if (index . "EndpointID") -}}
 endpoint_id = {{ .EndpointID }}
 {{ end -}}
diff --git a/test/functional/glanceapi_controller_test.go b/test/functional/glanceapi_controller_test.go

Original file line number	Diff line number	Diff line change
`@@ -21,6 +21,7 @@ import (`
`21`	`21`	`"strings"`
`22`	`22`
`23`	`23`	`"github.com/google/go-cmp/cmp"`
	`24`	`+ topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1"`
`24`	`25`	`"github.com/openstack-k8s-operators/lib-common/modules/common/service"`
`25`	`26`	`apierrors "k8s.io/apimachinery/pkg/api/errors"`
`26`	`27`	`"k8s.io/apimachinery/pkg/runtime"`
`@@ -29,7 +30,6 @@ import (`
`29`	`30`	`logf "sigs.k8s.io/controller-runtime/pkg/log"`
`30`	`31`	`"sigs.k8s.io/controller-runtime/pkg/webhook"`
`31`	`32`	`"sigs.k8s.io/controller-runtime/pkg/webhook/admission"`
`32`		`- topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1"`
`33`	`33`
`34`	`34`	`common_webhook "github.com/openstack-k8s-operators/lib-common/modules/common/webhook"`
`35`	`35`	`)`
`@@ -157,7 +157,6 @@ func (r *GlanceSpecCore) Default() {`
`157`	`157`	`}`
`158`	`158`	`}`
`159`	`159`
`160`		`-`
`161`	`160`	`// Check if File is used as a backend for Glance`
`162`	`161`	`func isFileBackend(customServiceConfig string, topLevel bool) bool {`
`163`	`162`	`availableBackends := GetEnabledBackends(customServiceConfig)`
Original file line number	Diff line number	Diff line change
`@@ -48,6 +48,8 @@ import (`
`48`	`48`	`// Common static errors for glance controllers`
`49`	`49`	`var (`
`50`	`50`	`ErrNetworkAttachmentConfig = errors.New("not all pods have interfaces with ips as configured in NetworkAttachments")`
	`51`	`+ ErrACSecretNotFound = errors.New("ApplicationCredential secret not found")`
	`52`	`+ ErrACSecretMissingKeys = errors.New("ApplicationCredential secret missing required keys")`
`51`	`53`	`)`
`52`	`54`
`53`	`55`	`// fields to index to reconcile when change`
`@@ -58,6 +60,7 @@ const (`
`58`	`60`	`tlsAPIPublicField = ".spec.tls.api.public.secretName"`
`59`	`61`	`topologyField = ".spec.topologyRef.Name"`
`60`	`62`	`notificationBusSecretField = ".spec.notificationBusSecret"`
	`63`	`+ authAppCredSecretField = ".spec.auth.applicationCredentialSecret" // #nosec G101`
`61`	`64`	`)`
`62`	`65`
`63`	`66`	`var (`
`@@ -71,6 +74,7 @@ var (`
`71`	`74`	`tlsAPIPublicField,`
`72`	`75`	`topologyField,`
`73`	`76`	`notificationBusSecretField,`
	`77`	`+ authAppCredSecretField,`
`74`	`78`	`}`
`75`	`79`	`)`
`76`	`80`