Skip to content

Commit 67833c8

Browse files
Deydra71Deydra71
committed
Add AC finalizer management
Signed-off-by: Veronika Fisarova <vfisarov@redhat.com>
1 parent a276145 commit 67833c8

10 files changed

Lines changed: 220 additions & 28 deletions

File tree

‎api/bases/neutron.openstack.org_neutronapis.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1629,6 +1629,13 @@ spec:
16291629
status:
16301630
description: NeutronAPIStatus defines the observed state of NeutronAPI
16311631
properties:
1632+
applicationCredentialSecret:
1633+
description: |-
1634+
ApplicationCredentialSecret - the AC secret NeutronAPI is currently
1635+
consuming and protecting with the openstack.org/neutronapi-ac-consumer
1636+
finalizer. Tracked so the controller can remove its finalizer from the
1637+
old secret when the openstack-operator rotates the reference.
1638+
type: string
16321639
conditions:
16331640
description: Conditions
16341641
items:

‎api/go.mod‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,9 @@ module github.com/openstack-k8s-operators/neutron-operator/api
33
go 1.24.4
44

55
require (
6-
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260212124933-d2541a526cd3
7-
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260205083029-d03e9df035ef
8-
github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260205083029-d03e9df035ef
6+
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260316100655-863ae03d41af
7+
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260320125710-3a5f82ff0f18
8+
github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260320125710-3a5f82ff0f18
99
k8s.io/api v0.31.14
1010
k8s.io/apimachinery v0.31.14
1111
sigs.k8s.io/controller-runtime v0.19.7
@@ -37,14 +37,12 @@ require (
3737
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
3838
github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
3939
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
40-
github.com/onsi/gomega v1.39.1 // indirect
4140
github.com/pkg/errors v0.9.1 // indirect
4241
github.com/prometheus/client_golang v1.22.0 // indirect
4342
github.com/prometheus/client_model v0.6.2 // indirect
4443
github.com/prometheus/common v0.65.0 // indirect
4544
github.com/prometheus/procfs v0.16.1 // indirect
4645
github.com/rabbitmq/cluster-operator/v2 v2.16.0 // indirect
47-
github.com/rogpeppe/go-internal v1.13.1 // indirect
4846
github.com/spf13/pflag v1.0.7 // indirect
4947
github.com/stretchr/testify v1.11.1 // indirect
5048
github.com/x448/float16 v0.8.4 // indirect

‎api/go.sum‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -79,12 +79,12 @@ github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI
7979
github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE=
8080
github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=
8181
github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg=
82-
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260212124933-d2541a526cd3 h1:U6CAq9B6Ta/i089/ADVsyruBOvzZEJHaSWAO+s03jDA=
83-
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260212124933-d2541a526cd3/go.mod h1:5hS/cVzc/HURwsbp4MMNwgqAl5bUqKvJdK+4irXeymE=
84-
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260205083029-d03e9df035ef h1:SgzLekXtZuApbRylC3unCXnMaUClT5FPuqsxzIjt3Go=
85-
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260205083029-d03e9df035ef/go.mod h1:ndqfy1KbVorHH6+zlUFPIrCRhMSxO3ImYJUGaooE0x0=
86-
github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260205083029-d03e9df035ef h1:2wJUSZ2ybE6JVjEyuk/HEaJ1in64jf/lrPOs8NrRHFo=
87-
github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260205083029-d03e9df035ef/go.mod h1:jofj+VqDszxLCZSBYo794KGkCjMo01xzhQ/gffYzf3I=
82+
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260316100655-863ae03d41af h1:Ow12j/PVbEtul1bZ7s/ZenVnKPIHK2q+0VgTp+j/wro=
83+
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260316100655-863ae03d41af/go.mod h1:nC/Jf3OYJRML8UEzJ/mn/TQcSCv/nhqO6x6LGkdDt60=
84+
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260320125710-3a5f82ff0f18 h1:P1Nx+i6aH7rFy+T4nrB2AlQzzoLMrMwtnZPEsFvC5cM=
85+
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260320125710-3a5f82ff0f18/go.mod h1:+vcGsjqibpMUz3y/g0B5YIXNotlTvQdMB6f92siiwKM=
86+
github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260320125710-3a5f82ff0f18 h1:9lbaamHYKiWQq/Vth69GGNxQz67qC+PbeQdkXvUEeNo=
87+
github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260320125710-3a5f82ff0f18/go.mod h1:3loLaPUDQyvbPekylZd9OCLF+EXH2klRI9IeeQhuMcs=
8888
github.com/openstack-k8s-operators/rabbitmq-cluster-operator/v2 v2.6.1-0.20250929174222-a0d328fa4dec h1:saovr368HPAKHN0aRPh8h8n9s9dn3d8Frmfua0UYRlc=
8989
github.com/openstack-k8s-operators/rabbitmq-cluster-operator/v2 v2.6.1-0.20250929174222-a0d328fa4dec/go.mod h1:Nh2NEePLjovUQof2krTAg4JaAoLacqtPTZQXK6izNfg=
9090
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=

‎api/v1beta1/neutronapi_types.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -252,6 +252,12 @@ type NeutronAPIStatus struct {
252252
// NetworkAttachments status of the deployment pods
253253
NetworkAttachments map[string][]string `json:"networkAttachments,omitempty"`
254254

255+
// ApplicationCredentialSecret - the AC secret NeutronAPI is currently
256+
// consuming and protecting with the openstack.org/neutronapi-ac-consumer
257+
// finalizer. Tracked so the controller can remove its finalizer from the
258+
// old secret when the openstack-operator rotates the reference.
259+
ApplicationCredentialSecret string `json:"applicationCredentialSecret,omitempty"`
260+
255261
// ObservedGeneration - the most recent generation observed for this
256262
// service. If the observed generation is less than the spec generation,
257263
// then the controller has not processed the latest changes injected by

‎config/crd/bases/neutron.openstack.org_neutronapis.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1629,6 +1629,13 @@ spec:
16291629
status:
16301630
description: NeutronAPIStatus defines the observed state of NeutronAPI
16311631
properties:
1632+
applicationCredentialSecret:
1633+
description: |-
1634+
ApplicationCredentialSecret - the AC secret NeutronAPI is currently
1635+
consuming and protecting with the openstack.org/neutronapi-ac-consumer
1636+
finalizer. Tracked so the controller can remove its finalizer from the
1637+
old secret when the openstack-operator rotates the reference.
1638+
type: string
16321639
conditions:
16331640
description: Conditions
16341641
items:

‎go.mod‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,11 @@ require (
88
github.com/k8snetworkplumbingwg/network-attachment-definition-client v1.7.7
99
github.com/onsi/ginkgo/v2 v2.28.1
1010
github.com/onsi/gomega v1.39.1
11-
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260212124933-d2541a526cd3
11+
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260316100655-863ae03d41af
1212
github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260212134514-510b47405111
13-
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260205083029-d03e9df035ef
14-
github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260205083029-d03e9df035ef
15-
github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260205083029-d03e9df035ef
13+
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260320125710-3a5f82ff0f18
14+
github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260320125710-3a5f82ff0f18
15+
github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260320125710-3a5f82ff0f18
1616
github.com/openstack-k8s-operators/mariadb-operator/api v0.6.1-0.20260212144335-e804f5700fea
1717
github.com/openstack-k8s-operators/neutron-operator/api v0.0.0-00010101000000-000000000000
1818
github.com/openstack-k8s-operators/ovn-operator/api v0.6.1-0.20260217081532-1146206f0451
@@ -64,7 +64,7 @@ require (
6464
github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
6565
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
6666
github.com/openshift/api v3.9.0+incompatible // indirect
67-
github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260205083029-d03e9df035ef // indirect
67+
github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260320125710-3a5f82ff0f18 // indirect
6868
github.com/pkg/errors v0.9.1 // indirect
6969
github.com/prometheus/client_golang v1.22.0 // indirect
7070
github.com/prometheus/client_model v0.6.2 // indirect
@@ -144,3 +144,5 @@ replace k8s.io/component-base => k8s.io/component-base v0.31.14 //allow-merging
144144
replace github.com/rabbitmq/cluster-operator/v2 => github.com/openstack-k8s-operators/rabbitmq-cluster-operator/v2 v2.6.1-0.20250929174222-a0d328fa4dec //allow-merging
145145

146146
replace k8s.io/kube-openapi => k8s.io/kube-openapi v0.0.0-20250627150254-e9823e99808e //allow-merging
147+
148+
replace github.com/openstack-k8s-operators/keystone-operator/api => github.com/Deydra71/keystone-operator/api v0.0.0-20260408063234-f70bc06c10d8

‎go.sum‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
github.com/Deydra71/keystone-operator/api v0.0.0-20260408063234-f70bc06c10d8 h1:BjJXiJDpbD0HS0ehvDTwmlIPLqP0aNjrJY09x0Alprk=
2+
github.com/Deydra71/keystone-operator/api v0.0.0-20260408063234-f70bc06c10d8/go.mod h1:8o6LSPt1VAvvB2ngS2QObGS6HEikSdVpHoKIgmb78KI=
13
github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
24
github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
35
github.com/antlr4-go/antlr/v4 v4.13.0 h1:lxCg3LAv+EUK6t1i0y1V6/SLeUi0eKEKdhQAlS8TVTI=
@@ -118,18 +120,16 @@ github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=
118120
github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg=
119121
github.com/openshift/api v0.0.0-20250711200046-c86d80652a9e h1:E1OdwSpqWuDPCedyUt0GEdoAE+r5TXy7YS21yNEo+2U=
120122
github.com/openshift/api v0.0.0-20250711200046-c86d80652a9e/go.mod h1:Shkl4HanLwDiiBzakv+con/aMGnVE2MAGvoKp5oyYUo=
121-
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260212124933-d2541a526cd3 h1:U6CAq9B6Ta/i089/ADVsyruBOvzZEJHaSWAO+s03jDA=
122-
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260212124933-d2541a526cd3/go.mod h1:5hS/cVzc/HURwsbp4MMNwgqAl5bUqKvJdK+4irXeymE=
123-
github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260212134514-510b47405111 h1:5+mrqOjaEZR9DEYAgxw8XO2lrGtnQZo3XXXRMPzt8lA=
124-
github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260212134514-510b47405111/go.mod h1:K9Wkzsxz2BBNIsyFvWNjYgPmyy9jbkAOUyt7dcOORXo=
125-
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260205083029-d03e9df035ef h1:SgzLekXtZuApbRylC3unCXnMaUClT5FPuqsxzIjt3Go=
126-
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260205083029-d03e9df035ef/go.mod h1:ndqfy1KbVorHH6+zlUFPIrCRhMSxO3ImYJUGaooE0x0=
127-
github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260205083029-d03e9df035ef h1:IXN2GwCJLirHciDp/sq8oql4F/ScBCKwklTtUYdptS4=
128-
github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260205083029-d03e9df035ef/go.mod h1:zOX7Y05keiSppIvLabuyh42QHBMhCcoskAtxFRbwXKo=
129-
github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260205083029-d03e9df035ef h1:2wJUSZ2ybE6JVjEyuk/HEaJ1in64jf/lrPOs8NrRHFo=
130-
github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260205083029-d03e9df035ef/go.mod h1:jofj+VqDszxLCZSBYo794KGkCjMo01xzhQ/gffYzf3I=
131-
github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260205083029-d03e9df035ef h1:Z4NHYzslSvwPVsoqSVCbGm/9mWG0mhc0WP92WSRh0CM=
132-
github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260205083029-d03e9df035ef/go.mod h1:sqKTKvYhSzu4Opnjx/J+zzetXKRqYrhxsfvrST/NjoU=
123+
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260316100655-863ae03d41af h1:Ow12j/PVbEtul1bZ7s/ZenVnKPIHK2q+0VgTp+j/wro=
124+
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260316100655-863ae03d41af/go.mod h1:nC/Jf3OYJRML8UEzJ/mn/TQcSCv/nhqO6x6LGkdDt60=
125+
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260320125710-3a5f82ff0f18 h1:P1Nx+i6aH7rFy+T4nrB2AlQzzoLMrMwtnZPEsFvC5cM=
126+
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260320125710-3a5f82ff0f18/go.mod h1:+vcGsjqibpMUz3y/g0B5YIXNotlTvQdMB6f92siiwKM=
127+
github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260320125710-3a5f82ff0f18 h1:eJDwc8LPJg+H4bHMLh/pDJBk+OezQ+wkjUNpExUFhbM=
128+
github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260320125710-3a5f82ff0f18/go.mod h1:7yqbVpg0k0vW+kZks+TMU/cd1ovoejyHfVPWcyGYLHI=
129+
github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260320125710-3a5f82ff0f18 h1:9lbaamHYKiWQq/Vth69GGNxQz67qC+PbeQdkXvUEeNo=
130+
github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260320125710-3a5f82ff0f18/go.mod h1:3loLaPUDQyvbPekylZd9OCLF+EXH2klRI9IeeQhuMcs=
131+
github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260320125710-3a5f82ff0f18 h1:beEKU5yv6ih8pbIqrU15QP0sGDXyxrKqVMh3zHDscrI=
132+
github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260320125710-3a5f82ff0f18/go.mod h1:dEjz8zHRIlP3vnMmWdHytlLeSZ6BHcIiSTPM7xTQxFg=
133133
github.com/openstack-k8s-operators/mariadb-operator/api v0.6.1-0.20260212144335-e804f5700fea h1:DKM4Go+yFATWkODprXImZOquMBiGegnSIvAfhu7mVWg=
134134
github.com/openstack-k8s-operators/mariadb-operator/api v0.6.1-0.20260212144335-e804f5700fea/go.mod h1:dAC9Uj2p6iXzPf5y6yWY4Mza6q64kwKt/hV26PSfG20=
135135
github.com/openstack-k8s-operators/ovn-operator/api v0.6.1-0.20260217081532-1146206f0451 h1:Q1Zx7G1xcIEOpFzvNs9NzaxvYIX68g3QyERneuDwkkk=

‎internal/controller/neutronapi_controller.go‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -492,6 +492,19 @@ func (r *NeutronAPIReconciler) reconcileDelete(ctx context.Context, instance *ne
492492
); err != nil {
493493
return ctrlResult, err
494494
}
495+
// Remove consumer finalizer from AC secrets NeutronAPI was consuming.
496+
// Check both status and spec to handle the edge case where the reconciler
497+
// crashed after adding the finalizer but before updating the status.
498+
for _, secretName := range []string{
499+
instance.Status.ApplicationCredentialSecret,
500+
instance.Spec.Auth.ApplicationCredentialSecret,
501+
} {
502+
if err := keystonev1.RemoveACSecretConsumerFinalizer(ctx, helper, instance.Namespace,
503+
secretName, neutronapi.ACConsumerFinalizer); err != nil {
504+
return ctrl.Result{}, err
505+
}
506+
}
507+
495508
// Service is deleted so remove the finalizer.
496509
controllerutil.RemoveFinalizer(instance, helper.GetFinalizer())
497510
Log.Info("Reconciled Service delete successfully")
@@ -648,6 +661,23 @@ func (r *NeutronAPIReconciler) reconcileInit(
648661

649662
// Create Secrets - end
650663

664+
// Manage consumer finalizer, the AC data was already read and rendered to the service config secret
665+
if instance.Spec.Auth.ApplicationCredentialSecret != "" || instance.Status.ApplicationCredentialSecret != "" {
666+
if err := keystonev1.ManageACSecretFinalizer(ctx, helper, instance.Namespace,
667+
instance.Spec.Auth.ApplicationCredentialSecret,
668+
instance.Status.ApplicationCredentialSecret,
669+
neutronapi.ACConsumerFinalizer); err != nil {
670+
instance.Status.Conditions.Set(condition.FalseCondition(
671+
condition.ServiceConfigReadyCondition,
672+
condition.ErrorReason,
673+
condition.SeverityWarning,
674+
condition.ServiceConfigReadyErrorMessage,
675+
err.Error()))
676+
return ctrl.Result{}, err
677+
}
678+
}
679+
instance.Status.ApplicationCredentialSecret = instance.Spec.Auth.ApplicationCredentialSecret
680+
651681
instance.Status.Conditions.MarkTrue(condition.ServiceConfigReadyCondition, condition.ServiceConfigReadyMessage)
652682

653683
//

‎internal/neutronapi/const.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,9 @@ const (
5050

5151
// NeutronDhcpAgentSecretKey is the key in external Secret for Neutron DHCP Agent with agent config
5252
NeutronDhcpAgentSecretKey = "10-neutron-dhcp.conf"
53+
54+
// ACConsumerFinalizer is added to AC secrets that neutron is actively consuming
55+
ACConsumerFinalizer = "openstack.org/neutronapi-ac-consumer"
5356
)
5457

5558
// DbsyncPropagation keeps track of the DBSync Service Propagation Type

0 commit comments

Comments
 (0)