@@ -456,6 +456,21 @@ func (r *PlacementAPIReconciler) Reconcile(ctx context.Context, req ctrl.Request
456456 return ctrl.Result {}, nil
457457 }
458458
459+ if instance .Spec .Auth .ApplicationCredentialSecret != "" {
460+ if err := keystonev1 .ManageACSecretFinalizer (ctx , h , instance .Namespace ,
461+ instance .Spec .Auth .ApplicationCredentialSecret ,
462+ "" ,
463+ placement .ACConsumerFinalizer ); err != nil {
464+ instance .Status .Conditions .Set (condition .FalseCondition (
465+ condition .ServiceConfigReadyCondition ,
466+ condition .ErrorReason ,
467+ condition .SeverityWarning ,
468+ condition .ServiceConfigReadyErrorMessage ,
469+ err .Error ()))
470+ return ctrl.Result {}, err
471+ }
472+ }
473+
459474 instance .Status .Conditions .MarkTrue (condition .ServiceConfigReadyCondition , condition .ServiceConfigReadyMessage )
460475
461476 serviceAnnotations , result , err := r .ensureNetworkAttachments (ctx , h , instance )
@@ -503,6 +518,26 @@ func (r *PlacementAPIReconciler) Reconcile(ctx context.Context, req ctrl.Request
503518 return ctrl.Result {}, err
504519 }
505520
521+ // Manage the old AC secret's finalizer and status tracking.
522+ // On rotation (old != new), only remove the old secret's finalizer after
523+ // all sub-services are ready with the new credentials. This prevents
524+ // premature revocation during rapid rotations.
525+ isRotation := instance .Status .ApplicationCredentialSecret != "" &&
526+ instance .Status .ApplicationCredentialSecret != instance .Spec .Auth .ApplicationCredentialSecret
527+
528+ if isRotation {
529+ allServicesReady := instance .Status .Conditions .AllSubConditionIsTrue ()
530+ if allServicesReady {
531+ if err := keystonev1 .RemoveACSecretConsumerFinalizer (ctx , h , instance .Namespace ,
532+ instance .Status .ApplicationCredentialSecret , placement .ACConsumerFinalizer ); err != nil {
533+ return ctrl.Result {}, err
534+ }
535+ instance .Status .ApplicationCredentialSecret = instance .Spec .Auth .ApplicationCredentialSecret
536+ }
537+ } else {
538+ instance .Status .ApplicationCredentialSecret = instance .Spec .Auth .ApplicationCredentialSecret
539+ }
540+
506541 return ctrl.Result {}, nil
507542}
508543
@@ -1095,6 +1130,17 @@ func (r *PlacementAPIReconciler) reconcileDelete(ctx context.Context, instance *
10951130 }
10961131 }
10971132
1133+ // Remove consumer finalizer from AC secrets placement was consuming.
1134+ for _ , secretName := range []string {
1135+ instance .Status .ApplicationCredentialSecret ,
1136+ instance .Spec .Auth .ApplicationCredentialSecret ,
1137+ } {
1138+ if err := keystonev1 .RemoveACSecretConsumerFinalizer (ctx , helper , instance .Namespace ,
1139+ secretName , placement .ACConsumerFinalizer ); err != nil {
1140+ return ctrl.Result {}, err
1141+ }
1142+ }
1143+
10981144 // We did all the cleanup on the objects we created so we can remove the
10991145 // finalizer from ourselves to allow the deletion
11001146 controllerutil .RemoveFinalizer (instance , helper .GetFinalizer ())
@@ -1333,6 +1379,25 @@ func (r *PlacementAPIReconciler) ensureDeployment(
13331379 }
13341380 // create Deployment - end
13351381
1382+ // Manage the old AC secret's finalizer and status tracking.
1383+ // On rotation (old != new), only remove the old secret's finalizer after
1384+ // all sub-services are ready with the new credentials. This prevents
1385+ // premature revocation during rapid rotations.
1386+ isRotation := instance .Status .ApplicationCredentialSecret != "" && instance .Status .ApplicationCredentialSecret != instance .Spec .Auth .ApplicationCredentialSecret
1387+
1388+ if isRotation {
1389+ allServicesReady := instance .Status .Conditions .AllSubConditionIsTrue ()
1390+ if allServicesReady {
1391+ if err := keystonev1 .RemoveACSecretConsumerFinalizer (ctx , h , instance .Namespace ,
1392+ instance .Status .ApplicationCredentialSecret , placement .ACConsumerFinalizer ); err != nil {
1393+ return ctrl.Result {}, err
1394+ }
1395+ instance .Status .ApplicationCredentialSecret = instance .Spec .Auth .ApplicationCredentialSecret
1396+ }
1397+ } else {
1398+ instance .Status .ApplicationCredentialSecret = instance .Spec .Auth .ApplicationCredentialSecret
1399+ }
1400+
13361401 Log .Info ("Reconciled Service successfully" )
13371402 return ctrl.Result {}, nil
13381403
0 commit comments