Skip to content

Commit 71d6dc8

Browse files
Deydra71millevy
Deydra71
and
millevy
committed
AppCred fixes
Fix propagation of ApplicatioNCredentialSecret into correct OCtavia Auth spec field. Fix reconcile on AC config changes (such as roles, expiry...). Fix deleting AC CRs when app creds are disabled (globally and for the service). Enhance kuttl test scenario to check the AC CR deletion. Signed-off-by: Veronika Fisarova <vfisarov@redhat.com> Co-authored-by: Milana Levy <millevy@redhat.com>
1 parent 5de8798 commit 71d6dc8

19 files changed

Lines changed: 200 additions & 3 deletions

‎internal/openstack/applicationcredential.go‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,11 @@ func EnsureApplicationCredentialForService(
125125

126126
// Check if AC CR exists and is ready
127127
if acExists {
128+
// We want to run reconcileApplicationCredential to update the AC CR if it exists and is ready and AC config fields changed
129+
err = reconcileApplicationCredential(ctx, helper, instance, acName, serviceUser, secretName, passwordSelector, merged)
130+
if err != nil {
131+
return "", ctrl.Result{}, err
132+
}
128133
if acCR.IsReady() {
129134
Log.Info("Application Credential is ready", "service", serviceName, "acName", acName, "secretName", acCR.Status.SecretName)
130135
return acCR.Status.SecretName, ctrl.Result{}, nil
@@ -153,6 +158,31 @@ func EnsureApplicationCredentialForService(
153158
return "", ctrl.Result{RequeueAfter: time.Second * 5}, nil
154159
}
155160

161+
// CleanupApplicationCredential deletes the AC CR for a service if it exists.
162+
// Called when AC is disabled (globally or per-service) to clean up existing AC CRs.
163+
func CleanupApplicationCredential(
164+
ctx context.Context,
165+
helper *helper.Helper,
166+
instance *corev1beta1.OpenStackControlPlane,
167+
serviceName string,
168+
) error {
169+
Log := GetLogger(ctx)
170+
acName := keystonev1.GetACCRName(serviceName)
171+
acCR := &keystonev1.KeystoneApplicationCredential{}
172+
err := helper.GetClient().Get(ctx, types.NamespacedName{Name: acName, Namespace: instance.Namespace}, acCR)
173+
if err != nil {
174+
if k8s_errors.IsNotFound(err) {
175+
return nil
176+
}
177+
return err
178+
}
179+
Log.Info("Application Credential disabled, deleting existing KeystoneApplicationCredential CR", "service", serviceName, "acName", acName)
180+
if err := helper.GetClient().Delete(ctx, acCR); err != nil && !k8s_errors.IsNotFound(err) {
181+
return err
182+
}
183+
return nil
184+
}
185+
156186
// reconcileApplicationCredential creates or updates a single ApplicationCredential CR
157187
func reconcileApplicationCredential(
158188
ctx context.Context,

‎internal/openstack/barbican.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,12 @@ func ReconcileBarbican(ctx context.Context, instance *corev1beta1.OpenStackContr
101101
// - If AC disabled: returns ""
102102
// - If AC enabled and ready: returns the AC secret name
103103
instance.Spec.Barbican.Template.Auth.ApplicationCredentialSecret = acSecretName
104+
} else {
105+
// AC disabled - clean up any AC CR
106+
if err := CleanupApplicationCredential(ctx, helper, instance, "barbican"); err != nil {
107+
return ctrl.Result{}, err
108+
}
109+
instance.Spec.Barbican.Template.Auth.ApplicationCredentialSecret = ""
104110
}
105111

106112
// preserve any previously set TLS certs, set CA cert

‎internal/openstack/cinder.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,12 @@ func ReconcileCinder(ctx context.Context, instance *corev1beta1.OpenStackControl
124124
// - If AC disabled: returns ""
125125
// - If AC enabled and ready: returns the AC secret name
126126
instance.Spec.Cinder.Template.Auth.ApplicationCredentialSecret = acSecretName
127+
} else {
128+
// AC disabled - clean up any AC CR
129+
if err := CleanupApplicationCredential(ctx, helper, instance, "cinder"); err != nil {
130+
return ctrl.Result{}, err
131+
}
132+
instance.Spec.Cinder.Template.Auth.ApplicationCredentialSecret = ""
127133
}
128134

129135
// preserve any previously set TLS certs,set CA cert

‎internal/openstack/designate.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,12 @@ func ReconcileDesignate(ctx context.Context, instance *corev1beta1.OpenStackCont
113113
// - If AC disabled: returns ""
114114
// - If AC enabled and ready: returns the AC secret name
115115
instance.Spec.Designate.Template.DesignateAPI.Auth.ApplicationCredentialSecret = acSecretName
116+
} else {
117+
// AC disabled - clean up any AC CR
118+
if err := CleanupApplicationCredential(ctx, helper, instance, "designate"); err != nil {
119+
return ctrl.Result{}, err
120+
}
121+
instance.Spec.Designate.Template.DesignateAPI.Auth.ApplicationCredentialSecret = ""
116122
}
117123

118124
svcs, err := service.GetServicesListWithLabel(

‎internal/openstack/glance.go‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -130,7 +130,6 @@ func ReconcileGlance(ctx context.Context, instance *corev1beta1.OpenStackControl
130130

131131
// Only call if AC enabled or currently configured
132132
if isACEnabled(instance.Spec.ApplicationCredential, instance.Spec.Glance.ApplicationCredential) || hasACConfigured {
133-
134133
acSecretName, acResult, err := EnsureApplicationCredentialForService(
135134
ctx,
136135
helper,
@@ -158,6 +157,15 @@ func ReconcileGlance(ctx context.Context, instance *corev1beta1.OpenStackControl
158157
glanceAPI.Auth.ApplicationCredentialSecret = acSecretName
159158
instance.Spec.Glance.Template.GlanceAPIs[name] = glanceAPI
160159
}
160+
} else {
161+
// AC disabled - clean up any AC CR
162+
if err := CleanupApplicationCredential(ctx, helper, instance, "glance"); err != nil {
163+
return ctrl.Result{}, err
164+
}
165+
for name, glanceAPI := range instance.Spec.Glance.Template.GlanceAPIs {
166+
glanceAPI.Auth.ApplicationCredentialSecret = ""
167+
instance.Spec.Glance.Template.GlanceAPIs[name] = glanceAPI
168+
}
161169
}
162170

163171
// add selector to service overrides

‎internal/openstack/heat.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -144,6 +144,12 @@ func ReconcileHeat(ctx context.Context, instance *corev1beta1.OpenStackControlPl
144144
// - If AC disabled: returns ""
145145
// - If AC enabled and ready: returns the AC secret name
146146
instance.Spec.Heat.Template.Auth.ApplicationCredentialSecret = heatACSecretName
147+
} else {
148+
// AC disabled - clean up any AC CR
149+
if err := CleanupApplicationCredential(ctx, helper, instance, "heat"); err != nil {
150+
return ctrl.Result{}, err
151+
}
152+
instance.Spec.Heat.Template.Auth.ApplicationCredentialSecret = ""
147153
}
148154

149155
// Heat API

‎internal/openstack/ironic.go‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -180,6 +180,16 @@ func ReconcileIronic(ctx context.Context, instance *corev1beta1.OpenStackControl
180180
// - If AC disabled: returns ""
181181
// - If AC enabled and ready: returns the AC secret name
182182
instance.Spec.Ironic.Template.IronicInspector.Auth.ApplicationCredentialSecret = inspectorACSecretName
183+
} else {
184+
// AC disabled - clean up any AC CRs
185+
if err := CleanupApplicationCredential(ctx, helper, instance, "ironic"); err != nil {
186+
return ctrl.Result{}, err
187+
}
188+
if err := CleanupApplicationCredential(ctx, helper, instance, "ironic-inspector"); err != nil {
189+
return ctrl.Result{}, err
190+
}
191+
instance.Spec.Ironic.Template.Auth.ApplicationCredentialSecret = ""
192+
instance.Spec.Ironic.Template.IronicInspector.Auth.ApplicationCredentialSecret = ""
183193
}
184194

185195
// Ironic API

‎internal/openstack/manila.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,12 @@ func ReconcileManila(ctx context.Context, instance *corev1beta1.OpenStackControl
103103
// - If AC disabled: returns ""
104104
// - If AC enabled and ready: returns the AC secret name
105105
instance.Spec.Manila.Template.Auth.ApplicationCredentialSecret = acSecretName
106+
} else {
107+
// AC disabled - clean up any AC CR
108+
if err := CleanupApplicationCredential(ctx, helper, instance, "manila"); err != nil {
109+
return ctrl.Result{}, err
110+
}
111+
instance.Spec.Manila.Template.Auth.ApplicationCredentialSecret = ""
106112
}
107113

108114
// preserve any previously set TLS certs, set CA cert

‎internal/openstack/neutron.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -147,6 +147,12 @@ func ReconcileNeutron(ctx context.Context, instance *corev1beta1.OpenStackContro
147147
// - If AC disabled: returns ""
148148
// - If AC enabled and ready: returns the AC secret name
149149
instance.Spec.Neutron.Template.Auth.ApplicationCredentialSecret = acSecretName
150+
} else {
151+
// AC disabled - clean up any AC CR
152+
if err := CleanupApplicationCredential(ctx, helper, instance, "neutron"); err != nil {
153+
return ctrl.Result{}, err
154+
}
155+
instance.Spec.Neutron.Template.Auth.ApplicationCredentialSecret = ""
150156
}
151157

152158
svcs, err := service.GetServicesListWithLabel(

‎internal/openstack/nova.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -219,6 +219,12 @@ func ReconcileNova(ctx context.Context, instance *corev1beta1.OpenStackControlPl
219219
// - If AC disabled: returns ""
220220
// - If AC enabled and ready: returns the AC secret name
221221
instance.Spec.Nova.Template.Auth.ApplicationCredentialSecret = acSecretName
222+
} else {
223+
// AC disabled - clean up any AC CR
224+
if err := CleanupApplicationCredential(ctx, helper, instance, "nova"); err != nil {
225+
return ctrl.Result{}, err
226+
}
227+
instance.Spec.Nova.Template.Auth.ApplicationCredentialSecret = ""
222228
}
223229

224230
// Nova API

0 commit comments

Comments
 (0)