Merge pull request #1922 from Deydra71/ac-edpm-annotation

openshift-merge-bot[bot] · web-flow · commit e2678c1d35ac · 2026-05-21T16:18:09.000Z
Set EDPM service annotation on nova and ceilometer ACs
diff --git a/internal/openstack/applicationcredential.go b/internal/openstack/applicationcredential.go
@@ -68,14 +68,15 @@ func CleanupApplicationCredentialForService(
 	instance *corev1beta1.OpenStackControlPlane,
 	serviceName string,
 ) error {
+	Log := GetLogger(ctx)
 	acName := keystonev1.GetACCRName(serviceName)
+
 	acCR := &keystonev1.KeystoneApplicationCredential{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      acName,
 			Namespace: instance.Namespace,
 		},
 	}
-	Log := GetLogger(ctx)
 	err := helper.GetClient().Delete(ctx, acCR)
 	if k8s_errors.IsNotFound(err) {
 		return nil
@@ -106,6 +107,7 @@ func EnsureApplicationCredentialForService(
 	passwordSelector string,
 	serviceUser string,
 	acConfig *corev1beta1.ServiceAppCredSection,
+	edpmService bool,
 ) (acSecretName string, result ctrl.Result, err error) {
 	Log := GetLogger(ctx)
 
@@ -154,7 +156,7 @@ func EnsureApplicationCredentialForService(
 	// Check if AC CR exists and is ready
 	if acExists {
 		// We want to run reconcileApplicationCredential to update the AC CR if it exists and is ready and AC config fields changed
-		err = reconcileApplicationCredential(ctx, helper, instance, acName, serviceUser, secretName, passwordSelector, merged)
+		err = reconcileApplicationCredential(ctx, helper, instance, acName, serviceUser, secretName, passwordSelector, merged, edpmService)
 		if err != nil {
 			return "", ctrl.Result{}, err
 		}
@@ -177,7 +179,7 @@ func EnsureApplicationCredentialForService(
 	// Service is ready, create Application Credential CR
 	Log.Info("Service is ready, creating Application Credential", "service", serviceName, "acName", acName)
 
-	err = reconcileApplicationCredential(ctx, helper, instance, acName, serviceUser, secretName, passwordSelector, merged)
+	err = reconcileApplicationCredential(ctx, helper, instance, acName, serviceUser, secretName, passwordSelector, merged, edpmService)
 	if err != nil {
 		return "", ctrl.Result{}, err
 	}
@@ -196,6 +198,7 @@ func reconcileApplicationCredential(
 	secretName string,
 	passwordSelector string,
 	effective corev1beta1.ApplicationCredentialSection,
+	edpmService bool,
 ) error {
 	log := GetLogger(ctx)
 
@@ -215,6 +218,17 @@ func reconcileApplicationCredential(
 		acObj.Spec.Roles = effective.Roles
 		acObj.Spec.Unrestricted = *effective.Unrestricted
 
+		annotations := acObj.GetAnnotations()
+		if annotations == nil {
+			annotations = map[string]string{}
+		}
+		if edpmService {
+			annotations[keystonev1.EDPMServiceAnnotation] = "true"
+		} else {
+			annotations[keystonev1.EDPMServiceAnnotation] = "false"
+		}
+		acObj.SetAnnotations(annotations)
+
 		if len(effective.AccessRules) > 0 {
 			kr := make([]keystonev1.ACRule, 0, len(effective.AccessRules))
 			for _, r := range effective.AccessRules {
diff --git a/internal/openstack/barbican.go b/internal/openstack/barbican.go
@@ -91,6 +91,7 @@ func ReconcileBarbican(ctx context.Context, instance *corev1beta1.OpenStackContr
 			instance.Spec.Barbican.Template.PasswordSelectors.Service,
 			instance.Spec.Barbican.Template.ServiceUser,
 			instance.Spec.Barbican.ApplicationCredential,
+			false,
 		)
 		if err != nil {
 			return ctrl.Result{}, err
diff --git a/internal/openstack/cinder.go b/internal/openstack/cinder.go
@@ -115,6 +115,7 @@ func ReconcileCinder(ctx context.Context, instance *corev1beta1.OpenStackControl
 			instance.Spec.Cinder.Template.PasswordSelectors.Service,
 			instance.Spec.Cinder.Template.ServiceUser,
 			instance.Spec.Cinder.ApplicationCredential,
+			false,
 		)
 		if err != nil {
 			return ctrl.Result{}, err
diff --git a/internal/openstack/designate.go b/internal/openstack/designate.go
@@ -103,6 +103,7 @@ func ReconcileDesignate(ctx context.Context, instance *corev1beta1.OpenStackCont
 			instance.Spec.Designate.Template.PasswordSelectors.Service,
 			instance.Spec.Designate.Template.ServiceUser,
 			instance.Spec.Designate.ApplicationCredential,
+			false,
 		)
 		if err != nil {
 			return ctrl.Result{}, err
diff --git a/internal/openstack/glance.go b/internal/openstack/glance.go
@@ -145,6 +145,7 @@ func ReconcileGlance(ctx context.Context, instance *corev1beta1.OpenStackControl
 			instance.Spec.Glance.Template.PasswordSelectors.Service,
 			instance.Spec.Glance.Template.ServiceUser,
 			instance.Spec.Glance.ApplicationCredential,
+			false,
 		)
 		if err != nil {
 			return ctrl.Result{}, err
diff --git a/internal/openstack/heat.go b/internal/openstack/heat.go
@@ -134,6 +134,7 @@ func ReconcileHeat(ctx context.Context, instance *corev1beta1.OpenStackControlPl
 			instance.Spec.Heat.Template.PasswordSelectors.Service,
 			instance.Spec.Heat.Template.ServiceUser,
 			instance.Spec.Heat.ApplicationCredential,
+			false,
 		)
 		if err != nil {
 			return ctrl.Result{}, err
diff --git a/internal/openstack/ironic.go b/internal/openstack/ironic.go
@@ -147,6 +147,7 @@ func ReconcileIronic(ctx context.Context, instance *corev1beta1.OpenStackControl
 			instance.Spec.Ironic.Template.PasswordSelectors.Service,
 			instance.Spec.Ironic.Template.ServiceUser,
 			instance.Spec.Ironic.ApplicationCredential,
+			false,
 		)
 		if err != nil {
 			return ctrl.Result{}, err
@@ -173,6 +174,7 @@ func ReconcileIronic(ctx context.Context, instance *corev1beta1.OpenStackControl
 			instance.Spec.Ironic.Template.IronicInspector.PasswordSelectors.Service,
 			instance.Spec.Ironic.Template.IronicInspector.ServiceUser,
 			instance.Spec.Ironic.ApplicationCredential,
+			false,
 		)
 		if err != nil {
 			return ctrl.Result{}, err
diff --git a/internal/openstack/manila.go b/internal/openstack/manila.go
@@ -93,6 +93,7 @@ func ReconcileManila(ctx context.Context, instance *corev1beta1.OpenStackControl
 			instance.Spec.Manila.Template.PasswordSelectors.Service,
 			instance.Spec.Manila.Template.ServiceUser,
 			instance.Spec.Manila.ApplicationCredential,
+			false,
 		)
 		if err != nil {
 			return ctrl.Result{}, err
diff --git a/internal/openstack/neutron.go b/internal/openstack/neutron.go
@@ -137,6 +137,7 @@ func ReconcileNeutron(ctx context.Context, instance *corev1beta1.OpenStackContro
 			instance.Spec.Neutron.Template.PasswordSelectors.Service,
 			instance.Spec.Neutron.Template.ServiceUser,
 			instance.Spec.Neutron.ApplicationCredential,
+			false,
 		)
 		if err != nil {
 			return ctrl.Result{}, err
diff --git a/internal/openstack/nova.go b/internal/openstack/nova.go
@@ -209,6 +209,7 @@ func ReconcileNova(ctx context.Context, instance *corev1beta1.OpenStackControlPl
 			instance.Spec.Nova.Template.PasswordSelectors.Service,
 			instance.Spec.Nova.Template.ServiceUser,
 			instance.Spec.Nova.ApplicationCredential,
+			true,
 		)
 		if err != nil {
 			return ctrl.Result{}, err
diff --git a/internal/openstack/octavia.go b/internal/openstack/octavia.go
@@ -185,6 +185,7 @@ func ReconcileOctavia(ctx context.Context, instance *corev1beta1.OpenStackContro
 			instance.Spec.Octavia.Template.PasswordSelectors.Service,
 			instance.Spec.Octavia.Template.ServiceUser,
 			instance.Spec.Octavia.ApplicationCredential,
+			false,
 		)
 		if err != nil {
 			return ctrl.Result{}, err
diff --git a/internal/openstack/placement.go b/internal/openstack/placement.go
@@ -97,6 +97,7 @@ func ReconcilePlacementAPI(ctx context.Context, instance *corev1beta1.OpenStackC
 			instance.Spec.Placement.Template.PasswordSelectors.Service,
 			instance.Spec.Placement.Template.ServiceUser,
 			instance.Spec.Placement.ApplicationCredential,
+			false,
 		)
 		if err != nil {
 			return ctrl.Result{}, err
diff --git a/internal/openstack/swift.go b/internal/openstack/swift.go
@@ -127,6 +127,7 @@ func ReconcileSwift(ctx context.Context, instance *corev1beta1.OpenStackControlP
 			instance.Spec.Swift.Template.SwiftProxy.PasswordSelectors.Service,
 			instance.Spec.Swift.Template.SwiftProxy.ServiceUser,
 			instance.Spec.Swift.ApplicationCredential,
+			false,
 		)
 		if err != nil {
 			return ctrl.Result{}, err
diff --git a/internal/openstack/telemetry.go b/internal/openstack/telemetry.go
@@ -153,6 +153,7 @@ func ReconcileTelemetry(ctx context.Context, instance *corev1beta1.OpenStackCont
 				instance.Spec.Telemetry.Template.Autoscaling.Aodh.PasswordSelectors.AodhService,
 				instance.Spec.Telemetry.Template.Autoscaling.Aodh.ServiceUser,
 				instance.Spec.Telemetry.ApplicationCredentialAodh,
+				false,
 			)
 			if err != nil {
 				return ctrl.Result{}, err
@@ -198,6 +199,7 @@ func ReconcileTelemetry(ctx context.Context, instance *corev1beta1.OpenStackCont
 				instance.Spec.Telemetry.Template.Ceilometer.PasswordSelectors.CeilometerService,
 				instance.Spec.Telemetry.Template.Ceilometer.ServiceUser,
 				instance.Spec.Telemetry.ApplicationCredentialCeilometer,
+				true,
 			)
 			if err != nil {
 				return ctrl.Result{}, err
@@ -242,6 +244,7 @@ func ReconcileTelemetry(ctx context.Context, instance *corev1beta1.OpenStackCont
 				instance.Spec.Telemetry.Template.CloudKitty.PasswordSelectors.CloudKittyService,
 				instance.Spec.Telemetry.Template.CloudKitty.ServiceUser,
 				instance.Spec.Telemetry.ApplicationCredentialCloudKitty,
+				false,
 			)
 			if err != nil {
 				return ctrl.Result{}, err
diff --git a/internal/openstack/watcher.go b/internal/openstack/watcher.go
@@ -106,6 +106,7 @@ func ReconcileWatcher(ctx context.Context, instance *corev1beta1.OpenStackContro
 			getWatcherPasswordSelector(),
 			getWatcherServiceUser(),
 			instance.Spec.Watcher.ApplicationCredential,
+			false,
 		)
 		if err != nil {
 			return ctrl.Result{}, err
diff --git a/test/kuttl/tests/ctlplane-basic-deployment-with-appcred/02-assert-appcred-crs.yaml b/test/kuttl/tests/ctlplane-basic-deployment-with-appcred/02-assert-appcred-crs.yaml
@@ -44,6 +44,16 @@ commands:
         echo "✓ ac-$name.roles = [${expected_roles[*]}]"
       }
 
+      check_edpm_annotation() {
+        local name=$1 expected=$2
+        local actual=$(oc get appcred ac-$name -n "$NS" -o jsonpath="{.metadata.annotations.keystone\.openstack\.org/edpm-service}" 2>/dev/null || echo "")
+        if [ "$actual" != "$expected" ]; then
+          echo "ERROR: ac-$name edpm-service annotation: expected '$expected', got '$actual'"
+          exit 1
+        fi
+        echo "✓ ac-$name edpm-service = $expected"
+      }
+
       echo "========================================="
       echo "Testing Application Credential CRs"
       echo "========================================="
@@ -66,6 +76,7 @@ commands:
       check_field barbican gracePeriodDays 364
       check_roles barbican "admin" "service"
       check_field barbican unrestricted "false"
+      check_edpm_annotation barbican "false"
       echo
 
       # ---- ac-cinder ----
@@ -76,6 +87,7 @@ commands:
       check_field cinder gracePeriodDays 5
       check_roles cinder "admin" "service"
       check_field cinder unrestricted "true"
+      check_edpm_annotation cinder "false"
       echo
 
       # ---- ac-glance ----
@@ -86,6 +98,7 @@ commands:
       check_field glance gracePeriodDays 60
       check_roles glance "admin" "service"
       check_field glance unrestricted "false"
+      check_edpm_annotation glance "false"
       echo
 
       # ---- ac-swift ----
@@ -96,6 +109,7 @@ commands:
       check_field swift gracePeriodDays 364
       check_roles swift "service"
       check_field swift unrestricted "false"
+      check_edpm_annotation swift "false"
       echo
 
       # ---- ac-neutron ----
@@ -106,6 +120,7 @@ commands:
       check_field neutron gracePeriodDays 364
       check_roles neutron "admin" "service"
       check_field neutron unrestricted "false"
+      check_edpm_annotation neutron "false"
       echo
 
       # ---- ac-placement ----
@@ -116,26 +131,29 @@ commands:
       check_field placement gracePeriodDays 30
       check_roles placement "admin" "service"
       check_field placement unrestricted "false"
+      check_edpm_annotation placement "false"
       echo
 
       # ---- ac-nova ----
-      # Multiple roles
-      echo "=== Testing ac-nova (multiple roles) ==="
+      # Multiple roles, EDPM service
+      echo "=== Testing ac-nova (multiple roles, EDPM service) ==="
       wait_ready nova
       check_field nova expirationDays 730
       check_field nova gracePeriodDays 364
       check_roles nova "admin" "service" "member"
       check_field nova unrestricted "false"
+      check_edpm_annotation nova "true"
       echo
 
       # ---- ac-ceilometer ----
-      # Telemetry/Ceilometer component (enabled by default in base sample)
-      echo "=== Testing ac-ceilometer (telemetry/ceilometer) ==="
+      # Telemetry/Ceilometer component, EDPM service
+      echo "=== Testing ac-ceilometer (telemetry/ceilometer, EDPM service) ==="
       wait_ready ceilometer
       check_field ceilometer expirationDays 45
       check_field ceilometer gracePeriodDays 20
       check_roles ceilometer "service"
       check_field ceilometer unrestricted "false"
+      check_edpm_annotation ceilometer "true"
       echo
 
       echo "All ApplicationCredential CRs validated successfully"

Original file line number	Diff line number	Diff line change
`@@ -91,6 +91,7 @@ func ReconcileBarbican(ctx context.Context, instance *corev1beta1.OpenStackContr`
`91`	`91`	`instance.Spec.Barbican.Template.PasswordSelectors.Service,`
`92`	`92`	`instance.Spec.Barbican.Template.ServiceUser,`
`93`	`93`	`instance.Spec.Barbican.ApplicationCredential,`
	`94`	`+ false,`
`94`	`95`	`)`
`95`	`96`	`if err != nil {`
`96`	`97`	`return ctrl.Result{}, err`
Original file line number	Diff line number	Diff line change
`@@ -115,6 +115,7 @@ func ReconcileCinder(ctx context.Context, instance *corev1beta1.OpenStackControl`
`115`	`115`	`instance.Spec.Cinder.Template.PasswordSelectors.Service,`
`116`	`116`	`instance.Spec.Cinder.Template.ServiceUser,`
`117`	`117`	`instance.Spec.Cinder.ApplicationCredential,`
	`118`	`+ false,`
`118`	`119`	`)`
`119`	`120`	`if err != nil {`
`120`	`121`	`return ctrl.Result{}, err`
Original file line number	Diff line number	Diff line change
`@@ -103,6 +103,7 @@ func ReconcileDesignate(ctx context.Context, instance *corev1beta1.OpenStackCont`
`103`	`103`	`instance.Spec.Designate.Template.PasswordSelectors.Service,`
`104`	`104`	`instance.Spec.Designate.Template.ServiceUser,`
`105`	`105`	`instance.Spec.Designate.ApplicationCredential,`
	`106`	`+ false,`
`106`	`107`	`)`
`107`	`108`	`if err != nil {`
`108`	`109`	`return ctrl.Result{}, err`
Original file line number	Diff line number	Diff line change
`@@ -145,6 +145,7 @@ func ReconcileGlance(ctx context.Context, instance *corev1beta1.OpenStackControl`
`145`	`145`	`instance.Spec.Glance.Template.PasswordSelectors.Service,`
`146`	`146`	`instance.Spec.Glance.Template.ServiceUser,`
`147`	`147`	`instance.Spec.Glance.ApplicationCredential,`
	`148`	`+ false,`
`148`	`149`	`)`
`149`	`150`	`if err != nil {`
`150`	`151`	`return ctrl.Result{}, err`
Original file line number	Diff line number	Diff line change
`@@ -134,6 +134,7 @@ func ReconcileHeat(ctx context.Context, instance *corev1beta1.OpenStackControlPl`
`134`	`134`	`instance.Spec.Heat.Template.PasswordSelectors.Service,`
`135`	`135`	`instance.Spec.Heat.Template.ServiceUser,`
`136`	`136`	`instance.Spec.Heat.ApplicationCredential,`
	`137`	`+ false,`
`137`	`138`	`)`
`138`	`139`	`if err != nil {`
`139`	`140`	`return ctrl.Result{}, err`
Original file line number	Diff line number	Diff line change
`@@ -93,6 +93,7 @@ func ReconcileManila(ctx context.Context, instance *corev1beta1.OpenStackControl`
`93`	`93`	`instance.Spec.Manila.Template.PasswordSelectors.Service,`
`94`	`94`	`instance.Spec.Manila.Template.ServiceUser,`
`95`	`95`	`instance.Spec.Manila.ApplicationCredential,`
	`96`	`+ false,`
`96`	`97`	`)`
`97`	`98`	`if err != nil {`
`98`	`99`	`return ctrl.Result{}, err`
Original file line number	Diff line number	Diff line change
`@@ -137,6 +137,7 @@ func ReconcileNeutron(ctx context.Context, instance *corev1beta1.OpenStackContro`
`137`	`137`	`instance.Spec.Neutron.Template.PasswordSelectors.Service,`
`138`	`138`	`instance.Spec.Neutron.Template.ServiceUser,`
`139`	`139`	`instance.Spec.Neutron.ApplicationCredential,`
	`140`	`+ false,`
`140`	`141`	`)`
`141`	`142`	`if err != nil {`
`142`	`143`	`return ctrl.Result{}, err`
Original file line number	Diff line number	Diff line change
`@@ -209,6 +209,7 @@ func ReconcileNova(ctx context.Context, instance *corev1beta1.OpenStackControlPl`
`209`	`209`	`instance.Spec.Nova.Template.PasswordSelectors.Service,`
`210`	`210`	`instance.Spec.Nova.Template.ServiceUser,`
`211`	`211`	`instance.Spec.Nova.ApplicationCredential,`
	`212`	`+ true,`
`212`	`213`	`)`
`213`	`214`	`if err != nil {`
`214`	`215`	`return ctrl.Result{}, err`