@@ -859,6 +859,41 @@ var allWatchFields = []string{
859859 topologyField ,
860860}
861861
862+ // Application Credential secret watching function
863+ func (r * PlacementAPIReconciler ) acSecretFn (_ context.Context , o client.Object ) []reconcile.Request {
864+ name := o .GetName ()
865+ ns := o .GetNamespace ()
866+ result := []reconcile.Request {}
867+
868+ // Only handle Secret objects
869+ if _ , isSecret := o .(* corev1.Secret ); ! isSecret {
870+ return nil
871+ }
872+
873+ // Check if this is a placement AC secret by name pattern (ac-placement-secret)
874+ expectedSecretName := keystonev1 .GetACSecretName (placement .ServiceName )
875+ if name == expectedSecretName {
876+ // get all PlacementAPI CRs in this namespace
877+ placementAPIs := & placementv1.PlacementAPIList {}
878+ listOpts := []client.ListOption {
879+ client .InNamespace (ns ),
880+ }
881+ if err := r .List (context .Background (), placementAPIs , listOpts ... ); err != nil {
882+ return nil
883+ }
884+
885+ for _ , cr := range placementAPIs .Items {
886+ result = append (result , reconcile.Request {
887+ NamespacedName : types.NamespacedName {
888+ Namespace : cr .Namespace ,
889+ Name : cr .Name ,
890+ },
891+ })
892+ }
893+ }
894+ return result
895+ }
896+
862897// SetupWithManager sets up the controller with the Manager.
863898func (r * PlacementAPIReconciler ) SetupWithManager (mgr ctrl.Manager ) error {
864899 // index passwordSecretField
@@ -940,6 +975,8 @@ func (r *PlacementAPIReconciler) SetupWithManager(mgr ctrl.Manager) error {
940975 handler .EnqueueRequestsFromMapFunc (r .findObjectsForSrc ),
941976 builder .WithPredicates (predicate.ResourceVersionChangedPredicate {}),
942977 ).
978+ Watches (& corev1.Secret {},
979+ handler .EnqueueRequestsFromMapFunc (r .acSecretFn )).
943980 Watches (& topologyv1.Topology {},
944981 handler .EnqueueRequestsFromMapFunc (r .findObjectsForSrc ),
945982 builder .WithPredicates (predicate.GenerationChangedPredicate {})).
@@ -1378,6 +1415,18 @@ func (r *PlacementAPIReconciler) generateServiceConfigMaps(
13781415 ),
13791416 }
13801417
1418+ templateParameters ["UseApplicationCredentials" ] = false
1419+ // Try to get Application Credential for this service
1420+ if acData , err := keystonev1 .GetApplicationCredentialFromSecret (ctx , r .Client , instance .Namespace , placement .ServiceName ); err != nil {
1421+ h .GetLogger ().Error (err , "Failed to get ApplicationCredential for service" , "service" , placement .ServiceName )
1422+ return err
1423+ } else if acData != nil {
1424+ templateParameters ["UseApplicationCredentials" ] = true
1425+ templateParameters ["ACID" ] = acData .ID
1426+ templateParameters ["ACSecret" ] = acData .Secret
1427+ h .GetLogger ().Info ("Using ApplicationCredentials auth" , "service" , placement .ServiceName )
1428+ }
1429+
13811430 // create httpd vhost template parameters
13821431 httpdVhostConfig := map [string ]any {}
13831432 for _ , endpt := range []service.Endpoint {service .EndpointInternal , service .EndpointPublic } {
0 commit comments