Add AC finalizer management

Deydra71 · Deydra71 · commit 8c927b960776 · 2026-05-20T17:52:33.000+02:00
Signed-off-by: Veronika Fisarova &lt;vfisarov@redhat.com&gt;
diff --git a/api/bases/telemetry.openstack.org_autoscalings.yaml b/api/bases/telemetry.openstack.org_autoscalings.yaml
@@ -456,6 +456,10 @@ spec:
                   type: string
                 description: API endpoint
                 type: object
+              applicationCredentialSecret:
+                description: ApplicationCredentialSecret - the AC secret aodh is currently
+                  consuming
+                type: string
               conditions:
                 description: Conditions
                 items:
diff --git a/api/bases/telemetry.openstack.org_ceilometers.yaml b/api/bases/telemetry.openstack.org_ceilometers.yaml
@@ -306,6 +306,10 @@ spec:
           status:
             description: CeilometerStatus defines the observed state of Ceilometer
             properties:
+              applicationCredentialSecret:
+                description: ApplicationCredentialSecret - the AC secret ceilometer
+                  is currently consuming
+                type: string
               conditions:
                 description: Conditions
                 items:
diff --git a/api/bases/telemetry.openstack.org_cloudkitties.yaml b/api/bases/telemetry.openstack.org_cloudkitties.yaml
@@ -760,6 +760,10 @@ spec:
                   type: object
                 description: API endpoints
                 type: object
+              applicationCredentialSecret:
+                description: ApplicationCredentialSecret - the AC secret cloudkitty
+                  is currently consuming
+                type: string
               cloudKittyAPIReadyCount:
                 default: 0
                 description: ReadyCount of CloudKitty API instance
diff --git a/api/v1beta1/autoscaling_types.go b/api/v1beta1/autoscaling_types.go
@@ -237,6 +237,9 @@ type AutoscalingStatus struct {
 
 	// LastAppliedTopology - the last applied Topology
 	LastAppliedTopology *topologyv1.TopoRef `json:"lastAppliedTopology,omitempty"`
+
+	// ApplicationCredentialSecret - the AC secret aodh is currently consuming
+	ApplicationCredentialSecret string `json:"applicationCredentialSecret,omitempty"`
 }
 
 //+kubebuilder:object:root=true
diff --git a/api/v1beta1/ceilometer_types.go b/api/v1beta1/ceilometer_types.go
@@ -218,6 +218,9 @@ type CeilometerStatus struct {
 
 	// LastAppliedTopology - the last applied Topology
 	LastAppliedTopology *topologyv1.TopoRef `json:"lastAppliedTopology,omitempty"`
+
+	// ApplicationCredentialSecret - the AC secret ceilometer is currently consuming
+	ApplicationCredentialSecret string `json:"applicationCredentialSecret,omitempty"`
 }
 
 // NOTE(mmagr): remove KSMStatus with API version increment
diff --git a/api/v1beta1/cloudkitty_types.go b/api/v1beta1/cloudkitty_types.go
@@ -354,6 +354,9 @@ type CloudKittyStatus struct {
 
 	// PrometheusTLS - Determines if TLS should be used for accessing prometheus
 	PrometheusTLS bool `json:"prometheusTLS,omitempty"`
+
+	// ApplicationCredentialSecret - the AC secret cloudkitty is currently consuming
+	ApplicationCredentialSecret string `json:"applicationCredentialSecret,omitempty"`
 }
 
 //+kubebuilder:object:root=true
diff --git a/config/crd/bases/telemetry.openstack.org_autoscalings.yaml b/config/crd/bases/telemetry.openstack.org_autoscalings.yaml
@@ -456,6 +456,10 @@ spec:
                   type: string
                 description: API endpoint
                 type: object
+              applicationCredentialSecret:
+                description: ApplicationCredentialSecret - the AC secret aodh is currently
+                  consuming
+                type: string
               conditions:
                 description: Conditions
                 items:
diff --git a/config/crd/bases/telemetry.openstack.org_ceilometers.yaml b/config/crd/bases/telemetry.openstack.org_ceilometers.yaml
@@ -306,6 +306,10 @@ spec:
           status:
             description: CeilometerStatus defines the observed state of Ceilometer
             properties:
+              applicationCredentialSecret:
+                description: ApplicationCredentialSecret - the AC secret ceilometer
+                  is currently consuming
+                type: string
               conditions:
                 description: Conditions
                 items:
diff --git a/config/crd/bases/telemetry.openstack.org_cloudkitties.yaml b/config/crd/bases/telemetry.openstack.org_cloudkitties.yaml
@@ -760,6 +760,10 @@ spec:
                   type: object
                 description: API endpoints
                 type: object
+              applicationCredentialSecret:
+                description: ApplicationCredentialSecret - the AC secret cloudkitty
+                  is currently consuming
+                type: string
               cloudKittyAPIReadyCount:
                 default: 0
                 description: ReadyCount of CloudKitty API instance
diff --git a/go.mod b/go.mod
@@ -10,14 +10,14 @@ require (
 	github.com/grafana/loki/operator/api/loki v0.0.0-20250910094332-a082b8a061ba
 	github.com/k8snetworkplumbingwg/network-attachment-definition-client v1.7.7
 	github.com/onsi/gomega v1.41.0
-	github.com/openstack-k8s-operators/heat-operator/api v0.6.1-0.20260428063332-32d27fe544a9
+	github.com/openstack-k8s-operators/heat-operator/api v0.6.1-0.20260413092447-bc6ef34fe170
 	github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260508091801-73f228e6af31
-	github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260507114237-f0b612d6c21f
-	github.com/openstack-k8s-operators/lib-common/modules/ansible v0.6.1-0.20260506154724-30a976ba8ef0
-	github.com/openstack-k8s-operators/lib-common/modules/certmanager v0.6.1-0.20260506154724-30a976ba8ef0
+	github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260520090027-4d7b7a01c0bf
+	github.com/openstack-k8s-operators/lib-common/modules/ansible v0.6.1-0.20260417092244-81c71b39e981
+	github.com/openstack-k8s-operators/lib-common/modules/certmanager v0.6.1-0.20260417092244-81c71b39e981
 	github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260518125357-72bdd580c587
-	github.com/openstack-k8s-operators/mariadb-operator/api v0.6.1-0.20260503164939-40728ae44d65
-	github.com/openstack-k8s-operators/ovn-operator/api v0.6.1-0.20260428063332-55b3554934b5
+	github.com/openstack-k8s-operators/mariadb-operator/api v0.6.1-0.20260413152655-564a51226a2a
+	github.com/openstack-k8s-operators/ovn-operator/api v0.6.1-0.20260417150438-dd80e10bc183
 	github.com/openstack-k8s-operators/telemetry-operator/api v0.3.1-0.20240529090522-c780bd90b147
 	github.com/rhobs/obo-prometheus-operator/pkg/apis/monitoring v0.77.1-rhobs1
 	github.com/rhobs/observability-operator v1.0.0
@@ -65,8 +65,8 @@ require (
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/openshift/api v3.9.0+incompatible // indirect
-	github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260430090237-a4265c18a162 // indirect
-	github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260430090237-a4265c18a162 // indirect
+	github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260506154724-30a976ba8ef0 // indirect
+	github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260506154724-30a976ba8ef0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/prometheus/client_golang v1.22.0 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
diff --git a/go.sum b/go.sum
@@ -109,26 +109,26 @@ github.com/onsi/gomega v1.41.0 h1:OwKp4pXNgVxf6sCplzYo794OFNuoL2q2SBMU5NSWOjA=
 github.com/onsi/gomega v1.41.0/go.mod h1:M/Uqpu/8qTjtzCLUA2zJHX9Iilrau25x1PdoSRbWh5A=
 github.com/openshift/api v0.0.0-20250711200046-c86d80652a9e h1:E1OdwSpqWuDPCedyUt0GEdoAE+r5TXy7YS21yNEo+2U=
 github.com/openshift/api v0.0.0-20250711200046-c86d80652a9e/go.mod h1:Shkl4HanLwDiiBzakv+con/aMGnVE2MAGvoKp5oyYUo=
-github.com/openstack-k8s-operators/heat-operator/api v0.6.1-0.20260428063332-32d27fe544a9 h1:DpUqWKiI65YNSDknN/uHO0Yl90DdS7omfrdszZHA1Pw=
-github.com/openstack-k8s-operators/heat-operator/api v0.6.1-0.20260428063332-32d27fe544a9/go.mod h1:QV5Oj54Ewg3pRycVeW9LLKl/NZJzHomhiL1lFRvf0dk=
+github.com/openstack-k8s-operators/heat-operator/api v0.6.1-0.20260413092447-bc6ef34fe170 h1:y+UVxgbLuEkmfbRIZAdRAMg1JQc4vexIT15GPELlvJI=
+github.com/openstack-k8s-operators/heat-operator/api v0.6.1-0.20260413092447-bc6ef34fe170/go.mod h1:9LW4EM4ZhR/BnTftysGFVTObydKHBrAqyBMN+1jt1HM=
 github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260508091801-73f228e6af31 h1:FWa0vNs175LpV1eSZ60YOGFdbJ3LqxQ1fxfprBRg7T4=
 github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260508091801-73f228e6af31/go.mod h1:/S2AN21zV70V1XuL0Of2dCjYWNkKwQSyNI8l/iQVrMs=
-github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260507114237-f0b612d6c21f h1:28WYAUIef3uion0Pps6doCSSbgZtIcodGzwG6BHhCOw=
-github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260507114237-f0b612d6c21f/go.mod h1:4ryvbSYuoN522BIPijnm0wMemPgJVKf7jCv8BNDq46I=
-github.com/openstack-k8s-operators/lib-common/modules/ansible v0.6.1-0.20260506154724-30a976ba8ef0 h1:cqSkbKimia/gFWwj5qn0unP594FQe1nsHyCs3HRs+zw=
-github.com/openstack-k8s-operators/lib-common/modules/ansible v0.6.1-0.20260506154724-30a976ba8ef0/go.mod h1:tXxVkkk8HlATwTmDA5RTP3b+c8apfuMM15mZ2wW5iNs=
-github.com/openstack-k8s-operators/lib-common/modules/certmanager v0.6.1-0.20260506154724-30a976ba8ef0 h1:Dck0sbRnRRm0JZ9zdbKoJADZqk37pEv7sFUZ8sZwqDA=
-github.com/openstack-k8s-operators/lib-common/modules/certmanager v0.6.1-0.20260506154724-30a976ba8ef0/go.mod h1:+0PCJgchLUfBcZM3pebsN0pN+d5a22NiC2vy2cpGfRs=
+github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260520090027-4d7b7a01c0bf h1:FoKK0zNo48i4ZMFxScupCK/YAmy6Ps4IILz3CK4BCTI=
+github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260520090027-4d7b7a01c0bf/go.mod h1:VNX1Mda2u5+yGxycIyVrgABucitMDR9ct3Lj6ROS92I=
+github.com/openstack-k8s-operators/lib-common/modules/ansible v0.6.1-0.20260417092244-81c71b39e981 h1:3aS6IFc8SHDf/tso8FKONOnhampZ3hV0ic0NH2FYmio=
+github.com/openstack-k8s-operators/lib-common/modules/ansible v0.6.1-0.20260417092244-81c71b39e981/go.mod h1:tXxVkkk8HlATwTmDA5RTP3b+c8apfuMM15mZ2wW5iNs=
+github.com/openstack-k8s-operators/lib-common/modules/certmanager v0.6.1-0.20260417092244-81c71b39e981 h1:G0YU5B6AhXDy/46urlNjz6tMXmHGDdoslgucTIN3F30=
+github.com/openstack-k8s-operators/lib-common/modules/certmanager v0.6.1-0.20260417092244-81c71b39e981/go.mod h1:GzD7Jc5o98ptJ97DSjhC0CQ6OiTP0PB/2qJqxYGcOH8=
 github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260518125357-72bdd580c587 h1:p03uEXoSreyu7LpFmb9YyYM8tEx2D2+7qqhLXNWHTq0=
 github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260518125357-72bdd580c587/go.mod h1:JC04T5G4E/he5ukonV1oCqa0QzFkLv761VbLruVghJM=
-github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260430090237-a4265c18a162 h1:kUfZlcl+EbUBEWe6EGLXjzlUeYj7xZ21QsPA5jMJlwE=
-github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260430090237-a4265c18a162/go.mod h1:7yqbVpg0k0vW+kZks+TMU/cd1ovoejyHfVPWcyGYLHI=
-github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260430090237-a4265c18a162 h1:b/E0t3klHOxMUzpp/TaMB6OwLliv9mwsHxE94i8Rifc=
-github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260430090237-a4265c18a162/go.mod h1:xSRQQt2ygoUdjq0pJelQ7X2aeKPIgAj71O9NpV10CQY=
-github.com/openstack-k8s-operators/mariadb-operator/api v0.6.1-0.20260503164939-40728ae44d65 h1:MNjmU326MKwYU6xT6AL2aKbr/0ids87wP5B+s5CL2O0=
-github.com/openstack-k8s-operators/mariadb-operator/api v0.6.1-0.20260503164939-40728ae44d65/go.mod h1:I2LO+wGIzbirVczQ9qo/49y2F5Zo/MEg/pabkXOrY2M=
-github.com/openstack-k8s-operators/ovn-operator/api v0.6.1-0.20260428063332-55b3554934b5 h1:E8KZkBUK2QzIEksFVxMUg0ETzvAX7uNuEg+2UqmX45I=
-github.com/openstack-k8s-operators/ovn-operator/api v0.6.1-0.20260428063332-55b3554934b5/go.mod h1:ODYNTFMUlzvjlqXAh9AGXrzpBNQBAOkWiNQ6UldsqFw=
+github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260506154724-30a976ba8ef0 h1:kMie+G0aHlGwDHjimjj8AUxTl2R7LGfai/8pev2T+TY=
+github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260506154724-30a976ba8ef0/go.mod h1:7yqbVpg0k0vW+kZks+TMU/cd1ovoejyHfVPWcyGYLHI=
+github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260506154724-30a976ba8ef0 h1:wuzSibIT9F/5RbMmxvBVFj6fy2vtKo58nibzmk5L4PM=
+github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260506154724-30a976ba8ef0/go.mod h1:tft3oDiN+v6wX3ILPXGUM/gCLJz6QtrPN63hxpJ3E24=
+github.com/openstack-k8s-operators/mariadb-operator/api v0.6.1-0.20260413152655-564a51226a2a h1:1VRHhhCE8U0+Q6jPNppxcklIVfK7gZ2Js9VaLpPR7sw=
+github.com/openstack-k8s-operators/mariadb-operator/api v0.6.1-0.20260413152655-564a51226a2a/go.mod h1:g/xgMnzNHxdTkqnEgAKwVOv75uPN4nuApbkGqSvASvs=
+github.com/openstack-k8s-operators/ovn-operator/api v0.6.1-0.20260417150438-dd80e10bc183 h1:ZkUOyGEkXPPeuKQdVP7DQGFYOR0Boo1uDb+GBNlrk0U=
+github.com/openstack-k8s-operators/ovn-operator/api v0.6.1-0.20260417150438-dd80e10bc183/go.mod h1:wtnlbYH3u8jHHKltKDCf0ILNtCe7ZnOJSreSGXCbb2w=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
diff --git a/internal/autoscaling/const.go b/internal/autoscaling/const.go
@@ -45,6 +45,9 @@ const (
 	// PrometheusEndpointSecret is the name of the secret containing Prometheus endpoint configuration
 	PrometheusEndpointSecret = "metric-storage-prometheus-endpoint"
 
+	// ACConsumerFinalizer is added to AC secrets that autoscaling (Aodh) is actively consuming
+	ACConsumerFinalizer = "openstack.org/autoscaling-ac-consumer"
+
 	// AodhUserID -
 	AodhUserID = 42402
 )
diff --git a/internal/ceilometer/const.go b/internal/ceilometer/const.go
@@ -37,4 +37,7 @@ const (
 
 	// CeilometerUserID -
 	CeilometerUserID = 42405
+
+	// ACConsumerFinalizer is added to AC secrets that Ceilometer is actively consuming
+	ACConsumerFinalizer = "openstack.org/ceilometer-ac-consumer"
 )
diff --git a/internal/cloudkitty/const.go b/internal/cloudkitty/const.go
@@ -65,6 +65,9 @@ const (
 
 	// CloudKittyUserID -
 	CloudKittyUserID = 42406
+
+	// ACConsumerFinalizer is added to AC secrets that CloudKitty is actively consuming
+	ACConsumerFinalizer = "openstack.org/cloudkitty-ac-consumer"
 )
 
 // ResultRequeue is a ctrl.Result that requeues after NormalDuration
diff --git a/internal/controller/autoscaling_controller.go b/internal/controller/autoscaling_controller.go
@@ -272,6 +272,15 @@ func (r *AutoscalingReconciler) reconcileDelete(
 	); err != nil {
 		return ctrlResult, err
 	}
+	for _, secretName := range []string{
+		instance.Status.ApplicationCredentialSecret,
+		instance.Spec.Aodh.Auth.ApplicationCredentialSecret,
+	} {
+		if err := keystonev1.RemoveACSecretConsumerFinalizer(ctx, helper, instance.Namespace,
+			secretName, autoscaling.ACConsumerFinalizer); err != nil {
+			return ctrl.Result{}, err
+		}
+	}
 	// Service is deleted so remove the finalizer.
 	controllerutil.RemoveFinalizer(instance, helper.GetFinalizer())
 	Log.Info(fmt.Sprintf("Reconciled Service '%s' delete successfully", autoscaling.ServiceName))
@@ -326,6 +335,22 @@ func (r *AutoscalingReconciler) reconcileNormal(
 		return rbacResult, nil
 	}
 
+	if instance.Spec.Aodh.Auth.ApplicationCredentialSecret != "" || instance.Status.ApplicationCredentialSecret != "" {
+		if err := keystonev1.ManageACSecretFinalizer(ctx, helper, instance.Namespace,
+			instance.Spec.Aodh.Auth.ApplicationCredentialSecret,
+			instance.Status.ApplicationCredentialSecret,
+			autoscaling.ACConsumerFinalizer); err != nil {
+			instance.Status.Conditions.Set(condition.FalseCondition(
+				condition.ServiceConfigReadyCondition,
+				condition.ErrorReason,
+				condition.SeverityWarning,
+				condition.ServiceConfigReadyErrorMessage,
+				err.Error()))
+			return ctrl.Result{}, err
+		}
+	}
+	instance.Status.ApplicationCredentialSecret = instance.Spec.Aodh.Auth.ApplicationCredentialSecret
+
 	instance.Status.Conditions.MarkTrue(condition.ServiceConfigReadyCondition, condition.ServiceConfigReadyMessage)
 
 	serviceLabels := map[string]string{
diff --git a/internal/controller/ceilometer_controller.go b/internal/controller/ceilometer_controller.go
@@ -410,6 +410,16 @@ func (r *CeilometerReconciler) reconcileDelete(ctx context.Context, instance *te
 		return ctrlResult, err
 	}
 
+	for _, secretName := range []string{
+		instance.Status.ApplicationCredentialSecret,
+		instance.Spec.Auth.ApplicationCredentialSecret,
+	} {
+		if err := keystonev1.RemoveACSecretConsumerFinalizer(ctx, helper, instance.Namespace,
+			secretName, ceilometer.ACConsumerFinalizer); err != nil {
+			return ctrl.Result{}, err
+		}
+	}
+
 	// Service is deleted so remove the finalizer.
 	controllerutil.RemoveFinalizer(instance, helper.GetFinalizer())
 	Log.Info(fmt.Sprintf("Reconciled Service '%s' delete successfully", ceilometer.ServiceName))
@@ -752,6 +762,22 @@ func (r *CeilometerReconciler) reconcileCeilometer(
 
 	instance.Status.Hash[common.InputHashName] = inputHash
 
+	if instance.Spec.Auth.ApplicationCredentialSecret != "" || instance.Status.ApplicationCredentialSecret != "" {
+		if err := keystonev1.ManageACSecretFinalizer(ctx, helper, instance.Namespace,
+			instance.Spec.Auth.ApplicationCredentialSecret,
+			instance.Status.ApplicationCredentialSecret,
+			ceilometer.ACConsumerFinalizer); err != nil {
+			instance.Status.Conditions.Set(condition.FalseCondition(
+				condition.ServiceConfigReadyCondition,
+				condition.ErrorReason,
+				condition.SeverityWarning,
+				condition.ServiceConfigReadyErrorMessage,
+				err.Error()))
+			return ctrl.Result{}, err
+		}
+	}
+	instance.Status.ApplicationCredentialSecret = instance.Spec.Auth.ApplicationCredentialSecret
+
 	instance.Status.Conditions.MarkTrue(condition.ServiceConfigReadyCondition, condition.ServiceConfigReadyMessage)
 
 	topology, err := ensureTopology(
diff --git a/internal/controller/cloudkitty_controller.go b/internal/controller/cloudkitty_controller.go
@@ -517,6 +517,16 @@ func (r *CloudKittyReconciler) reconcileDelete(ctx context.Context, instance *te
 	// TODO: We might need to control how the sub-services (API and Proc) are
 	// deleted (when their parent CloudKitty CR is deleted) once we further develop their functionality
 
+	for _, secretName := range []string{
+		instance.Status.ApplicationCredentialSecret,
+		instance.Spec.Auth.ApplicationCredentialSecret,
+	} {
+		if err := keystonev1.RemoveACSecretConsumerFinalizer(ctx, helper, instance.Namespace,
+			secretName, cloudkitty.ACConsumerFinalizer); err != nil {
+			return ctrl.Result{}, err
+		}
+	}
+
 	// Service is deleted so remove the finalizer.
 	controllerutil.RemoveFinalizer(instance, helper.GetFinalizer())
 	Log.Info(fmt.Sprintf("Reconciled Service '%s' delete successfully", instance.Name))
@@ -1027,6 +1037,22 @@ func (r *CloudKittyReconciler) reconcileNormal(ctx context.Context, instance *te
 		return ctrl.Result{}, nil
 	}
 
+	if instance.Spec.Auth.ApplicationCredentialSecret != "" || instance.Status.ApplicationCredentialSecret != "" {
+		if err := keystonev1.ManageACSecretFinalizer(ctx, helper, instance.Namespace,
+			instance.Spec.Auth.ApplicationCredentialSecret,
+			instance.Status.ApplicationCredentialSecret,
+			cloudkitty.ACConsumerFinalizer); err != nil {
+			instance.Status.Conditions.Set(condition.FalseCondition(
+				condition.ServiceConfigReadyCondition,
+				condition.ErrorReason,
+				condition.SeverityWarning,
+				condition.ServiceConfigReadyErrorMessage,
+				err.Error()))
+			return ctrl.Result{}, err
+		}
+	}
+	instance.Status.ApplicationCredentialSecret = instance.Spec.Auth.ApplicationCredentialSecret
+
 	instance.Status.Conditions.MarkTrue(condition.ServiceConfigReadyCondition, condition.ServiceConfigReadyMessage)
 
 	//
diff --git a/test/kuttl/tests/autoscaling/03-assert.yaml b/test/kuttl/tests/autoscaling/03-assert.yaml
@@ -16,9 +16,16 @@ commands:
       fi
       echo "ac-aodh.status.acID=${ac_id}"
 
+      ac_secret_name=$(oc get -n "${NS}" appcred/ac-aodh -o jsonpath='{.status.secretName}')
+      if [ -z "${ac_secret_name}" ]; then
+        echo "ERROR: appcred/ac-aodh.status.secretName is empty"
+        exit 1
+      fi
+      echo "AC secret name: ${ac_secret_name}"
+
       # Verify secret exists with correct AC_ID
-      oc get -n "${NS}" secret/ac-aodh-secret >/dev/null
-      secret_ac_id=$(oc get -n "${NS}" secret/ac-aodh-secret -o jsonpath='{.data.AC_ID}' | base64 -d)
+      oc get -n "${NS}" secret/"${ac_secret_name}" >/dev/null
+      secret_ac_id=$(oc get -n "${NS}" secret/"${ac_secret_name}" -o jsonpath='{.data.AC_ID}' | base64 -d)
       if [ "${secret_ac_id}" != "${ac_id}" ]; then
         echo "ERROR: Secret AC_ID (${secret_ac_id}) != appcred.status.acID (${ac_id})"
         exit 1
diff --git a/test/kuttl/tests/autoscaling/03-deploy-appcred.yaml b/test/kuttl/tests/autoscaling/03-deploy-appcred.yaml
@@ -27,6 +27,16 @@ commands:
         unrestricted: false
       EOF
 
+      echo "Waiting for KeystoneApplicationCredential ac-aodh to be Ready..."
+      oc wait -n "${NS}" appcred/ac-aodh --for=condition=Ready --timeout=300s
+
+      ac_secret_name=$(oc get -n "${NS}" appcred/ac-aodh -o jsonpath='{.status.secretName}')
+      if [ -z "${ac_secret_name}" ]; then
+        echo "ERROR: appcred/ac-aodh.status.secretName is empty"
+        exit 1
+      fi
+      echo "AC secret name: ${ac_secret_name}"
+
       # Patch Autoscaling to use application credential
       oc patch autoscaling telemetry-kuttl -n "${NS}" --type=merge \
-        -p '{"spec":{"aodh":{"auth":{"applicationCredentialSecret":"ac-aodh-secret"}}}}'
+        -p "{\"spec\":{\"aodh\":{\"auth\":{\"applicationCredentialSecret\":\"${ac_secret_name}\"}}}}"
diff --git a/test/kuttl/tests/autoscaling/04-assert.yaml b/test/kuttl/tests/autoscaling/04-assert.yaml
diff --git a/test/kuttl/tests/ceilometer/02-assert.yaml b/test/kuttl/tests/ceilometer/02-assert.yaml
diff --git a/test/kuttl/tests/ceilometer/02-deploy-appcred.yaml b/test/kuttl/tests/ceilometer/02-deploy-appcred.yaml
diff --git a/test/kuttl/tests/ceilometer/03-assert.yaml b/test/kuttl/tests/ceilometer/03-assert.yaml
diff --git a/test/kuttl/tests/cloudkitty/04-assert.yaml b/test/kuttl/tests/cloudkitty/04-assert.yaml
diff --git a/test/kuttl/tests/cloudkitty/04-deploy-appcred.yaml b/test/kuttl/tests/cloudkitty/04-deploy-appcred.yaml
diff --git a/test/kuttl/tests/cloudkitty/05-assert.yaml b/test/kuttl/tests/cloudkitty/05-assert.yaml

Original file line number	Diff line number	Diff line change
`@@ -237,6 +237,9 @@ type AutoscalingStatus struct {`
`237`	`237`
`238`	`238`	`// LastAppliedTopology - the last applied Topology`
`239`	`239`	LastAppliedTopology *topologyv1.TopoRef `json:"lastAppliedTopology,omitempty"`
	`240`	`+`
	`241`	`+ // ApplicationCredentialSecret - the AC secret aodh is currently consuming`
	`242`	+ ApplicationCredentialSecret string `json:"applicationCredentialSecret,omitempty"`
`240`	`243`	`}`
`241`	`244`
`242`	`245`	`//+kubebuilder:object:root=true`
Original file line number	Diff line number	Diff line change
`@@ -218,6 +218,9 @@ type CeilometerStatus struct {`
`218`	`218`
`219`	`219`	`// LastAppliedTopology - the last applied Topology`
`220`	`220`	LastAppliedTopology *topologyv1.TopoRef `json:"lastAppliedTopology,omitempty"`
	`221`	`+`
	`222`	`+ // ApplicationCredentialSecret - the AC secret ceilometer is currently consuming`
	`223`	+ ApplicationCredentialSecret string `json:"applicationCredentialSecret,omitempty"`
`221`	`224`	`}`
`222`	`225`
`223`	`226`	`// NOTE(mmagr): remove KSMStatus with API version increment`
Original file line number	Diff line number	Diff line change
`@@ -354,6 +354,9 @@ type CloudKittyStatus struct {`
`354`	`354`
`355`	`355`	`// PrometheusTLS - Determines if TLS should be used for accessing prometheus`
`356`	`356`	PrometheusTLS bool `json:"prometheusTLS,omitempty"`
	`357`	`+`
	`358`	`+ // ApplicationCredentialSecret - the AC secret cloudkitty is currently consuming`
	`359`	+ ApplicationCredentialSecret string `json:"applicationCredentialSecret,omitempty"`
`357`	`360`	`}`
`358`	`361`
`359`	`362`	`//+kubebuilder:object:root=true`