@@ -316,6 +316,47 @@ func (r *WatcherReconciler) Reconcile(ctx context.Context, req ctrl.Request) (re
316316 return ctrl.Result {}, ErrRetrievingTransportURLSecretData
317317 }
318318
319+ // Try to get Application Credential from the secret specified in the CR
320+ var acData * keystonev1.ApplicationCredentialData
321+ if instance .Spec .Auth .ApplicationCredentialSecret != "" {
322+ acSecretObj , _ , err := secret .GetSecret (ctx , helper , instance .Spec .Auth .ApplicationCredentialSecret , instance .Namespace )
323+ if err != nil {
324+ if k8s_errors .IsNotFound (err ) {
325+ Log .Info ("ApplicationCredential secret not found, waiting" , "secret" , instance .Spec .Auth .ApplicationCredentialSecret )
326+ instance .Status .Conditions .Set (condition .FalseCondition (
327+ condition .InputReadyCondition ,
328+ condition .RequestedReason ,
329+ condition .SeverityInfo ,
330+ watcherv1beta1 .WatcherApplicationCredentialSecretErrorMessage ))
331+ return ctrl.Result {}, fmt .Errorf ("%w: %s" , ErrACSecretNotFound , instance .Spec .Auth .ApplicationCredentialSecret )
332+ }
333+ Log .Error (err , "Failed to get ApplicationCredential secret" , "secret" , instance .Spec .Auth .ApplicationCredentialSecret )
334+ instance .Status .Conditions .Set (condition .FalseCondition (
335+ condition .InputReadyCondition ,
336+ condition .ErrorReason ,
337+ condition .SeverityWarning ,
338+ watcherv1beta1 .WatcherApplicationCredentialSecretErrorMessage ))
339+ return ctrl.Result {}, err
340+ }
341+ acID , okID := acSecretObj .Data [keystonev1 .ACIDSecretKey ]
342+ acSecretData , okSecret := acSecretObj .Data [keystonev1 .ACSecretSecretKey ]
343+ if okID && len (acID ) > 0 && okSecret && len (acSecretData ) > 0 {
344+ acData = & keystonev1.ApplicationCredentialData {
345+ ID : string (acID ),
346+ Secret : string (acSecretData ),
347+ }
348+ Log .Info ("Using ApplicationCredentials auth" , "secret" , instance .Spec .Auth .ApplicationCredentialSecret )
349+ } else {
350+ Log .Error (nil , "ApplicationCredential secret missing required keys" , "secret" , instance .Spec .Auth .ApplicationCredentialSecret )
351+ instance .Status .Conditions .Set (condition .FalseCondition (
352+ condition .InputReadyCondition ,
353+ condition .ErrorReason ,
354+ condition .SeverityWarning ,
355+ watcherv1beta1 .WatcherApplicationCredentialSecretErrorMessage ))
356+ return ctrl.Result {}, fmt .Errorf ("%w: %s" , ErrACSecretMissingKeys , instance .Spec .Auth .ApplicationCredentialSecret )
357+ }
358+ }
359+
319360 // Prometheus config secret
320361
321362 hashPrometheus , _ , prometheusSecret , err := ensureSecret (
@@ -354,7 +395,7 @@ func (r *WatcherReconciler) Reconcile(ctx context.Context, req ctrl.Request) (re
354395
355396 // End of Prometheus config secret
356397
357- subLevelSecretName , err := r .createSubLevelSecret (ctx , helper , instance , transporturlSecret , notificationURLSecret , inputSecret , db )
398+ subLevelSecretName , err := r .createSubLevelSecret (ctx , helper , instance , transporturlSecret , notificationURLSecret , inputSecret , db , acData )
358399 if err != nil {
359400 return ctrl.Result {}, nil
360401 }
@@ -375,7 +416,7 @@ func (r *WatcherReconciler) Reconcile(ctx context.Context, req ctrl.Request) (re
375416 // Generate config for dbsync
376417 configVars := make (map [string ]env.Setter )
377418
378- err = r .generateServiceConfigDBJobs (ctx , instance , db , & transporturlSecret , helper , & configVars )
419+ err = r .generateServiceConfigDBJobs (ctx , instance , db , & transporturlSecret , helper , & configVars , acData )
379420 if err != nil {
380421 instance .Status .Conditions .Set (condition .FalseCondition (
381422 condition .ServiceConfigReadyCondition ,
@@ -775,6 +816,7 @@ func (r *WatcherReconciler) generateServiceConfigDBJobs(
775816 transporturlSecret * corev1.Secret ,
776817 helper * helper.Helper ,
777818 envVars * map [string ]env.Setter ,
819+ acData * keystonev1.ApplicationCredentialData ,
778820) error {
779821 Log := r .GetLogger (ctx )
780822 Log .Info ("generateServiceConfigs - reconciling config for Watcher CR" )
@@ -804,6 +846,12 @@ func (r *WatcherReconciler) generateServiceConfigDBJobs(
804846 "APIPublicPort" : fmt .Sprintf ("%d" , watcher .WatcherPublicPort ),
805847 }
806848
849+ // Add Application Credential data if provided
850+ if acData != nil {
851+ templateParameters ["ACID" ] = acData .ID
852+ templateParameters ["ACSecret" ] = acData .Secret
853+ }
854+
807855 return GenerateConfigsGeneric (ctx , helper , instance , envVars , templateParameters , customData , labels , true )
808856}
809857
@@ -867,6 +915,7 @@ func (r *WatcherReconciler) createSubLevelSecret(
867915 notificationURLSecret * corev1.Secret ,
868916 inputSecret corev1.Secret ,
869917 db * mariadbv1.Database ,
918+ acData * keystonev1.ApplicationCredentialData ,
870919) (string , error ) {
871920 Log := r .GetLogger (ctx )
872921 Log .Info (fmt .Sprintf ("Creating SubCr Level Secret for '%s'" , instance .Name ))
@@ -884,6 +933,13 @@ func (r *WatcherReconciler) createSubLevelSecret(
884933 watcher .GlobalCustomConfigFileName : instance .Spec .CustomServiceConfig ,
885934 NotificationURLSelector : string (notificationURLSecret .Data [TransportURLSelector ]),
886935 }
936+
937+ // Add Application Credential data if provided
938+ if acData != nil {
939+ data ["ACID" ] = acData .ID
940+ data ["ACSecret" ] = acData .Secret
941+ }
942+
887943 secretName := instance .Name
888944
889945 labels := labels .GetLabels (instance , labels .GetGroupLabel (watcher .ServiceName ), map [string ]string {})
@@ -1266,6 +1322,18 @@ func (r *WatcherReconciler) SetupWithManager(mgr ctrl.Manager) error {
12661322 return err
12671323 }
12681324
1325+ // index authAppCredSecretField
1326+ if err := mgr .GetFieldIndexer ().IndexField (context .Background (), & watcherv1beta1.Watcher {}, authAppCredSecretField , func (rawObj client.Object ) []string {
1327+ // Extract the secret name from the spec, if one is provided
1328+ cr := rawObj .(* watcherv1beta1.Watcher )
1329+ if cr .Spec .Auth .ApplicationCredentialSecret == "" {
1330+ return nil
1331+ }
1332+ return []string {cr .Spec .Auth .ApplicationCredentialSecret }
1333+ }); err != nil {
1334+ return err
1335+ }
1336+
12691337 return ctrl .NewControllerManagedBy (mgr ).
12701338 For (& watcherv1beta1.Watcher {}).
12711339 Owns (& watcherv1beta1.WatcherAPI {}).
0 commit comments