Skip to content

Commit 685c276

Browse files
Deydra71Deydra71
committed
Add AC finalizer management
Signed-off-by: Veronika Fisarova <vfisarov@redhat.com>
1 parent 2814ff0 commit 685c276

10 files changed

Lines changed: 241 additions & 30 deletions

File tree

‎api/bases/watcher.openstack.org_watchers.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -737,6 +737,13 @@ spec:
737737
from watcher-api
738738
format: int32
739739
type: integer
740+
applicationCredentialSecret:
741+
description: |-
742+
ApplicationCredentialSecret - the AC secret watcher is currently
743+
consuming and protecting with the openstack.org/watcher-ac-consumer
744+
finalizer. Tracked so the controller can remove its finalizer from the
745+
old secret when the openstack-operator rotates the reference.
746+
type: string
740747
applierServiceReadyCount:
741748
description: ApplierServiceReadyCount defines the number or replicas
742749
ready from watcher-applier

‎api/go.mod‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@ go 1.24.4
55
toolchain go1.24.6
66

77
require (
8-
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260316100655-863ae03d41af
9-
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260320125710-3a5f82ff0f18
8+
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260416122644-5476763a36b6
9+
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260417092244-81c71b39e981
1010
k8s.io/api v0.31.14
1111
k8s.io/apimachinery v0.31.14
1212
k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d
@@ -44,7 +44,6 @@ require (
4444
github.com/prometheus/client_model v0.6.2 // indirect
4545
github.com/prometheus/common v0.65.0 // indirect
4646
github.com/prometheus/procfs v0.16.1 // indirect
47-
github.com/rabbitmq/cluster-operator/v2 v2.16.0 // indirect
4847
github.com/spf13/pflag v1.0.7 // indirect
4948
github.com/x448/float16 v0.8.4 // indirect
5049
go.yaml.in/yaml/v2 v2.4.2 // indirect
@@ -91,3 +90,5 @@ replace k8s.io/component-base => k8s.io/component-base v0.31.14 //allow-merging
9190
replace github.com/rabbitmq/cluster-operator/v2 => github.com/openstack-k8s-operators/rabbitmq-cluster-operator/v2 v2.6.1-0.20250929174222-a0d328fa4dec //allow-merging
9291

9392
replace k8s.io/kube-openapi => k8s.io/kube-openapi v0.0.0-20250627150254-e9823e99808e //allow-merging
93+
94+
replace github.com/openstack-k8s-operators/keystone-operator/api => github.com/Deydra71/keystone-operator/api v0.0.0-20260424093804-00a0ccdc9d20

‎api/go.sum‎

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
github.com/Masterminds/semver v1.5.0 h1:H65muMkzWKEuNDnfl9d70GUjFniHKHRbFPGBuZ3QEww=
21
github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
32
github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
43
github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
@@ -79,12 +78,10 @@ github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI
7978
github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE=
8079
github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=
8180
github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg=
82-
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260316100655-863ae03d41af h1:Ow12j/PVbEtul1bZ7s/ZenVnKPIHK2q+0VgTp+j/wro=
83-
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260316100655-863ae03d41af/go.mod h1:nC/Jf3OYJRML8UEzJ/mn/TQcSCv/nhqO6x6LGkdDt60=
84-
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260320125710-3a5f82ff0f18 h1:P1Nx+i6aH7rFy+T4nrB2AlQzzoLMrMwtnZPEsFvC5cM=
85-
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260320125710-3a5f82ff0f18/go.mod h1:+vcGsjqibpMUz3y/g0B5YIXNotlTvQdMB6f92siiwKM=
86-
github.com/openstack-k8s-operators/rabbitmq-cluster-operator/v2 v2.6.1-0.20250929174222-a0d328fa4dec h1:saovr368HPAKHN0aRPh8h8n9s9dn3d8Frmfua0UYRlc=
87-
github.com/openstack-k8s-operators/rabbitmq-cluster-operator/v2 v2.6.1-0.20250929174222-a0d328fa4dec/go.mod h1:Nh2NEePLjovUQof2krTAg4JaAoLacqtPTZQXK6izNfg=
81+
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260416122644-5476763a36b6 h1:117Gu9HCSu2tAp579WnCJ9QtnslH2qnPB8UFvn8ZpqE=
82+
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260416122644-5476763a36b6/go.mod h1:i7l8cihvFktd/LSuyvL2z6OcwauarQGoVhDMePL4VyI=
83+
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260417092244-81c71b39e981 h1:v1viH0gmNb+AXMg/0GxDcj8VUTdjVLotfOIGrNyMxHk=
84+
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260417092244-81c71b39e981/go.mod h1:I/VBXZLdjk8DUGsEbB+Ha72JBFYYntP7Pm2FpEto9K8=
8885
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
8986
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
9087
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=

‎api/v1beta1/watcher_types.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,12 @@ type WatcherStatus struct {
6161

6262
// DecisionEngineServiceReadyCount defines the number or replicas ready from watcher-decision-engine
6363
DecisionEngineServiceReadyCount int32 `json:"decisionengineServiceReadyCount,omitempty"`
64+
65+
// ApplicationCredentialSecret - the AC secret watcher is currently
66+
// consuming and protecting with the openstack.org/watcher-ac-consumer
67+
// finalizer. Tracked so the controller can remove its finalizer from the
68+
// old secret when the openstack-operator rotates the reference.
69+
ApplicationCredentialSecret string `json:"applicationCredentialSecret,omitempty"`
6470
}
6571

6672
// WatcherDBPurge defines the parameters for the Watcher database purging cron job

‎config/crd/bases/watcher.openstack.org_watchers.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -737,6 +737,13 @@ spec:
737737
from watcher-api
738738
format: int32
739739
type: integer
740+
applicationCredentialSecret:
741+
description: |-
742+
ApplicationCredentialSecret - the AC secret watcher is currently
743+
consuming and protecting with the openstack.org/watcher-ac-consumer
744+
finalizer. Tracked so the controller can remove its finalizer from the
745+
old secret when the openstack-operator rotates the reference.
746+
type: string
740747
applierServiceReadyCount:
741748
description: ApplierServiceReadyCount defines the number or replicas
742749
ready from watcher-applier

‎go.mod‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,10 @@ require (
88
github.com/onsi/ginkgo/v2 v2.28.1
99
github.com/onsi/gomega v1.39.1
1010
github.com/openshift/api v3.9.0+incompatible
11-
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260316100655-863ae03d41af
11+
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260416122644-5476763a36b6
1212
github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260314080138-b41734470581
13-
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260320125710-3a5f82ff0f18
14-
github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260320125710-3a5f82ff0f18
13+
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260417092244-81c71b39e981
14+
github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260417092244-81c71b39e981
1515
github.com/openstack-k8s-operators/mariadb-operator/api v0.6.1-0.20260314091348-5c473d964727
1616
github.com/openstack-k8s-operators/watcher-operator/api v0.0.0-00010101000000-000000000000
1717
go.uber.org/zap v1.27.1
@@ -62,14 +62,13 @@ require (
6262
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
6363
github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
6464
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
65-
github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260310070607-b96da8dd520e // indirect
66-
github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260310070607-b96da8dd520e // indirect
65+
github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260417092244-81c71b39e981 // indirect
66+
github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260417092244-81c71b39e981 // indirect
6767
github.com/pkg/errors v0.9.1 // indirect
6868
github.com/prometheus/client_golang v1.22.0 // indirect
6969
github.com/prometheus/client_model v0.6.2 // indirect
7070
github.com/prometheus/common v0.65.0 // indirect
7171
github.com/prometheus/procfs v0.16.1 // indirect
72-
github.com/rabbitmq/cluster-operator/v2 v2.16.0 // indirect
7372
github.com/spf13/cobra v1.9.1 // indirect
7473
github.com/spf13/pflag v1.0.7 // indirect
7574
github.com/stoewer/go-strcase v1.2.0 // indirect
@@ -142,3 +141,5 @@ replace k8s.io/component-base => k8s.io/component-base v0.31.14 //allow-merging
142141
replace github.com/rabbitmq/cluster-operator/v2 => github.com/openstack-k8s-operators/rabbitmq-cluster-operator/v2 v2.6.1-0.20250929174222-a0d328fa4dec //allow-merging
143142

144143
replace k8s.io/kube-openapi => k8s.io/kube-openapi v0.0.0-20250627150254-e9823e99808e //allow-merging
144+
145+
replace github.com/openstack-k8s-operators/keystone-operator/api => github.com/Deydra71/keystone-operator/api v0.0.0-20260424093804-00a0ccdc9d20

‎go.sum‎

Lines changed: 12 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
github.com/Deydra71/keystone-operator/api v0.0.0-20260424093804-00a0ccdc9d20 h1:iyxfh2SDvQrOrsHItYAE3A3+8Ku9UnzWAq9jnLJDLjg=
2+
github.com/Deydra71/keystone-operator/api v0.0.0-20260424093804-00a0ccdc9d20/go.mod h1:SpO4CL7c5/1HG+61fP6kWhL2+3aqR+5SNatdZueKrz8=
13
github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
24
github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
35
github.com/antlr4-go/antlr/v4 v4.13.0 h1:lxCg3LAv+EUK6t1i0y1V6/SLeUi0eKEKdhQAlS8TVTI=
@@ -118,22 +120,18 @@ github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=
118120
github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg=
119121
github.com/openshift/api v0.0.0-20250711200046-c86d80652a9e h1:E1OdwSpqWuDPCedyUt0GEdoAE+r5TXy7YS21yNEo+2U=
120122
github.com/openshift/api v0.0.0-20250711200046-c86d80652a9e/go.mod h1:Shkl4HanLwDiiBzakv+con/aMGnVE2MAGvoKp5oyYUo=
121-
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260316100655-863ae03d41af h1:Ow12j/PVbEtul1bZ7s/ZenVnKPIHK2q+0VgTp+j/wro=
122-
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260316100655-863ae03d41af/go.mod h1:nC/Jf3OYJRML8UEzJ/mn/TQcSCv/nhqO6x6LGkdDt60=
123-
github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260314080138-b41734470581 h1:FntUoWPVWx8xaGCwP7kdUVT/N8Z0kfIxLLK4L+oQJ7c=
124-
github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260314080138-b41734470581/go.mod h1:l15wx+Qxi/I9Nlj6u6PheZqkf9dBW7cCxAcjl8zsu+8=
125-
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260320125710-3a5f82ff0f18 h1:P1Nx+i6aH7rFy+T4nrB2AlQzzoLMrMwtnZPEsFvC5cM=
126-
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260320125710-3a5f82ff0f18/go.mod h1:+vcGsjqibpMUz3y/g0B5YIXNotlTvQdMB6f92siiwKM=
127-
github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260310070607-b96da8dd520e h1:42OT26Ak0lwWbJDNwhv/0HsjafVkLyPhfonS5DjDb2g=
128-
github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260310070607-b96da8dd520e/go.mod h1:7yqbVpg0k0vW+kZks+TMU/cd1ovoejyHfVPWcyGYLHI=
129-
github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260310070607-b96da8dd520e h1:lHsE9kmPzGHfO6o9vXj6f5UTIlQRJNdrvrj8GWy/ct8=
130-
github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260310070607-b96da8dd520e/go.mod h1:3loLaPUDQyvbPekylZd9OCLF+EXH2klRI9IeeQhuMcs=
131-
github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260320125710-3a5f82ff0f18 h1:beEKU5yv6ih8pbIqrU15QP0sGDXyxrKqVMh3zHDscrI=
132-
github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260320125710-3a5f82ff0f18/go.mod h1:dEjz8zHRIlP3vnMmWdHytlLeSZ6BHcIiSTPM7xTQxFg=
123+
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260416122644-5476763a36b6 h1:117Gu9HCSu2tAp579WnCJ9QtnslH2qnPB8UFvn8ZpqE=
124+
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260416122644-5476763a36b6/go.mod h1:i7l8cihvFktd/LSuyvL2z6OcwauarQGoVhDMePL4VyI=
125+
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260417092244-81c71b39e981 h1:v1viH0gmNb+AXMg/0GxDcj8VUTdjVLotfOIGrNyMxHk=
126+
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260417092244-81c71b39e981/go.mod h1:I/VBXZLdjk8DUGsEbB+Ha72JBFYYntP7Pm2FpEto9K8=
127+
github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260417092244-81c71b39e981 h1:jN3Kvt+RYUTaL9EXeeeIqRXVjqeNF74SuLTDXmi4X2Y=
128+
github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260417092244-81c71b39e981/go.mod h1:7yqbVpg0k0vW+kZks+TMU/cd1ovoejyHfVPWcyGYLHI=
129+
github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260417092244-81c71b39e981 h1:X3/Gc+i0ZxaROExrpLXonz9EPhftlubFnOK4aSkRLvo=
130+
github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260417092244-81c71b39e981/go.mod h1:3loLaPUDQyvbPekylZd9OCLF+EXH2klRI9IeeQhuMcs=
131+
github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260417092244-81c71b39e981 h1:KAQ8T+Ri3JWgsyK1D6QybScMh6fpkYUUA+0ntnOiAl4=
132+
github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260417092244-81c71b39e981/go.mod h1:dEjz8zHRIlP3vnMmWdHytlLeSZ6BHcIiSTPM7xTQxFg=
133133
github.com/openstack-k8s-operators/mariadb-operator/api v0.6.1-0.20260314091348-5c473d964727 h1:+IVZR4jm1MvVeoxS75cHNOsW7sf6jGdXx7kTnOSOxiw=
134134
github.com/openstack-k8s-operators/mariadb-operator/api v0.6.1-0.20260314091348-5c473d964727/go.mod h1:bUpTGnR9HF19rD2Ow6IU8wJk+xrBtKdeA8PFjpguEh8=
135-
github.com/openstack-k8s-operators/rabbitmq-cluster-operator/v2 v2.6.1-0.20250929174222-a0d328fa4dec h1:saovr368HPAKHN0aRPh8h8n9s9dn3d8Frmfua0UYRlc=
136-
github.com/openstack-k8s-operators/rabbitmq-cluster-operator/v2 v2.6.1-0.20250929174222-a0d328fa4dec/go.mod h1:Nh2NEePLjovUQof2krTAg4JaAoLacqtPTZQXK6izNfg=
137135
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
138136
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
139137
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=

‎internal/controller/watcher_controller.go‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -478,6 +478,22 @@ func (r *WatcherReconciler) Reconcile(ctx context.Context, req ctrl.Request) (re
478478
return ctrl.Result{}, err
479479
}
480480

481+
if instance.Spec.Auth.ApplicationCredentialSecret != "" || instance.Status.ApplicationCredentialSecret != "" {
482+
if err := keystonev1.ManageACSecretFinalizer(ctx, helper, instance.Namespace,
483+
instance.Spec.Auth.ApplicationCredentialSecret,
484+
instance.Status.ApplicationCredentialSecret,
485+
watcher.ACConsumerFinalizer); err != nil {
486+
instance.Status.Conditions.Set(condition.FalseCondition(
487+
condition.ServiceConfigReadyCondition,
488+
condition.ErrorReason,
489+
condition.SeverityWarning,
490+
condition.ServiceConfigReadyErrorMessage,
491+
err.Error()))
492+
return ctrl.Result{}, err
493+
}
494+
}
495+
instance.Status.ApplicationCredentialSecret = instance.Spec.Auth.ApplicationCredentialSecret
496+
481497
instance.Status.Conditions.MarkTrue(condition.ServiceConfigReadyCondition, condition.ServiceConfigReadyMessage)
482498
// End of config generation for dbsync
483499

@@ -1347,6 +1363,17 @@ func (r *WatcherReconciler) reconcileDelete(ctx context.Context, instance *watch
13471363
}
13481364
//
13491365

1366+
// Remove consumer finalizer from AC secrets watcher was consuming.
1367+
for _, secretName := range []string{
1368+
instance.Status.ApplicationCredentialSecret,
1369+
instance.Spec.Auth.ApplicationCredentialSecret,
1370+
} {
1371+
if err := keystonev1.RemoveACSecretConsumerFinalizer(ctx, helper, instance.Namespace,
1372+
secretName, watcher.ACConsumerFinalizer); err != nil {
1373+
return ctrl.Result{}, err
1374+
}
1375+
}
1376+
13501377
controllerutil.RemoveFinalizer(instance, helper.GetFinalizer())
13511378
Log.Info(fmt.Sprintf("Reconciled Service '%s' delete successfully", instance.Name))
13521379
return ctrl.Result{}, nil

‎internal/watcher/constants.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,4 +50,7 @@ const (
5050

5151
// scriptVolume is the name of the volume used to ship scripts into pods
5252
scriptVolume = "scripts-volume"
53+
54+
// ACConsumerFinalizer is added to AC secrets that watcher is actively consuming
55+
ACConsumerFinalizer = "openstack.org/watcher-ac-consumer"
5356
)

0 commit comments

Comments
 (0)