@@ -7,25 +7,20 @@ import (
77 keystonev1 "github.com/openstack-k8s-operators/keystone-operator/api/v1beta1"
88 "github.com/openstack-k8s-operators/lib-common/modules/common/helper"
99 corev1beta1 "github.com/openstack-k8s-operators/openstack-operator/apis/core/v1beta1"
10-
1110 metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
1211 ctrl "sigs.k8s.io/controller-runtime"
1312 "sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
1413)
1514
16- // mergeAppCred returns a new ApplicationCredentialSection
17- // by starting from the global defaults, then overriding
18- // only the fields the service user has explicitly set
15+ // mergeAppCred returns a new ApplicationCredentialSection by overlaying
16+ // service-specific values on top of the global defaults.
1917func mergeAppCred (
2018 global corev1beta1.ApplicationCredentialSection ,
2119 svc * corev1beta1.ServiceAppCredSection ,
2220) corev1beta1.ApplicationCredentialSection {
2321 out := global
24-
2522 if svc != nil {
26- // always override Enabled, even if false
2723 out .Enabled = svc .Enabled
28-
2924 // only override expiry/grace if the user actually set them
3025 if svc .ExpirationDays != nil {
3126 out .ExpirationDays = svc .ExpirationDays
@@ -34,30 +29,23 @@ func mergeAppCred(
3429 out .GracePeriodDays = svc .GracePeriodDays
3530 }
3631 }
37-
3832 return out
3933}
4034
41- // ReconcileApplicationCredentials ensures that every OpenStack service which
42- // has AC enabled (both globally and per-service) has a corresponding
43- // keystone.openstack.org/v1beta1 ApplicationCredential CR, with proper
44- // ExpirationDays and GracePeriodDays inherited or overridden
35+ // ReconcileApplicationCredentials ensures an AC CR per enabled service,
36+ // propagating its secret name, passwordSelector, and serviceUser fields.
4537func ReconcileApplicationCredentials (
4638 ctx context.Context ,
4739 instance * corev1beta1.OpenStackControlPlane ,
4840 _ * corev1beta1.OpenStackVersion ,
4941 helper * helper.Helper ,
5042) (ctrl.Result , error ) {
51-
5243 log := GetLogger (ctx )
5344
54- // If global AC is turned off , delete service AC CRs
45+ // If global disabled , delete all ACs:
5546 if ! instance .Spec .ApplicationCredential .Enabled {
56- log .Info ("Global .spec.applicationCredential.enabled is false – deleting all per-service AC CRs" )
57- for _ , svc := range []string {
58- "glance" , "nova" , "swift" , "ceilometer" ,
59- "barbican" , "cinder" , "placement" , "neutron" ,
60- } {
47+ log .Info ("Global AC disabled; deleting per-service AC CRs" )
48+ for _ , svc := range []string {"glance" , "nova" , "swift" , "ceilometer" , "barbican" , "cinder" , "placement" , "neutron" } {
6149 ac := & keystonev1.ApplicationCredential {
6250 ObjectMeta : metav1.ObjectMeta {
6351 Name : fmt .Sprintf ("ac-%s" , svc ),
@@ -71,9 +59,25 @@ func ReconcileApplicationCredentials(
7159 return ctrl.Result {}, nil
7260 }
7361
74- // Build list of services to reconcile
62+ // Build a lookup with each service’s secret, selector, and service user name field:
63+ services := map [string ]struct {
64+ SecretName string
65+ PasswordSelector string
66+ ServiceUser string
67+ }{
68+ "glance" : {instance .Spec .Glance .Template .Secret , instance .Spec .Glance .Template .PasswordSelectors .Service , instance .Spec .Glance .Template .ServiceUser },
69+ "nova" : {instance .Spec .Nova .Template .Secret , instance .Spec .Nova .Template .PasswordSelectors .Service , instance .Spec .Nova .Template .ServiceUser },
70+ "swift" : {instance .Spec .Swift .Template .SwiftProxy .Secret , instance .Spec .Swift .Template .SwiftProxy .PasswordSelectors .Service , instance .Spec .Swift .Template .SwiftProxy .ServiceUser },
71+ "ceilometer" : {instance .Spec .Telemetry .Template .Ceilometer .Secret , instance .Spec .Telemetry .Template .Ceilometer .PasswordSelectors .CeilometerService , instance .Spec .Telemetry .Template .Ceilometer .ServiceUser },
72+ "barbican" : {instance .Spec .Barbican .Template .Secret , instance .Spec .Barbican .Template .PasswordSelectors .Service , instance .Spec .Barbican .Template .ServiceUser },
73+ "cinder" : {instance .Spec .Cinder .Template .Secret , instance .Spec .Cinder .Template .PasswordSelectors .Service , instance .Spec .Cinder .Template .ServiceUser },
74+ "placement" : {instance .Spec .Placement .Template .Secret , instance .Spec .Placement .Template .PasswordSelectors .Service , instance .Spec .Placement .Template .ServiceUser },
75+ "neutron" : {instance .Spec .Neutron .Template .Secret , instance .Spec .Neutron .Template .PasswordSelectors .Service , instance .Spec .Neutron .Template .ServiceUser },
76+ }
77+
78+ // Collect each service’s enabled flag and AC section:
7579 type svcAC struct {
76- Name string
80+ Key string
7781 Enabled bool
7882 ACSection * corev1beta1.ServiceAppCredSection
7983 }
@@ -87,33 +91,35 @@ func ReconcileApplicationCredentials(
8791 {"placement" , instance .Spec .Placement .Enabled , instance .Spec .Placement .ApplicationCredential },
8892 {"neutron" , instance .Spec .Neutron .Enabled , instance .Spec .Neutron .ApplicationCredential },
8993 }
90-
9194 global := instance .Spec .ApplicationCredential
9295
96+ // Loop, CreateOrPatch or delete each AC CR:
9397 for _ , svc := range svcs {
94- acName := fmt .Sprintf ("ac-%s" , svc .Name )
98+ acName := fmt .Sprintf ("ac-%s" , svc .Key )
9599 acObj := & keystonev1.ApplicationCredential {
96100 ObjectMeta : metav1.ObjectMeta {
97101 Name : acName ,
98102 Namespace : instance .Namespace ,
99103 },
100104 }
101105
106+ // merge flags
102107 effective := mergeAppCred (global , svc .ACSection )
103- // if either the service itself is disabled, or the merged AC.Enabled is false,
104- // then ensure that CR is deleted
105108 if ! (svc .Enabled && effective .Enabled ) {
106109 if res , err := EnsureDeleted (ctx , helper , acObj ); err != nil {
107110 return res , err
108111 }
109112 continue
110113 }
111114
112- // otherwise create or patch it to have exactly the merged values
115+ // create/ patch
113116 op , err := controllerutil .CreateOrPatch (ctx , helper .GetClient (), acObj , func () error {
114- acObj .Spec .UserName = svc .Name
117+ acObj .Spec .UserName = services [ svc .Key ]. ServiceUser
115118 acObj .Spec .ExpirationDays = * effective .ExpirationDays
116119 acObj .Spec .GracePeriodDays = * effective .GracePeriodDays
120+ acObj .Spec .Secret = services [svc .Key ].SecretName
121+ acObj .Spec .PasswordSelector = services [svc .Key ].PasswordSelector
122+
117123 return controllerutil .SetControllerReference (
118124 helper .GetBeforeObject (), acObj , helper .GetScheme (),
119125 )
@@ -122,7 +128,7 @@ func ReconcileApplicationCredentials(
122128 return ctrl.Result {}, err
123129 }
124130 if op != controllerutil .OperationResultNone {
125- log .Info ("Reconciled ApplicationCredential" , "service" , svc .Name , "operation" , op )
131+ log .Info ("Reconciled ApplicationCredential" , "service" , svc .Key , "operation" , op )
126132 }
127133 }
128134
0 commit comments