@@ -436,6 +436,24 @@ func (r *PlacementAPIReconciler) Reconcile(ctx context.Context, req ctrl.Request
436436
437437 instance .Status .Conditions .MarkTrue (condition .TLSInputReadyCondition , condition .InputReadyMessage )
438438
439+ //
440+ // check for Application Credential secret and add hash to the vars map
441+ //
442+ if instance .Spec .Auth .ApplicationCredentialSecret != "" {
443+ acHash , result , _ , err := ensureSecret (
444+ ctx ,
445+ types.NamespacedName {Namespace : instance .Namespace , Name : instance .Spec .Auth .ApplicationCredentialSecret },
446+ []string {
447+ keystonev1 .ACIDSecretKey ,
448+ },
449+ h .GetClient (),
450+ & instance .Status .Conditions )
451+ if err != nil {
452+ return result , err
453+ }
454+ configMapVars ["secret-" + instance .Spec .Auth .ApplicationCredentialSecret ] = env .SetValue (acHash )
455+ }
456+
439457 // create hash over all the different input resources to identify if any those changed
440458 // and a restart/recreate is required.
441459 //
@@ -849,6 +867,7 @@ const (
849867 tlsAPIInternalField = ".spec.tls.api.internal.secretName"
850868 tlsAPIPublicField = ".spec.tls.api.public.secretName"
851869 topologyField = ".spec.topologyRef.Name"
870+ authAppCredSecretField = ".spec.auth.applicationCredentialSecret" // #nosec G101
852871)
853872
854873var allWatchFields = []string {
@@ -857,6 +876,7 @@ var allWatchFields = []string{
857876 tlsAPIInternalField ,
858877 tlsAPIPublicField ,
859878 topologyField ,
879+ authAppCredSecretField ,
860880}
861881
862882// SetupWithManager sets up the controller with the Manager.
@@ -921,6 +941,18 @@ func (r *PlacementAPIReconciler) SetupWithManager(mgr ctrl.Manager) error {
921941 return err
922942 }
923943
944+ // index authAppCredSecretField
945+ if err := mgr .GetFieldIndexer ().IndexField (context .Background (), & placementv1.PlacementAPI {}, authAppCredSecretField , func (rawObj client.Object ) []string {
946+ // Extract the application credential secret name from the spec, if one is provided
947+ cr := rawObj .(* placementv1.PlacementAPI )
948+ if cr .Spec .Auth .ApplicationCredentialSecret == "" {
949+ return nil
950+ }
951+ return []string {cr .Spec .Auth .ApplicationCredentialSecret }
952+ }); err != nil {
953+ return err
954+ }
955+
924956 return ctrl .NewControllerManagedBy (mgr ).
925957 For (& placementv1.PlacementAPI {}).
926958 Owns (& mariadbv1.MariaDBDatabase {}).
@@ -1378,6 +1410,28 @@ func (r *PlacementAPIReconciler) generateServiceConfigMaps(
13781410 ),
13791411 }
13801412
1413+ templateParameters ["UseApplicationCredentials" ] = false
1414+ // Try to get Application Credential for this service
1415+ if instance .Spec .Auth .ApplicationCredentialSecret != "" {
1416+ secret := & corev1.Secret {}
1417+ key := types.NamespacedName {Namespace : instance .Namespace , Name : instance .Spec .Auth .ApplicationCredentialSecret }
1418+ if err := r .Get (ctx , key , secret ); err != nil {
1419+ if ! k8s_errors .IsNotFound (err ) {
1420+ h .GetLogger ().Error (err , "Failed to get ApplicationCredential secret" , "secret" , key )
1421+ return err
1422+ }
1423+ } else {
1424+ acID , okID := secret .Data [keystonev1 .ACIDSecretKey ]
1425+ acSecret , okSecret := secret .Data [keystonev1 .ACSecretSecretKey ]
1426+ if okID && len (acID ) > 0 && okSecret && len (acSecret ) > 0 {
1427+ templateParameters ["UseApplicationCredentials" ] = true
1428+ templateParameters ["ACID" ] = string (acID )
1429+ templateParameters ["ACSecret" ] = string (acSecret )
1430+ h .GetLogger ().Info ("Using ApplicationCredentials auth" , "secret" , key )
1431+ }
1432+ }
1433+ }
1434+
13811435 // create httpd vhost template parameters
13821436 httpdVhostConfig := map [string ]any {}
13831437 for _ , endpt := range []service.Endpoint {service .EndpointInternal , service .EndpointPublic } {
0 commit comments