@@ -849,6 +849,7 @@ const (
849849 tlsAPIInternalField = ".spec.tls.api.internal.secretName"
850850 tlsAPIPublicField = ".spec.tls.api.public.secretName"
851851 topologyField = ".spec.topologyRef.Name"
852+ authAppCredSecretField = ".spec.auth.applicationCredentialSecret" // #nosec G101
852853)
853854
854855var allWatchFields = []string {
@@ -857,6 +858,7 @@ var allWatchFields = []string{
857858 tlsAPIInternalField ,
858859 tlsAPIPublicField ,
859860 topologyField ,
861+ authAppCredSecretField ,
860862}
861863
862864// SetupWithManager sets up the controller with the Manager.
@@ -921,6 +923,18 @@ func (r *PlacementAPIReconciler) SetupWithManager(mgr ctrl.Manager) error {
921923 return err
922924 }
923925
926+ // index authAppCredSecretField
927+ if err := mgr .GetFieldIndexer ().IndexField (context .Background (), & placementv1.PlacementAPI {}, authAppCredSecretField , func (rawObj client.Object ) []string {
928+ // Extract the application credential secret name from the spec, if one is provided
929+ cr := rawObj .(* placementv1.PlacementAPI )
930+ if cr .Spec .Auth .ApplicationCredentialSecret == "" {
931+ return nil
932+ }
933+ return []string {cr .Spec .Auth .ApplicationCredentialSecret }
934+ }); err != nil {
935+ return err
936+ }
937+
924938 return ctrl .NewControllerManagedBy (mgr ).
925939 For (& placementv1.PlacementAPI {}).
926940 Owns (& mariadbv1.MariaDBDatabase {}).
@@ -1378,6 +1392,28 @@ func (r *PlacementAPIReconciler) generateServiceConfigMaps(
13781392 ),
13791393 }
13801394
1395+ templateParameters ["UseApplicationCredentials" ] = false
1396+ // Try to get Application Credential for this service
1397+ if instance .Spec .Auth .ApplicationCredentialSecret != "" {
1398+ secret := & corev1.Secret {}
1399+ key := types.NamespacedName {Namespace : instance .Namespace , Name : instance .Spec .Auth .ApplicationCredentialSecret }
1400+ if err := r .Get (ctx , key , secret ); err != nil {
1401+ if ! k8s_errors .IsNotFound (err ) {
1402+ h .GetLogger ().Error (err , "Failed to get ApplicationCredential secret" , "secret" , key )
1403+ return err
1404+ }
1405+ } else {
1406+ acID , okID := secret .Data [keystonev1 .ACIDSecretKey ]
1407+ acSecret , okSecret := secret .Data [keystonev1 .ACSecretSecretKey ]
1408+ if okID && len (acID ) > 0 && okSecret && len (acSecret ) > 0 {
1409+ templateParameters ["UseApplicationCredentials" ] = true
1410+ templateParameters ["ACID" ] = string (acID )
1411+ templateParameters ["ACSecret" ] = string (acSecret )
1412+ h .GetLogger ().Info ("Using ApplicationCredentials auth" , "secret" , key )
1413+ }
1414+ }
1415+ }
1416+
13811417 // create httpd vhost template parameters
13821418 httpdVhostConfig := map [string ]any {}
13831419 for _ , endpt := range []service.Endpoint {service .EndpointInternal , service .EndpointPublic } {
0 commit comments