Skip to content

Commit a22b12b

Browse files
Deydra71Deydra71
committed
Application Credential Support
Adds the end-to-end support for consuming Keystone ApplicationCredentials (AC) in the watcher-operator, enabling WatcherAPI, WatcherApplier, and WatcherDecisionEngine pods to use AC-based authentication when available. Signed-off-by: Veronika Fisarova <[email protected]>
1 parent fc73878 commit a22b12b

24 files changed

+694
-5
lines changed

‎api/bases/watcher.openstack.org_watcherapis.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,15 @@ spec:
5353
description: APITimeout for Route and Apache
5454
minimum: 10
5555
type: integer
56+
auth:
57+
description: Auth - Parameters related to authentication (inherited
58+
from parent Watcher CR)
59+
properties:
60+
applicationCredentialSecret:
61+
description: ApplicationCredentialSecret - Secret containing Application
62+
Credential ID and Secret
63+
type: string
64+
type: object
5665
containerImage:
5766
description: The service specific Container Image URL (will be set
5867
to environmental default if empty)

‎api/bases/watcher.openstack.org_watcherdecisionengines.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,15 @@ spec:
4949
spec:
5050
description: WatcherDecisionEngineSpec defines the desired state of WatcherDecisionEngine
5151
properties:
52+
auth:
53+
description: Auth - Parameters related to authentication (inherited
54+
from parent Watcher CR)
55+
properties:
56+
applicationCredentialSecret:
57+
description: ApplicationCredentialSecret - Secret containing Application
58+
Credential ID and Secret
59+
type: string
60+
type: object
5261
containerImage:
5362
description: The service specific Container Image URL (will be set
5463
to environmental default if empty)

‎api/bases/watcher.openstack.org_watchers.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,14 @@ spec:
5656
replicas: 1
5757
description: APIServiceTemplate - define the watcher-api service
5858
properties:
59+
auth:
60+
description: Auth - Parameters related to authentication
61+
properties:
62+
applicationCredentialSecret:
63+
description: ApplicationCredentialSecret - Secret containing
64+
Application Credential ID and Secret
65+
type: string
66+
type: object
5967
customServiceConfig:
6068
description: |-
6169
CustomServiceConfig - customize the service config using this parameter to change service defaults,
@@ -460,6 +468,15 @@ spec:
460468
type: string
461469
type: object
462470
type: object
471+
auth:
472+
description: Auth - Parameters related to authentication (shared by
473+
all Watcher components)
474+
properties:
475+
applicationCredentialSecret:
476+
description: ApplicationCredentialSecret - Secret containing Application
477+
Credential ID and Secret
478+
type: string
479+
type: object
463480
customServiceConfig:
464481
description: |-
465482
CustomServiceConfig - customize the service config using this parameter to change service defaults,

‎api/go.mod‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ toolchain go1.24.6
66

77
require (
88
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20251217131115-0f117a938d4e
9+
github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20251206133124-593df0a7a9e1
910
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20251215094837-5c05ea64c324
1011
k8s.io/api v0.31.14
1112
k8s.io/apimachinery v0.31.14
@@ -18,7 +19,6 @@ require (
1819
github.com/cespare/xxhash/v2 v2.3.0 // indirect
1920
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
2021
github.com/emicklei/go-restful/v3 v3.12.2 // indirect
21-
github.com/evanphx/json-patch v5.9.11+incompatible // indirect
2222
github.com/evanphx/json-patch/v5 v5.9.11 // indirect
2323
github.com/fsnotify/fsnotify v1.9.0 // indirect
2424
github.com/fxamacker/cbor/v2 v2.9.0 // indirect
@@ -33,13 +33,17 @@ require (
3333
github.com/google/go-cmp v0.7.0 // indirect
3434
github.com/google/gofuzz v1.2.0 // indirect
3535
github.com/google/uuid v1.6.0 // indirect
36+
github.com/gophercloud/gophercloud/v2 v2.8.0 // indirect
3637
github.com/imdario/mergo v0.3.16 // indirect
3738
github.com/josharian/intern v1.0.0 // indirect
3839
github.com/json-iterator/go v1.1.12 // indirect
3940
github.com/mailru/easyjson v0.9.0 // indirect
4041
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
4142
github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
4243
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
44+
github.com/openshift/api v3.9.0+incompatible // indirect
45+
github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20251122131503-b76943960b6c // indirect
46+
github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20251122131503-b76943960b6c // indirect
4347
github.com/pkg/errors v0.9.1 // indirect
4448
github.com/prometheus/client_golang v1.22.0 // indirect
4549
github.com/prometheus/client_model v0.6.2 // indirect
@@ -91,3 +95,5 @@ replace k8s.io/component-base => k8s.io/component-base v0.31.13 //allow-merging
9195
replace github.com/rabbitmq/cluster-operator/v2 => github.com/openstack-k8s-operators/rabbitmq-cluster-operator/v2 v2.6.1-0.20250929174222-a0d328fa4dec //allow-merging
9296

9397
replace k8s.io/kube-openapi => k8s.io/kube-openapi v0.0.0-20250627150254-e9823e99808e //allow-merging
98+
99+
replace github.com/openstack-k8s-operators/keystone-operator/api => github.com/Deydra71/keystone-operator/api v0.0.0-20251211085602-3e1a3e022c81

‎api/go.sum‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
github.com/Deydra71/keystone-operator/api v0.0.0-20251211085602-3e1a3e022c81 h1:plax+NFgJJL1SrERyXAnf3jOHRhLTtBlJ2oc7d84EoU=
2+
github.com/Deydra71/keystone-operator/api v0.0.0-20251211085602-3e1a3e022c81/go.mod h1:b98Jl8eyUw8V07l9YiuQnoMlnWC748oV8IhXH15NCC4=
13
github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
24
github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
35
github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
@@ -48,6 +50,8 @@ github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 h1:BHT72Gu3keYf3ZEu2J
4850
github.com/google/pprof v0.0.0-20250403155104-27863c87afa6/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
4951
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
5052
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
53+
github.com/gophercloud/gophercloud/v2 v2.8.0 h1:of2+8tT6+FbEYHfYC8GBu8TXJNsXYSNm9KuvpX7Neqo=
54+
github.com/gophercloud/gophercloud/v2 v2.8.0/go.mod h1:Ki/ILhYZr/5EPebrPL9Ej+tUg4lqx71/YH2JWVeU+Qk=
5155
github.com/imdario/mergo v0.3.16 h1:wwQJbIsHYGMUyLSPrEq1CT16AhnhNJQ51+4fdHUnCl4=
5256
github.com/imdario/mergo v0.3.16/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
5357
github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
@@ -78,10 +82,14 @@ github.com/onsi/ginkgo/v2 v2.27.2 h1:LzwLj0b89qtIy6SSASkzlNvX6WktqurSHwkk2ipF/Ns
7882
github.com/onsi/ginkgo/v2 v2.27.2/go.mod h1:ArE1D/XhNXBXCBkKOLkbsb2c81dQHCRcF5zwn/ykDRo=
7983
github.com/onsi/gomega v1.38.2 h1:eZCjf2xjZAqe+LeWvKb5weQ+NcPwX84kqJ0cZNxok2A=
8084
github.com/onsi/gomega v1.38.2/go.mod h1:W2MJcYxRGV63b418Ai34Ud0hEdTVXq9NW9+Sx6uXf3k=
85+
github.com/openshift/api v3.9.0+incompatible h1:fJ/KsefYuZAjmrr3+5U9yZIZbTOpVkDDLDLFresAeYs=
86+
github.com/openshift/api v3.9.0+incompatible/go.mod h1:dh9o4Fs58gpFXGSYfnVxGR9PnV53I8TW84pQaJDdGiY=
8187
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20251217131115-0f117a938d4e h1:PIjcXzMMwfvBRFgFpaq/W9tqy0t2cYvcWX+kq6uNtTM=
8288
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20251217131115-0f117a938d4e/go.mod h1:ex8ou6/3ms6ovR+CMXD6XhTlNakm1GhB6UZgagVRNW8=
8389
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20251215094837-5c05ea64c324 h1:y2awFehe8MS5YC47UAdmSSBp7qUSq61uWGWPjWEGaRc=
8490
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20251215094837-5c05ea64c324/go.mod h1:+Me0raWPPdz8gRi9D4z1khmvUgS9vIKAVC8ckg1yJZU=
91+
github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20251122131503-b76943960b6c h1:l7FO+XoQRnD4aT5p/JXVY2uezQLdC7D50KrwrTmzCfg=
92+
github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20251122131503-b76943960b6c h1:dVIaDL5BeIdJjERGaN/XlcvZVplfkzh0uUfiVUHj/6Q=
8593
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
8694
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
8795
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=

‎api/v1beta1/common_types.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,11 @@ type WatcherSpecCore struct {
129129
// APITimeout for Route and Apache
130130
APITimeout *int `json:"apiTimeout"`
131131

132+
// +kubebuilder:validation:Optional
133+
// +operator-sdk:csv:customresourcedefinitions:type=spec
134+
// Auth - Parameters related to authentication (shared by all Watcher components)
135+
Auth AuthSpec `json:"auth,omitempty"`
136+
132137
// +kubebuilder:validation:Optional
133138
// NotificationsBusInstance is the name of the RabbitMqCluster CR to select
134139
// the Message Bus Service instance used by the Watcher service to publish and consume notifications

‎api/v1beta1/watcher_webhook.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ import (
2020
"fmt"
2121

2222
topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1"
23+
keystonev1 "github.com/openstack-k8s-operators/keystone-operator/api/v1beta1"
2324
apierrors "k8s.io/apimachinery/pkg/api/errors"
2425
"k8s.io/apimachinery/pkg/runtime"
2526
"k8s.io/apimachinery/pkg/runtime/schema"
@@ -65,6 +66,11 @@ func (spec *WatcherSpec) Default() {
6566
// Default - set defaults for this WatcherSpecCore spec.
6667
func (spec *WatcherSpecCore) Default() {
6768
// no validations . Placeholder for defaulting webhook integrated in the OpenStackControlPlane
69+
70+
// Default ApplicationCredentialSecret to standard AC secret name if not specified
71+
if spec.Auth.ApplicationCredentialSecret == "" {
72+
spec.Auth.ApplicationCredentialSecret = keystonev1.GetACSecretName("watcher")
73+
}
6874
}
6975

7076
var _ webhook.Validator = &Watcher{}

‎api/v1beta1/watcherapi_types.go‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,11 @@ type WatcherAPISpec struct {
5959
// +kubebuilder:validation:Minimum=10
6060
// APITimeout for Route and Apache
6161
APITimeout int `json:"apiTimeout"`
62+
63+
// +kubebuilder:validation:Optional
64+
// +operator-sdk:csv:customresourcedefinitions:type=spec
65+
// Auth - Parameters related to authentication (inherited from parent Watcher CR)
66+
Auth AuthSpec `json:"auth,omitempty"`
6267
}
6368

6469
// WatcherAPIStatus defines the observed state of WatcherAPI
@@ -91,6 +96,14 @@ type APIOverrideSpec struct {
9196
Service map[service.Endpoint]service.RoutedOverrideSpec `json:"service,omitempty"`
9297
}
9398

99+
// AuthSpec defines authentication parameters
100+
type AuthSpec struct {
101+
// +kubebuilder:validation:Optional
102+
// +operator-sdk:csv:customresourcedefinitions:type=spec
103+
// ApplicationCredentialSecret - Secret containing Application Credential ID and Secret
104+
ApplicationCredentialSecret string `json:"applicationCredentialSecret,omitempty"`
105+
}
106+
94107
// WatcherAPITemplate defines the input parameters specified by the user to
95108
// create a WatcherAPI via higher level CRDs.
96109
type WatcherAPITemplate struct {
@@ -112,6 +125,11 @@ type WatcherAPITemplate struct {
112125
// +operator-sdk:csv:customresourcedefinitions:type=spec
113126
// TLS - Parameters related to the TLS
114127
TLS tls.API `json:"tls,omitempty"`
128+
129+
// +kubebuilder:validation:Optional
130+
// +operator-sdk:csv:customresourcedefinitions:type=spec
131+
// Auth - Parameters related to authentication
132+
Auth AuthSpec `json:"auth,omitempty"`
115133
}
116134

117135
//+kubebuilder:object:root=true

‎api/v1beta1/watcherdecisionengine_types.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,11 @@ type WatcherDecisionEngineSpec struct {
4949
// +operator-sdk:csv:customresourcedefinitions:type=spec
5050
// TLS - Parameters related to the TLS
5151
TLS tls.Ca `json:"tls,omitempty"`
52+
53+
// +kubebuilder:validation:Optional
54+
// +operator-sdk:csv:customresourcedefinitions:type=spec
55+
// Auth - Parameters related to authentication (inherited from parent Watcher CR)
56+
Auth AuthSpec `json:"auth,omitempty"`
5257
}
5358

5459
// WatcherDecisionEngineStatus defines the observed state of WatcherDecisionEngine

‎api/v1beta1/zz_generated.deepcopy.go‎

Lines changed: 19 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)