Skip to content

Commit b7fa7ee

Browse files
Deydra71Deydra71
committed
Application Credential Support
Adds the end-to-end support for consuming Keystone ApplicationCredentials (AC) in the watcher-operator, enabling WatcherAPI, WatcherApplier, and WatcherDecisionEngine pods to use AC-based authentication when available. Signed-off-by: Veronika Fisarova <[email protected]>
1 parent 74db373 commit b7fa7ee

File tree

11 files changed

+611
-39
lines changed

11 files changed

+611
-39
lines changed

‎api/go.mod‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@ toolchain go1.24.6
77
require (
88
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20251110170511-c2d4a351a7c3
99
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20251103072528-9eb684fef4ef
10-
k8s.io/api v0.31.13
11-
k8s.io/apimachinery v0.31.13
10+
k8s.io/api v0.31.14
11+
k8s.io/apimachinery v0.31.14
1212
k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d
1313
sigs.k8s.io/controller-runtime v0.19.7
1414
)
@@ -54,16 +54,16 @@ require (
5454
golang.org/x/exp v0.0.0-20241217172543-b2144cdd0a67 // indirect
5555
golang.org/x/net v0.43.0 // indirect
5656
golang.org/x/oauth2 v0.30.0 // indirect
57-
golang.org/x/sys v0.35.0 // indirect
58-
golang.org/x/term v0.34.0 // indirect
59-
golang.org/x/text v0.28.0 // indirect
57+
golang.org/x/sys v0.36.0 // indirect
58+
golang.org/x/term v0.35.0 // indirect
59+
golang.org/x/text v0.29.0 // indirect
6060
golang.org/x/time v0.12.0 // indirect
6161
gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
6262
google.golang.org/protobuf v1.36.7 // indirect
6363
gopkg.in/inf.v0 v0.9.1 // indirect
6464
gopkg.in/yaml.v3 v3.0.1 // indirect
6565
k8s.io/apiextensions-apiserver v0.33.2 // indirect
66-
k8s.io/client-go v0.31.13 // indirect
66+
k8s.io/client-go v0.31.14 // indirect
6767
k8s.io/klog/v2 v2.130.1 // indirect
6868
k8s.io/kube-openapi v0.0.0-20250902184714-7fc278399c7f // indirect
6969
sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
@@ -93,3 +93,5 @@ replace k8s.io/component-base => k8s.io/component-base v0.31.13 //allow-merging
9393
replace github.com/rabbitmq/cluster-operator/v2 => github.com/openstack-k8s-operators/rabbitmq-cluster-operator/v2 v2.6.1-0.20250929174222-a0d328fa4dec //allow-merging
9494

9595
replace k8s.io/kube-openapi => k8s.io/kube-openapi v0.0.0-20250627150254-e9823e99808e //allow-merging
96+
97+
replace github.com/openstack-k8s-operators/keystone-operator/api => github.com/Deydra71/keystone-operator/api v0.0.0-20251211085602-3e1a3e022c81

‎api/go.sum‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -137,19 +137,19 @@ golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKl
137137
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
138138
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
139139
golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
140-
golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
141-
golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
140+
golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
141+
golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
142142
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
143143
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
144144
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
145-
golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
146-
golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
147-
golang.org/x/term v0.34.0 h1:O/2T7POpk0ZZ7MAzMeWFSg6S5IpWd/RXDlM9hgM3DR4=
148-
golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw=
145+
golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k=
146+
golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
147+
golang.org/x/term v0.35.0 h1:bZBVKBudEyhRcajGcNc3jIfWPqV4y/Kt2XcoigOWtDQ=
148+
golang.org/x/term v0.35.0/go.mod h1:TPGtkTLesOwf2DE8CgVYiZinHAOuy5AYUYT1lENIZnA=
149149
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
150150
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
151-
golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
152-
golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
151+
golang.org/x/text v0.29.0 h1:1neNs90w9YzJ9BocxfsQNHKuAT4pkghyXc4nhZ6sJvk=
152+
golang.org/x/text v0.29.0/go.mod h1:7MhJOA9CD2qZyOKYazxdYMF85OwPdEr9jTtBpO7ydH4=
153153
golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
154154
golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
155155
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

‎go.mod‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,9 @@ require (
1616
github.com/openstack-k8s-operators/watcher-operator/api v0.0.0-00010101000000-000000000000
1717
go.uber.org/zap v1.27.1
1818
gopkg.in/yaml.v3 v3.0.1
19-
k8s.io/api v0.31.13
20-
k8s.io/apimachinery v0.31.13
21-
k8s.io/client-go v0.31.13
19+
k8s.io/api v0.31.14
20+
k8s.io/apimachinery v0.31.14
21+
k8s.io/client-go v0.31.14
2222
k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d
2323
sigs.k8s.io/controller-runtime v0.19.7
2424
)
@@ -62,8 +62,8 @@ require (
6262
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
6363
github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
6464
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
65-
github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20251021145236-2b84ec9fd9bb // indirect
66-
github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20250929092825-4c2402451077 // indirect
65+
github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20251103072528-9eb684fef4ef // indirect
66+
github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20251103072528-9eb684fef4ef // indirect
6767
github.com/pkg/errors v0.9.1 // indirect
6868
github.com/prometheus/client_golang v1.22.0 // indirect
6969
github.com/prometheus/client_model v0.6.2 // indirect
@@ -90,10 +90,10 @@ require (
9090
golang.org/x/mod v0.27.0 // indirect
9191
golang.org/x/net v0.43.0 // indirect
9292
golang.org/x/oauth2 v0.30.0 // indirect
93-
golang.org/x/sync v0.16.0 // indirect
94-
golang.org/x/sys v0.35.0 // indirect
95-
golang.org/x/term v0.34.0 // indirect
96-
golang.org/x/text v0.28.0 // indirect
93+
golang.org/x/sync v0.17.0 // indirect
94+
golang.org/x/sys v0.36.0 // indirect
95+
golang.org/x/term v0.35.0 // indirect
96+
golang.org/x/text v0.29.0 // indirect
9797
golang.org/x/time v0.12.0 // indirect
9898
golang.org/x/tools v0.36.0 // indirect
9999
gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
@@ -142,3 +142,5 @@ replace k8s.io/component-base => k8s.io/component-base v0.31.13 //allow-merging
142142
replace github.com/rabbitmq/cluster-operator/v2 => github.com/openstack-k8s-operators/rabbitmq-cluster-operator/v2 v2.6.1-0.20250929174222-a0d328fa4dec //allow-merging
143143

144144
replace k8s.io/kube-openapi => k8s.io/kube-openapi v0.0.0-20250627150254-e9823e99808e //allow-merging
145+
146+
replace github.com/openstack-k8s-operators/keystone-operator/api => github.com/Deydra71/keystone-operator/api v0.0.0-20251211085602-3e1a3e022c81

‎go.sum‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
github.com/Deydra71/keystone-operator/api v0.0.0-20251211085602-3e1a3e022c81 h1:plax+NFgJJL1SrERyXAnf3jOHRhLTtBlJ2oc7d84EoU=
2+
github.com/Deydra71/keystone-operator/api v0.0.0-20251211085602-3e1a3e022c81/go.mod h1:b98Jl8eyUw8V07l9YiuQnoMlnWC748oV8IhXH15NCC4=
13
github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
24
github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
35
github.com/antlr4-go/antlr/v4 v4.13.0 h1:lxCg3LAv+EUK6t1i0y1V6/SLeUi0eKEKdhQAlS8TVTI=
@@ -120,14 +122,12 @@ github.com/openshift/api v0.0.0-20250711200046-c86d80652a9e h1:E1OdwSpqWuDPCedyU
120122
github.com/openshift/api v0.0.0-20250711200046-c86d80652a9e/go.mod h1:Shkl4HanLwDiiBzakv+con/aMGnVE2MAGvoKp5oyYUo=
121123
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20251110170511-c2d4a351a7c3 h1:gKazSLpq0Ytn4OLzNtSKQpLswAdki8u8mXZgpJy83bE=
122124
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20251110170511-c2d4a351a7c3/go.mod h1:Y9LqOS1wYhn7RT4jFknINdWa+ziYEIOU1jLNxkxiCsw=
123-
github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20251027074845-ed8154b20ad1 h1:QohvX44nxoV2GwvvOURGXYyDuCn4SCrnwubTKJtzehY=
124-
github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20251027074845-ed8154b20ad1/go.mod h1:FMFoO4MjEQ85JpdLtDHxYSZxvJ9KzHua+HdKhpl0KRI=
125125
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20251103072528-9eb684fef4ef h1:1j7kk+D4ZdIXm6C/IwEjuTzIuvWUytxO39E/x94JY7k=
126126
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20251103072528-9eb684fef4ef/go.mod h1:kUT/SyuxZiOcX8ZuvpFN3PaQa2V8uQon8YwY+1RoQWM=
127-
github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20251021145236-2b84ec9fd9bb h1:wToXqX7AS1JV3Kna7RcJfkRart8rSGun2biKNfyY6Zg=
128-
github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20251021145236-2b84ec9fd9bb/go.mod h1:yf13jWb60XV26eA7A8o86ZCXNWBLNK9dPkTSWFaTPCw=
129-
github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20250929092825-4c2402451077 h1:9tpPDBV2RLXMDgt13ec8XR2OatFriItseqg+Oyvx9GA=
130-
github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20250929092825-4c2402451077/go.mod h1:JPQHkExlxeT6MU3DNJgXXJJG0NMQHlZwxxfbYRaP3eg=
127+
github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20251103072528-9eb684fef4ef h1:Ql4G7sRHpqWFGwXypN7MorDGUWv4jz5n34ayzVt3R9E=
128+
github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20251103072528-9eb684fef4ef/go.mod h1:yf13jWb60XV26eA7A8o86ZCXNWBLNK9dPkTSWFaTPCw=
129+
github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20251103072528-9eb684fef4ef h1:VMwP0988m1VCjpVn+MxHt7i3B0OuBhQnM5akKt4taVA=
130+
github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20251103072528-9eb684fef4ef/go.mod h1:jl+SNs7K7XBx5jVbUJwWV0NRDfM8LyeV4AsGAroP8XA=
131131
github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20251103072528-9eb684fef4ef h1:U9cgXJs/GuO6/0bRn6oaS7ovDrabyGPZpmZyAWksUuQ=
132132
github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20251103072528-9eb684fef4ef/go.mod h1:lgYyrXEYA2BPsq4Kg6dqa+QsHgOjMPyOsEYrvyYW3jk=
133133
github.com/openstack-k8s-operators/mariadb-operator/api v0.6.1-0.20251110170510-e669472c745c h1:Fx2ZD3jNoqprCJSEkvU59vnkNNluLH1QUstpZN6M6JU=
@@ -224,19 +224,19 @@ golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKl
224224
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
225225
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
226226
golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
227-
golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
228-
golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
227+
golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
228+
golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
229229
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
230230
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
231231
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
232-
golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
233-
golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
234-
golang.org/x/term v0.34.0 h1:O/2T7POpk0ZZ7MAzMeWFSg6S5IpWd/RXDlM9hgM3DR4=
235-
golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw=
232+
golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k=
233+
golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
234+
golang.org/x/term v0.35.0 h1:bZBVKBudEyhRcajGcNc3jIfWPqV4y/Kt2XcoigOWtDQ=
235+
golang.org/x/term v0.35.0/go.mod h1:TPGtkTLesOwf2DE8CgVYiZinHAOuy5AYUYT1lENIZnA=
236236
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
237237
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
238-
golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
239-
golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
238+
golang.org/x/text v0.29.0 h1:1neNs90w9YzJ9BocxfsQNHKuAT4pkghyXc4nhZ6sJvk=
239+
golang.org/x/text v0.29.0/go.mod h1:7MhJOA9CD2qZyOKYazxdYMF85OwPdEr9jTtBpO7ydH4=
240240
golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
241241
golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
242242
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

‎internal/controller/watcherapi_controller.go‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -472,6 +472,18 @@ func (r *WatcherAPIReconciler) generateServiceConfigs(
472472
if string(secret.Data[NotificationURLSelector]) != "" {
473473
templateParameters["NotificationURL"] = string(secret.Data[NotificationURLSelector])
474474
}
475+
476+
// Check for Application Credentials
477+
templateParameters["UseApplicationCredentials"] = false
478+
if acData, err := keystonev1.GetApplicationCredentialFromSecret(ctx, r.Client, instance.Namespace, watcher.ServiceName); err != nil {
479+
Log.Error(err, "Failed to get ApplicationCredential for service", "service", watcher.ServiceName)
480+
} else if acData != nil {
481+
templateParameters["UseApplicationCredentials"] = true
482+
templateParameters["ACID"] = acData.ID
483+
templateParameters["ACSecret"] = acData.Secret
484+
Log.Info("Using ApplicationCredentials auth", "service", watcher.ServiceName)
485+
}
486+
475487
// MTLS
476488
if memcachedInstance.GetMemcachedMTLSSecret() != "" {
477489
templateParameters["MemcachedAuthCert"] = fmt.Sprint(memcachedv1.CertMountPath())
@@ -929,6 +941,36 @@ func (r *WatcherAPIReconciler) SetupWithManager(mgr ctrl.Manager) error {
929941
return err
930942
}
931943

944+
// Application Credential secret watching function
945+
acSecretFn := func(_ context.Context, o client.Object) []reconcile.Request {
946+
result := []reconcile.Request{}
947+
948+
// Check if this is a watcher AC secret by name pattern (ac-watcher-secret)
949+
expectedSecretName := keystonev1.GetACSecretName(watcher.ServiceName)
950+
if o.GetName() == expectedSecretName {
951+
// get all WatcherAPI CRs in this namespace
952+
watcherAPIs := &watcherv1beta1.WatcherAPIList{}
953+
listOpts := []client.ListOption{
954+
client.InNamespace(o.GetNamespace()),
955+
}
956+
if err := r.Client.List(context.Background(), watcherAPIs, listOpts...); err != nil {
957+
return nil
958+
}
959+
960+
// Enqueue reconcile for all WatcherAPI instances
961+
for _, cr := range watcherAPIs.Items {
962+
result = append(result, reconcile.Request{
963+
NamespacedName: types.NamespacedName{
964+
Namespace: o.GetNamespace(),
965+
Name: cr.Name,
966+
},
967+
})
968+
}
969+
}
970+
971+
return result
972+
}
973+
932974
return ctrl.NewControllerManagedBy(mgr).
933975
For(&watcherv1beta1.WatcherAPI{}).
934976
Owns(&corev1.Secret{}).
@@ -940,6 +982,11 @@ func (r *WatcherAPIReconciler) SetupWithManager(mgr ctrl.Manager) error {
940982
handler.EnqueueRequestsFromMapFunc(r.findObjectsForSrc),
941983
builder.WithPredicates(predicate.ResourceVersionChangedPredicate{}),
942984
).
985+
Watches(
986+
&corev1.Secret{},
987+
handler.EnqueueRequestsFromMapFunc(acSecretFn),
988+
builder.WithPredicates(predicate.ResourceVersionChangedPredicate{}),
989+
).
943990
Watches(
944991
&memcachedv1.Memcached{},
945992
handler.EnqueueRequestsFromMapFunc(r.findObjectsForSrc),

‎internal/controller/watcherapplier_controller.go‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -435,6 +435,17 @@ func (r *WatcherApplierReconciler) generateServiceConfigs(
435435
templateParameters["NotificationURL"] = string(secret.Data[NotificationURLSelector])
436436
}
437437

438+
// Check for Application Credentials
439+
templateParameters["UseApplicationCredentials"] = false
440+
if acData, err := keystonev1.GetApplicationCredentialFromSecret(ctx, r.Client, instance.Namespace, watcher.ServiceName); err != nil {
441+
Log.Error(err, "Failed to get ApplicationCredential for service", "service", watcher.ServiceName)
442+
} else if acData != nil {
443+
templateParameters["UseApplicationCredentials"] = true
444+
templateParameters["ACID"] = acData.ID
445+
templateParameters["ACSecret"] = acData.Secret
446+
Log.Info("Using ApplicationCredentials auth", "service", watcher.ServiceName)
447+
}
448+
438449
// MTLS
439450
if memcachedInstance.GetMemcachedMTLSSecret() != "" {
440451
templateParameters["MemcachedAuthCert"] = fmt.Sprint(memcachedv1.CertMountPath())
@@ -506,6 +517,36 @@ func (r *WatcherApplierReconciler) SetupWithManager(mgr ctrl.Manager) error {
506517
return err
507518
}
508519

520+
// Application Credential secret watching function
521+
acSecretFn := func(_ context.Context, o client.Object) []reconcile.Request {
522+
result := []reconcile.Request{}
523+
524+
// Check if this is a watcher AC secret by name pattern (ac-watcher-secret)
525+
expectedSecretName := keystonev1.GetACSecretName(watcher.ServiceName)
526+
if o.GetName() == expectedSecretName {
527+
// get all WatcherApplier CRs in this namespace
528+
watcherAppliers := &watcherv1beta1.WatcherApplierList{}
529+
listOpts := []client.ListOption{
530+
client.InNamespace(o.GetNamespace()),
531+
}
532+
if err := r.Client.List(context.Background(), watcherAppliers, listOpts...); err != nil {
533+
return nil
534+
}
535+
536+
// Enqueue reconcile for all WatcherApplier instances
537+
for _, cr := range watcherAppliers.Items {
538+
result = append(result, reconcile.Request{
539+
NamespacedName: types.NamespacedName{
540+
Namespace: o.GetNamespace(),
541+
Name: cr.Name,
542+
},
543+
})
544+
}
545+
}
546+
547+
return result
548+
}
549+
509550
return ctrl.NewControllerManagedBy(mgr).
510551
For(&watcherv1beta1.WatcherApplier{}).
511552
Owns(&corev1.Secret{}).
@@ -515,6 +556,11 @@ func (r *WatcherApplierReconciler) SetupWithManager(mgr ctrl.Manager) error {
515556
handler.EnqueueRequestsFromMapFunc(r.findObjectsForSrc),
516557
builder.WithPredicates(predicate.ResourceVersionChangedPredicate{}),
517558
).
559+
Watches(
560+
&corev1.Secret{},
561+
handler.EnqueueRequestsFromMapFunc(acSecretFn),
562+
builder.WithPredicates(predicate.ResourceVersionChangedPredicate{}),
563+
).
518564
Watches(
519565
&memcachedv1.Memcached{},
520566
handler.EnqueueRequestsFromMapFunc(r.findObjectsForSrc),

0 commit comments

Comments
 (0)