Application Credential support #600
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: afaranha The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
Build failed (check pipeline). Post https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/6d759bd17e2643e0a01d3f999ac8ac11 ❌ openstack-k8s-operators-content-provider FAILURE in 12m 31s |
afaranha
force-pushed
the
appcred-support
branch
from
f845c0b to
08b0fcf
Compare
|
Build failed (check pipeline). Post https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/04a276bec69648989673e8406f8d934d ❌ openstack-k8s-operators-content-provider FAILURE in 7m 26s |
This allows the CI check to pass for the temporary replace directive pointing to the Deydra71 fork which contains the AppCred support in keystone-operator.
|
Build failed (check pipeline). Post https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/9336569ea9d34faaa3923e684efa5618 ❌ openstack-k8s-operators-content-provider FAILURE in 7m 10s |
The config template generates 'auth_type=v3applicationcredential' (no spaces), but the test was checking for 'auth_type = v3applicationcredential' (with spaces). This fixes the CI functional test failures.
|
Build failed (check pipeline). Post https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/5f00846a401047888141e2404ec6113d ❌ openstack-k8s-operators-content-provider FAILURE in 7m 12s |
Deydra71
left a comment
Deydra71
left a comment
There was a problem hiding this comment.
The acSecretFn watcher is only added to HeatAPI, not to HeatCfnAPI or HeatEngine.
This is sufficient because the parent Heat controller generates the shared config
(heat-config-data) consumed by all three children. When HeatAPI detects the AppCred
secret change and reconciles, it triggers the parent to regenerate the shared config,
which automatically propagates to all children via config hash changes. This pattern
matches eg barbican and cinder operators.
Deydra71
left a comment
Deydra71
left a comment
There was a problem hiding this comment.
//allow-merging should not be used here, it makes the pre-commit checks to not warn us about using them. We use the replace directive here only until the PR in keystone-operator gets merged and bumped.
2 participants
Jira: OSPRH-20520
This PR adds end-to-end support for consuming Keystone ApplicationCredentials (AC) in the Heat operator, enabling Heat API pods to use AC-based authentication when available.
Reconcile:
On each reconcile, the Heat API controller checks for an AC Secret (ac-{service}-secret) using the GetApplicationCredentialFromSecret() helper from keystone-operator API:
Depends-On: openstack-k8s-operators/keystone-operator#567