Skip to content

Add application credential finalizer management #466

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 1 commit into from
May 26, 2026
Merged

Add application credential finalizer management #466

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions api/bases/swift.openstack.org_swiftproxies.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -436,6 +436,10 @@ spec:
status:
description: SwiftProxyStatus defines the observed state of SwiftProxy
properties:
applicationCredentialSecret:
description: ApplicationCredentialSecret - Secret that SwiftProxy
is actively consuming (AC consumer finalizer present)
type: string
conditions:
description: Conditions
items:
Expand Down
3 changes: 3 additions & 0 deletions api/v1beta1/swiftproxy_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -173,6 +173,9 @@ type SwiftProxyStatus struct {
// TransportURLSecret - Secret containing RabbitMQ transportURL
TransportURLSecret string `json:"transportURLSecret,omitempty"`

// ApplicationCredentialSecret - Secret that SwiftProxy is actively consuming (AC consumer finalizer present)
ApplicationCredentialSecret string `json:"applicationCredentialSecret,omitempty"`

// ObservedGeneration - the most recent generation observed for this
// service. If the observed generation is less than the spec generation,
// then the controller has not processed the latest changes injected by
Expand Down
4 changes: 4 additions & 0 deletions config/crd/bases/swift.openstack.org_swiftproxies.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -436,6 +436,10 @@ spec:
status:
description: SwiftProxyStatus defines the observed state of SwiftProxy
properties:
applicationCredentialSecret:
description: ApplicationCredentialSecret - Secret that SwiftProxy
is actively consuming (AC consumer finalizer present)
type: string
conditions:
description: Conditions
items:
Expand Down
6 changes: 3 additions & 3 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,12 +8,12 @@ require (
github.com/k8snetworkplumbingwg/network-attachment-definition-client v1.7.7
github.com/onsi/ginkgo/v2 v2.28.2
github.com/onsi/gomega v1.41.0
github.com/openstack-k8s-operators/barbican-operator/api v0.6.1-0.20260520062336-4e619693858c
github.com/openstack-k8s-operators/barbican-operator/api v0.6.1-0.20260420052305-96c3a8196933
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260521141938-b817d49cac5c
github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260520090027-4d7b7a01c0bf
github.com/openstack-k8s-operators/lib-common/modules/ansible v0.6.1-0.20260518125357-72bdd580c587
github.com/openstack-k8s-operators/lib-common/modules/ansible v0.6.1-0.20260417092244-81c71b39e981
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260518125357-72bdd580c587
github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260518125357-72bdd580c587
github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260506154724-30a976ba8ef0
github.com/openstack-k8s-operators/swift-operator/api v0.3.1-0.20240523121736-379011b2cfac
k8s.io/api v0.31.14
k8s.io/apimachinery v0.31.14
Expand Down
12 changes: 6 additions & 6 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,18 +118,18 @@ github.com/onsi/gomega v1.41.0 h1:OwKp4pXNgVxf6sCplzYo794OFNuoL2q2SBMU5NSWOjA=
github.com/onsi/gomega v1.41.0/go.mod h1:M/Uqpu/8qTjtzCLUA2zJHX9Iilrau25x1PdoSRbWh5A=
github.com/openshift/api v0.0.0-20250711200046-c86d80652a9e h1:E1OdwSpqWuDPCedyUt0GEdoAE+r5TXy7YS21yNEo+2U=
github.com/openshift/api v0.0.0-20250711200046-c86d80652a9e/go.mod h1:Shkl4HanLwDiiBzakv+con/aMGnVE2MAGvoKp5oyYUo=
github.com/openstack-k8s-operators/barbican-operator/api v0.6.1-0.20260520062336-4e619693858c h1:Z+5N7zx8VdE7ArsT15V9Tmsgkv/DpvMjKsY7j6fcgGQ=
github.com/openstack-k8s-operators/barbican-operator/api v0.6.1-0.20260520062336-4e619693858c/go.mod h1:o76sKVTrHxURciO7nS+68TBI0x3zFqfJyaijxEo2FzI=
github.com/openstack-k8s-operators/barbican-operator/api v0.6.1-0.20260420052305-96c3a8196933 h1:Ks/OYlX2ipYy1XjAezm1955VkmwXoi+fAZlL0X0NDwM=
github.com/openstack-k8s-operators/barbican-operator/api v0.6.1-0.20260420052305-96c3a8196933/go.mod h1:GlhOX7fRcMXxNrRsxPcJOSWd8zvL3/Aitkjr7VWqP68=
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260521141938-b817d49cac5c h1:9379F/g0DN6MiCnBNQvSdXV+LHzS79bSOFIviriqa0w=
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260521141938-b817d49cac5c/go.mod h1:RFFB4Zs9IJv1jXs/yMjo+VswSW+rsrFZsoP0QrB1EbI=
github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260520090027-4d7b7a01c0bf h1:FoKK0zNo48i4ZMFxScupCK/YAmy6Ps4IILz3CK4BCTI=
github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260520090027-4d7b7a01c0bf/go.mod h1:VNX1Mda2u5+yGxycIyVrgABucitMDR9ct3Lj6ROS92I=
github.com/openstack-k8s-operators/lib-common/modules/ansible v0.6.1-0.20260518125357-72bdd580c587 h1:VvXvQw3t7slykvGeb+/CzmnTilSpQV2ji6gjJhHD/XU=
github.com/openstack-k8s-operators/lib-common/modules/ansible v0.6.1-0.20260518125357-72bdd580c587/go.mod h1:tXxVkkk8HlATwTmDA5RTP3b+c8apfuMM15mZ2wW5iNs=
github.com/openstack-k8s-operators/lib-common/modules/ansible v0.6.1-0.20260417092244-81c71b39e981 h1:3aS6IFc8SHDf/tso8FKONOnhampZ3hV0ic0NH2FYmio=
github.com/openstack-k8s-operators/lib-common/modules/ansible v0.6.1-0.20260417092244-81c71b39e981/go.mod h1:tXxVkkk8HlATwTmDA5RTP3b+c8apfuMM15mZ2wW5iNs=
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260518125357-72bdd580c587 h1:p03uEXoSreyu7LpFmb9YyYM8tEx2D2+7qqhLXNWHTq0=
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260518125357-72bdd580c587/go.mod h1:JC04T5G4E/he5ukonV1oCqa0QzFkLv761VbLruVghJM=
github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260518125357-72bdd580c587 h1:sg+VXXWM8amYFpynStptXbE3fNFwzYef4vVniMMzmAE=
github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260518125357-72bdd580c587/go.mod h1:7yqbVpg0k0vW+kZks+TMU/cd1ovoejyHfVPWcyGYLHI=
github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260506154724-30a976ba8ef0 h1:kMie+G0aHlGwDHjimjj8AUxTl2R7LGfai/8pev2T+TY=
github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260506154724-30a976ba8ef0/go.mod h1:7yqbVpg0k0vW+kZks+TMU/cd1ovoejyHfVPWcyGYLHI=
github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260506154724-30a976ba8ef0 h1:wuzSibIT9F/5RbMmxvBVFj6fy2vtKo58nibzmk5L4PM=
github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260506154724-30a976ba8ef0/go.mod h1:tft3oDiN+v6wX3ILPXGUM/gCLJz6QtrPN63hxpJ3E24=
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
Expand Down
50 changes: 50 additions & 0 deletions internal/controller/swiftproxy_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -658,6 +658,24 @@ func (r *SwiftProxyReconciler) Reconcile(ctx context.Context, req ctrl.Request)
// so we need to return and reconcile again
return ctrl.Result{}, nil
}
// Add consumer finalizer to the new AC secret early, before deployment.
// The old secret's finalizer is removed later (after all services deploy)
// so that rapid rotations don't revoke a credential still in use by pods.
if instance.Spec.Auth.ApplicationCredentialSecret != "" {
if err := keystonev1.ManageACSecretFinalizer(ctx, helper, instance.Namespace,
instance.Spec.Auth.ApplicationCredentialSecret,
"",
swiftproxy.ACConsumerFinalizer); err != nil {
instance.Status.Conditions.Set(condition.FalseCondition(
condition.ServiceConfigReadyCondition,
condition.ErrorReason,
condition.SeverityWarning,
condition.ServiceConfigReadyErrorMessage,
err.Error()))
return ctrl.Result{}, err
}
}

instance.Status.Conditions.MarkTrue(condition.ServiceConfigReadyCondition, condition.ServiceConfigReadyMessage)

// networks to attach to
Expand Down Expand Up @@ -788,6 +806,25 @@ func (r *SwiftProxyReconciler) Reconcile(ctx context.Context, req ctrl.Request)
condition.SeverityInfo,
condition.DeploymentReadyRunningMessage))
}
// Manage the old AC secret's finalizer and status tracking.
// On rotation (old != new), only remove the old secret's finalizer after
// all sub-services are ready with the new credentials. This prevents
// premature revocation during rapid rotations.
isRotation := instance.Status.ApplicationCredentialSecret != "" && instance.Status.ApplicationCredentialSecret != instance.Spec.Auth.ApplicationCredentialSecret

if isRotation {
allServicesReady := instance.Status.Conditions.AllSubConditionIsTrue()
if allServicesReady {
if err := keystonev1.RemoveACSecretConsumerFinalizer(ctx, helper, instance.Namespace,
instance.Status.ApplicationCredentialSecret, swiftproxy.ACConsumerFinalizer); err != nil {
return ctrl.Result{}, err
}
instance.Status.ApplicationCredentialSecret = instance.Spec.Auth.ApplicationCredentialSecret
}
} else {
instance.Status.ApplicationCredentialSecret = instance.Spec.Auth.ApplicationCredentialSecret
}

// We reached the end of the Reconcile, update the Ready condition based on
// the sub conditions
if instance.Status.Conditions.AllSubConditionIsTrue() {
Expand Down Expand Up @@ -1028,6 +1065,19 @@ func (r *SwiftProxyReconciler) reconcileDelete(ctx context.Context, instance *sw
}
}

// Remove consumer finalizer from AC secrets SwiftProxy was consuming.
// Check both status and spec to handle the edge case where the reconciler
// crashed after adding the finalizer but before updating the status.
for _, secretName := range []string{
instance.Status.ApplicationCredentialSecret,
instance.Spec.Auth.ApplicationCredentialSecret,
} {
if err := keystonev1.RemoveACSecretConsumerFinalizer(ctx, helper, instance.Namespace,
secretName, swiftproxy.ACConsumerFinalizer); err != nil {
return ctrl.Result{}, err
}
}

// Remove finalizer on the Topology CR
if ctrlResult, err := topologyv1.EnsureDeletedTopologyRef(
ctx,
Expand Down
3 changes: 3 additions & 0 deletions internal/swiftproxy/const.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,4 +22,7 @@ const (
// BarbicanSecretName is the name of the Barbican secret for Swift encryption
// Same as in OOO to be backward compatible
BarbicanSecretName = "swift_root_secret_uuid" //nolint:gosec // G101: Not actual credentials, just secret name

// ACConsumerFinalizer is added to AC secrets that SwiftProxy is actively consuming
ACConsumerFinalizer = "openstack.org/swiftproxy-ac-consumer"
)