Implement ApplicationCredentials by gndrmnn · Pull Request #671 · k-orc/openstack-resource-controller

gndrmnn · 2026-02-04T16:10:56Z

Adds ApplicationCredential support

Due to the nature of the OpenStack API, we have to work around addressing application credentials not only by their unique ID, but also a UserRef.

Closes #670

github-actions · 2026-02-05T15:55:00Z

Failed to assess the semver bump. See logs for details.

github-actions · 2026-02-12T16:07:35Z

Failed to assess the semver bump. See logs for details.

github-actions · 2026-02-17T15:01:22Z

Failed to assess the semver bump. See logs for details.

github-actions · 2026-02-19T15:55:00Z

Failed to assess the semver bump. See logs for details.

github-actions · 2026-02-24T10:30:33Z

Failed to assess the semver bump. See logs for details.

api/v1alpha1/applicationcredential_types.go

mandre

This is a great start! There's a bit more work to do around dependency management and handling of the secret, but hopefully nothing blocking.

It's annoying that the openstack API doesn't allow retrieving an app cred directly via its UUID, forcing us to pass it a user ID as well. I don't think there's a magic solution for it, and we'll have to document the tradeoff we've made, and explain how managing app creds for other user might increase the load on OpenStack API.

Again, really good work.

api/v1alpha1/applicationcredential_types.go

internal/osclients/applicationcredential.go

mandre · 2026-03-05T09:03:29Z

internal/controllers/applicationcredential/actuator.go

+	var filters []osclients.ResourceFilter[osResourceT]
+
+	// Add client-side filters
+	if resourceSpec.Description != nil {


Looks like the keystone API allows filtering app creds via description but this is missing from gophercloud.

Would you like to contribute this to gophercloud?

Yeah, I could address this at some point. But I would like to get this PR merged in the foreseeable future. Would you mind, if we open a new issue for this instead?

Clearly not something I expect you to fix in gophercloud before this PR lands :)
It was just an observation for something I noticed during review.

internal/controllers/applicationcredential/actuator.go

$ go run ./cmd/scaffold-controller -interactive=false \ -kind=ApplicationCredential \ -gophercloud-client=NewIdentityV3 \ -gophercloud-module=github.com/gophercloud/gophercloud/v2/openstack/identity/v3/applicationcredentials \ -gophercloud-type=ApplicationCredential \ -openstack-json-object=application_credentials \ -required-create-dependency=User \ -import-dependency=User On-behalf-of: SAP nils.gondermann@sap.com

Register with the resource generator On-behalf-of: SAP nils.gondermann@sap.com

Add the OpenStack client to scope On-behalf-of: SAP nils.gondermann@sap.com

Register the controller On-behalf-of: SAP nils.gondermann@sap.com

On-behalf-of: SAP nils.gondermann@sap.com

mandre

A lot of changes since I last looked at it, I see there's now proper dependency handling. I've left a few comments, some that really need addressing before we merge, some less important. I also see you chose to make passing the password required, I think that's a fair first implementation, that we can change later.

mandre · 2026-03-26T13:09:18Z

config/samples/openstack_v1alpha1_applicationcredential.yaml

+    unrestricted: true
+    secret:
+      secretRef: kubernetes-secret
+    roleRef:


Suggested change

roleRef:

roleRefs:

mandre · 2026-03-26T13:14:42Z

api/v1alpha1/applicationcredential_types.go

+
+	// secret used to authenticate against the API
+	// +required
+	Secret ApplicationCredentialSecretSpec `json:"secret,omitempty,omitzero"`


If there's no extra parameters associated with the secret, it's probably not necessary to wrap into a struct, is it?

Suggested change

Secret ApplicationCredentialSecretSpec `json:"secret,omitempty,omitzero"`

SecretRef KubernetesNameRef `json:"secretRef,omitempty"`

mandre · 2026-03-26T13:24:32Z

api/v1alpha1/applicationcredential_types.go

+	// +optional
+	Name *string `json:"name,omitempty"`
+
+	// id is the ID of an role


nit

Suggested change

// id is the ID of an role

// id is the ID of a role

mandre · 2026-03-26T13:42:25Z

...ollers/applicationcredential/tests/applicationcredential-create-full/00-create-resource.yaml

+    unrestricted: true
+    secret:
+      secretRef: "application-credential-secret"
+    roleRef:


Should be plurals. I suspect your test succeeds because you're getting default roles.

Suggested change

roleRef:

roleRefs:

mandre · 2026-03-26T14:03:04Z

...nal/controllers/applicationcredential/tests/applicationcredential-create-full/00-assert.yaml

+      kind: ApplicationCredential
+      name: applicationcredential-create-full
+      ref: applicationcredential
+    - apiVersion: openstack.k-orc.cloud/v1alpha1


I wonder if we shouldn't simply store the UserID in the resource status 🤔

This way, we could drop the hack that goes over all users.

mandre · 2026-03-26T16:05:15Z

internal/controllers/applicationcredential/actuator.go

+	return user.Status.ID, rs
+}
+
+func (actuator applicationcredentialActuator) ResolveUserIDDependency(ctx context.Context, orcObject orcObjectPT) (*string, progress.ReconcileStatus) {


Same here, this function appears to not be needed?

mandre · 2026-03-26T16:09:46Z

internal/controllers/applicationcredential/actuator.go

+				// Programming error
+				return nil, progress.WrapError(fmt.Errorf("service %s was not returned by GetDependencies", serviceName))
+			}
+			accessRule.Service = *service.Status.ID


Should be the service type, and not id, right?

mandre · 2026-03-26T16:15:42Z

internal/controllers/applicationcredential/actuator.go

+
+	var secretData []byte
+
+	secret, secretReconcileStatus := dependency.FetchDependency(


We should move this dependency retrieval at the top of the function, where the other dependencies are retrieved.

mandre · 2026-03-26T16:20:22Z

internal/controllers/applicationcredential/actuator.go

+func (actuator applicationcredentialActuator) DeleteResource(ctx context.Context, orcObject orcObjectPT, resource *osResourceT) progress.ReconcileStatus {
+	var reconcileStatus progress.ReconcileStatus
+
+	userID, userDepRS := actuator.ResolveUserIDDependency(ctx, orcObject)


See my comment about storing the user ID in the resource status. This would make it easier to retrieve here.

mandre · 2026-03-26T16:23:43Z

internal/controllers/applicationcredential/controller.go

+
+			services := make([]string, len(resource.AccessRules))
+			for i := range resource.AccessRules {
+				services[i] = string(*resource.AccessRules[i].ServiceRef)


ServiceRef is optional, so we would need to check for nil, and only add service refs that are set.

github-actions bot added the semver:major Breaking change label Feb 4, 2026

gndrmnn force-pushed the implement_appcred branch from b164bc7 to 3b4c877 Compare February 5, 2026 15:54

github-actions bot removed the semver:major Breaking change label Feb 5, 2026

gndrmnn force-pushed the implement_appcred branch from 3b4c877 to 1673576 Compare February 12, 2026 16:05

gndrmnn force-pushed the implement_appcred branch from 1673576 to 9f8fef7 Compare February 17, 2026 15:00

gndrmnn force-pushed the implement_appcred branch from 9f8fef7 to 6b99144 Compare February 19, 2026 15:54

gndrmnn force-pushed the implement_appcred branch from 6b99144 to 2f6ff31 Compare February 24, 2026 10:30

gndrmnn force-pushed the implement_appcred branch from 2f6ff31 to 480ccef Compare February 24, 2026 11:24

github-actions bot added the semver:major Breaking change label Feb 24, 2026

gndrmnn force-pushed the implement_appcred branch 7 times, most recently from b05fcb5 to ba588f7 Compare February 26, 2026 09:58

gndrmnn mentioned this pull request Feb 26, 2026

Keystone Application Credentials Controller #670

Open

mandre reviewed Mar 5, 2026

View reviewed changes

api/v1alpha1/applicationcredential_types.go Outdated Show resolved Hide resolved

mandre reviewed Mar 5, 2026

View reviewed changes

gndrmnn force-pushed the implement_appcred branch 2 times, most recently from ac1c351 to b991cc7 Compare March 5, 2026 11:52

gndrmnn added 4 commits March 17, 2026 16:02

Scaffolding for the ApplicationCredential controller

c74168c

Register with the resource generator On-behalf-of: SAP nils.gondermann@sap.com

Scaffolding for the ApplicationCredential controller

7214e21

Add the OpenStack client to scope On-behalf-of: SAP nils.gondermann@sap.com

Scaffolding for the ApplicationCredential controller

6fa13d4

Register the controller On-behalf-of: SAP nils.gondermann@sap.com

gndrmnn force-pushed the implement_appcred branch 14 times, most recently from 3337480 to 3b6f422 Compare March 23, 2026 13:46

gndrmnn added 4 commits March 23, 2026 15:22

ApplicationCredential Type Declaration

af33297

On-behalf-of: SAP nils.gondermann@sap.com

ApplicationCredential Workaround for userID requirement in OpenStack API

89df1cc

On-behalf-of: SAP nils.gondermann@sap.com

ApplicationCredential Regenerate Interfaces

580c1cc

On-behalf-of: SAP nils.gondermann@sap.com

ApplicationCredential Actuator and Status

022f9fb

On-behalf-of: SAP nils.gondermann@sap.com

gndrmnn force-pushed the implement_appcred branch from 3b6f422 to 9379fb5 Compare March 23, 2026 14:37

gndrmnn requested a review from mandre March 23, 2026 14:40

gndrmnn added 2 commits March 24, 2026 11:22

ApplicationCredential Tests and Config Samples

eaf6db9

On-behalf-of: SAP nils.gondermann@sap.com

ApplicationCredential Additional Documentation

123212f

On-behalf-of: SAP nils.gondermann@sap.com

gndrmnn force-pushed the implement_appcred branch from 9379fb5 to 123212f Compare March 24, 2026 10:22

gndrmnn marked this pull request as ready for review March 24, 2026 10:23

mandre reviewed Mar 26, 2026

View reviewed changes

	Secret ApplicationCredentialSecretSpec `json:"secret,omitempty,omitzero"`
	SecretRef KubernetesNameRef `json:"secretRef,omitempty"`


		var secretData []byte

		secret, secretReconcileStatus := dependency.FetchDependency(

Conversation

gndrmnn commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 5, 2026

Uh oh!

github-actions bot commented Feb 12, 2026

Uh oh!

github-actions bot commented Feb 17, 2026

Uh oh!

github-actions bot commented Feb 19, 2026

Uh oh!

github-actions bot commented Feb 24, 2026

Uh oh!

Uh oh!

mandre left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mandre left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

gndrmnn commented Feb 4, 2026 •

edited

Loading