Application Credential support

[Deydra71]

Jira: https://issues.redhat.com/browse/OSPRH-16626

Adds end-to-end support for consuming Keystone Application Credentials (AC) in the nova-operator, enabling Nova control plane components (NovaAPI, Scheduler, Conductors/Cells, Metadata NoVNCProxy) to use AC-based authentication when available.

API changes:

Adds an optional authentication field to the Nova CR:

• spec.auth.applicationCredentialSecret — name of the Secret that contains the Keystone Application Credential ID and Secret (AC_ID and AC_SECRET).

Reconcile behavior:

• Reads spec.auth.applicationCredentialSecret.
• Attempts to load AC_ID / AC_SECRET from the referenced Secret (via the Keystone helper).
• If the Secret is missing or incomplete, it falls back to password authentication (AppCred auth is optional and not treated as an error).

Once the AC Secret is ready with valid AC_ID and AC_SECRET fields:

• Templates AC credentials into the rendered nova.conf for relevant auth sections (e.g. [keystone_authtoken] and service client auth stanzas such as [placement] / [neutron] / [glance] / [cinder] / [barbican] / [service_user], where applicable).
• The configuration hash includes AC values, triggering rolling updates when credentials rotate.
• A single Nova service user (nova) is used, and the same AC Secret is propagated across Nova subcomponents so all Nova pods authenticate consistently via the same credential source.
• Config template structure is updated so password-auth fields are not rendered when AppCred is used

Depends-on: openstack-k8s-operators/keystone-operator#567

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Deydra71
Once this PR has been reviewed and has the lgtm label, please assign seanmooney for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Deydra71]

I left out app cred auth from oslo_limit config section, because it needs system-scoped token, and our app creds are tied to user and project.

Kuttl tests will be added soon.

[softwarefactory-project-zuul]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/2e7e6c4092c549b9b63701580d6c34f4

✔️ openstack-meta-content-provider SUCCESS in 2h 41m 25s
✔️ nova-operator-kuttl SUCCESS in 42m 40s
✔️ nova-operator-tempest-multinode SUCCESS in 2h 17m 26s
❌ nova-operator-tempest-multinode-ceph FAILURE in 24m 26s

[SeanMooney]

This has the same design question as the watcher CRDs

specficily should the applaiction credtail secret be watched by the top level nova contoler only and embeded into the per servce cr screats that we generated or should each contoller monitor the applciation credetial secreate sepreatly.

the later will increase the load on the k8s api/etcd server and is really only useful if and only if we intended to be able to have nova-schduler use a diffent appclaition credetial form nova-conductor

if that is not the intent (i dont think it is) we shoudl not add the auth section ot the sub CRs for nova-api nova schduler ectra and should only add it to the top levele nova CRD

i dont think we have a usecase today to have seperate applciation creditals per cell but that might be reasonable so that you can rotate each cells seperately since that requires dataplane deployment to complete.

that probaly need wider dicsusion with kamil and gibi before proceeding

[openshift-ci]

@Deydra71: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/precommit-check	9d8ab81	link	true	/test precommit-check

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[softwarefactory-project-zuul]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/bc2c43d9a4bd4faca56dd814cfd0698b

✔️ openstack-meta-content-provider SUCCESS in 2h 39m 42s
✔️ nova-operator-kuttl SUCCESS in 43m 29s
✔️ nova-operator-tempest-multinode SUCCESS in 2h 03m 32s
❌ nova-operator-tempest-multinode-ceph FAILURE in 25m 53s