Fix Octavia ApplicationCredentialSecret set on wrong spec path#1821
Fix Octavia ApplicationCredentialSecret set on wrong spec path#1821millevy wants to merge 1 commit intoopenstack-k8s-operators:mainfrom
Conversation
The ApplicationCredentialSecret was being set on OctaviaAPI.Auth (sub-spec level) instead of Auth (top-level OctaviaSpecBase). The octavia-operator reads the secret from spec.auth, which is populated from OctaviaSpecBase via DeepCopyInto, not from the OctaviaAPI sub-spec. This caused Octavia to silently fall back to password auth when ZDPR (application credentials) was enabled, because the secret name never reached the Octavia CR's spec.auth field. Verified manually by patching the controlplane CR to set spec.octavia.template.auth.applicationCredentialSecret, which confirmed Octavia correctly switches to v3applicationcredential auth_type when the secret is at the correct spec level. Co-authored-by: AI Assistant (Cursor/Claude) JIRA: OSPRH-26817
millevy
force-pushed
the
fix-octavia-appcred-auth-path
branch
from
3f32806 to
e6859a7
Compare
|
@millevy: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
recheck |
|
/cc @Deydra71 |
|
/approve |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: gthiemonge, millevy The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
| // Only call if AC enabled or currently configured | ||
| if isACEnabled(instance.Spec.ApplicationCredential, instance.Spec.Octavia.ApplicationCredential) || | ||
| instance.Spec.Octavia.Template.OctaviaAPI.Auth.ApplicationCredentialSecret != "" { | ||
| instance.Spec.Octavia.Template.Auth.ApplicationCredentialSecret != "" { |
There was a problem hiding this comment.
We should first fix octavia-operator - right now octavia has incorectly Auth type and nested ApplicationCredentialSecret in OctaviaAPI and at the same time Auth type in OctaviaSpecBase, but the Auth and nested ApplicationCredentialSecret should be in the parent octavia_types.go file.
https://github.com/openstack-k8s-operators/octavia-operator/blob/main/api/v1beta1/octavia_types.go#L248 (this one is correct, we just need to add the ApplicatioCredentialSecret and delete them from OctaviaAPI)
@millevy agreed to take care of this.
|
The change is redundant. |
3 participants
The ApplicationCredentialSecret was being set on OctaviaAPI.Auth (sub-spec level) instead of Auth (top-level OctaviaSpecBase). The octavia-operator reads the secret from spec.auth, which is populated from OctaviaSpecBase via DeepCopyInto, not from the OctaviaAPI sub-spec.
This caused Octavia to silently fall back to password auth when ZDPR (application credentials) was enabled, because the secret name never reached the Octavia CR's spec.auth field.
Co-authored-by: AI Assistant (Cursor/Claude)
JIRA: OSPRH-21647