Implement ApplicationCredentials by gndrmnn · Pull Request #671 · k-orc/openstack-resource-controller

gndrmnn · 2026-02-04T16:10:56Z

Adds ApplicationCredential support

Due to the nature of the OpenStack API, we have to work around addressing application credentials not only by their unique ID, but also a UserRef.

Closes #670

github-actions · 2026-02-05T15:55:00Z

Failed to assess the semver bump. See logs for details.

github-actions · 2026-02-12T16:07:35Z

Failed to assess the semver bump. See logs for details.

github-actions · 2026-02-17T15:01:22Z

Failed to assess the semver bump. See logs for details.

github-actions · 2026-02-19T15:55:00Z

Failed to assess the semver bump. See logs for details.

github-actions · 2026-02-24T10:30:33Z

Failed to assess the semver bump. See logs for details.

api/v1alpha1/applicationcredential_types.go

mandre

This is a great start! There's a bit more work to do around dependency management and handling of the secret, but hopefully nothing blocking.

It's annoying that the openstack API doesn't allow retrieving an app cred directly via its UUID, forcing us to pass it a user ID as well. I don't think there's a magic solution for it, and we'll have to document the tradeoff we've made, and explain how managing app creds for other user might increase the load on OpenStack API.

Again, really good work.

api/v1alpha1/applicationcredential_types.go

internal/osclients/applicationcredential.go

mandre · 2026-03-05T09:03:29Z

internal/controllers/applicationcredential/actuator.go

+	var filters []osclients.ResourceFilter[osResourceT]
+
+	// Add client-side filters
+	if resourceSpec.Description != nil {


Looks like the keystone API allows filtering app creds via description but this is missing from gophercloud.

Would you like to contribute this to gophercloud?

Yeah, I could address this at some point. But I would like to get this PR merged in the foreseeable future. Would you mind, if we open a new issue for this instead?

Clearly not something I expect you to fix in gophercloud before this PR lands :)
It was just an observation for something I noticed during review.

internal/controllers/applicationcredential/actuator.go

mandre

A lot of changes since I last looked at it, I see there's now proper dependency handling. I've left a few comments, some that really need addressing before we merge, some less important. I also see you chose to make passing the password required, I think that's a fair first implementation, that we can change later.

config/samples/openstack_v1alpha1_applicationcredential.yaml

mandre · 2026-03-26T13:14:42Z

api/v1alpha1/applicationcredential_types.go

+
+	// secret used to authenticate against the API
+	// +required
+	Secret ApplicationCredentialSecretSpec `json:"secret,omitempty,omitzero"`


If there's no extra parameters associated with the secret, it's probably not necessary to wrap into a struct, is it?

Suggested change

Secret ApplicationCredentialSecretSpec `json:"secret,omitempty,omitzero"`

SecretRef KubernetesNameRef `json:"secretRef,omitempty"`

api/v1alpha1/applicationcredential_types.go

...ollers/applicationcredential/tests/applicationcredential-create-full/00-create-resource.yaml

mandre · 2026-03-26T14:03:04Z

...nal/controllers/applicationcredential/tests/applicationcredential-create-full/00-assert.yaml

+      kind: ApplicationCredential
+      name: applicationcredential-create-full
+      ref: applicationcredential
+    - apiVersion: openstack.k-orc.cloud/v1alpha1


I wonder if we shouldn't simply store the UserID in the resource status 🤔

This way, we could drop the hack that goes over all users.

internal/controllers/applicationcredential/actuator.go

mandre · 2026-03-26T16:09:46Z

internal/controllers/applicationcredential/actuator.go

+				// Programming error
+				return nil, progress.WrapError(fmt.Errorf("service %s was not returned by GetDependencies", serviceName))
+			}
+			accessRule.Service = *service.Status.ID


Should be the service type, and not id, right?

internal/controllers/applicationcredential/actuator.go

mandre · 2026-03-26T16:20:22Z

internal/controllers/applicationcredential/actuator.go

+func (actuator applicationcredentialActuator) DeleteResource(ctx context.Context, orcObject orcObjectPT, resource *osResourceT) progress.ReconcileStatus {
+	var reconcileStatus progress.ReconcileStatus
+
+	userID, userDepRS := actuator.ResolveUserIDDependency(ctx, orcObject)


See my comment about storing the user ID in the resource status. This would make it easier to retrieve here.

mandre · 2026-03-26T16:23:43Z

internal/controllers/applicationcredential/controller.go

+
+			services := make([]string, len(resource.AccessRules))
+			for i := range resource.AccessRules {
+				services[i] = string(*resource.AccessRules[i].ServiceRef)


ServiceRef is optional, so we would need to check for nil, and only add service refs that are set.

$ go run ./cmd/scaffold-controller -interactive=false \ -kind=ApplicationCredential \ -gophercloud-client=NewIdentityV3 \ -gophercloud-module=github.com/gophercloud/gophercloud/v2/openstack/identity/v3/applicationcredentials \ -gophercloud-type=ApplicationCredential \ -openstack-json-object=application_credentials \ -required-create-dependency=User \ -import-dependency=User On-behalf-of: SAP nils.gondermann@sap.com

Register with the resource generator On-behalf-of: SAP nils.gondermann@sap.com

Add the OpenStack client to scope On-behalf-of: SAP nils.gondermann@sap.com

Register the controller On-behalf-of: SAP nils.gondermann@sap.com

On-behalf-of: SAP nils.gondermann@sap.com

mandre · 2026-03-31T12:07:41Z

@gndrmnn let me know when your PR is ready for review again.

gndrmnn · 2026-03-31T12:09:12Z

@gndrmnn let me know when your PR is ready for review again.

sure. I will use the GitHub review request feature. i need a little more time though

github-actions bot added the semver:major Breaking change label Feb 4, 2026

gndrmnn force-pushed the implement_appcred branch from b164bc7 to 3b4c877 Compare February 5, 2026 15:54

github-actions bot removed the semver:major Breaking change label Feb 5, 2026

gndrmnn force-pushed the implement_appcred branch from 3b4c877 to 1673576 Compare February 12, 2026 16:05

gndrmnn force-pushed the implement_appcred branch from 1673576 to 9f8fef7 Compare February 17, 2026 15:00

gndrmnn force-pushed the implement_appcred branch from 9f8fef7 to 6b99144 Compare February 19, 2026 15:54

gndrmnn force-pushed the implement_appcred branch from 6b99144 to 2f6ff31 Compare February 24, 2026 10:30

gndrmnn force-pushed the implement_appcred branch from 2f6ff31 to 480ccef Compare February 24, 2026 11:24

github-actions bot added the semver:major Breaking change label Feb 24, 2026

gndrmnn force-pushed the implement_appcred branch 7 times, most recently from b05fcb5 to ba588f7 Compare February 26, 2026 09:58

gndrmnn mentioned this pull request Feb 26, 2026

Keystone Application Credentials Controller #670

Open

mandre reviewed Mar 5, 2026

View reviewed changes

api/v1alpha1/applicationcredential_types.go Outdated Show resolved Hide resolved

mandre reviewed Mar 5, 2026

View reviewed changes

gndrmnn force-pushed the implement_appcred branch 2 times, most recently from ac1c351 to b991cc7 Compare March 5, 2026 11:52

gndrmnn force-pushed the implement_appcred branch 4 times, most recently from 02a1ad7 to 94388d7 Compare March 18, 2026 13:36

gndrmnn force-pushed the implement_appcred branch 6 times, most recently from 3b6f422 to 9379fb5 Compare March 23, 2026 14:37

gndrmnn requested a review from mandre March 23, 2026 14:40

gndrmnn force-pushed the implement_appcred branch from 9379fb5 to 123212f Compare March 24, 2026 10:22

gndrmnn marked this pull request as ready for review March 24, 2026 10:23

mandre reviewed Mar 26, 2026

View reviewed changes

gndrmnn added 6 commits March 30, 2026 10:50

Scaffolding for the ApplicationCredential controller

f90c3d2

Register with the resource generator On-behalf-of: SAP nils.gondermann@sap.com

Scaffolding for the ApplicationCredential controller

d3af13f

Add the OpenStack client to scope On-behalf-of: SAP nils.gondermann@sap.com

Scaffolding for the ApplicationCredential controller

2d5c9cd

Register the controller On-behalf-of: SAP nils.gondermann@sap.com

ApplicationCredential Type Declaration

5829389

On-behalf-of: SAP nils.gondermann@sap.com

ApplicationCredential Workaround for userID requirement in OpenStack API

79bb2e2

On-behalf-of: SAP nils.gondermann@sap.com

gndrmnn force-pushed the implement_appcred branch 2 times, most recently from bb642b3 to af2402f Compare March 30, 2026 11:03

gndrmnn added 2 commits March 30, 2026 14:59

ApplicationCredential Actuator and Status

03bbaa1

On-behalf-of: SAP nils.gondermann@sap.com

ApplicationCredential Regenerate Interfaces

b093bad

On-behalf-of: SAP nils.gondermann@sap.com

gndrmnn force-pushed the implement_appcred branch 5 times, most recently from 757dac4 to ed5af8b Compare March 31, 2026 10:11

gndrmnn added 2 commits March 31, 2026 12:44

ApplicationCredential Tests and Config Samples

b99b15d

On-behalf-of: SAP nils.gondermann@sap.com

ApplicationCredential Additional Documentation

0d71847

On-behalf-of: SAP nils.gondermann@sap.com

gndrmnn force-pushed the implement_appcred branch from ed5af8b to 0d71847 Compare March 31, 2026 10:44

	Secret ApplicationCredentialSecretSpec `json:"secret,omitempty,omitzero"`
	SecretRef KubernetesNameRef `json:"secretRef,omitempty"`

Conversation

gndrmnn commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 5, 2026

Uh oh!

github-actions bot commented Feb 12, 2026

Uh oh!

github-actions bot commented Feb 17, 2026

Uh oh!

github-actions bot commented Feb 19, 2026

Uh oh!

github-actions bot commented Feb 24, 2026

Uh oh!

Uh oh!

mandre left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mandre left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mandre commented Mar 31, 2026

Uh oh!

gndrmnn commented Mar 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

gndrmnn commented Feb 4, 2026 •

edited

Loading