Application Credential support

[Deydra71]

Jira: OSPRH-16625

This PR adds end-to-end support for consuming Keystone ApplicationCredentials (AC) in the Glance operator, enabling Glance API pods to use AC-based authentication when available.

Reconcile:

API changes:

Adds an optional authentication field to the Glance API CR:

spec.auth.applicationCredentialSecret — name of the Secret that contains the Keystone Application Credential ID and Secret (AC_ID and AC_SECRET).

Reconcile behavior:

Reads spec.auth.applicationCredentialSecret
Attempts to load AC_ID / AC_SECRET from the referenced Secret (via the Keystone helper).
If the secret is missing or incomplete, it falls back to password authentication (the AppCred auth is optional, not an error).

Once the AC Secret is ready with valid AC_ID and AC_SECRET fields, templates AC credentials into Glance configuration
Computes hash of Secret contents and stores in configVars to trigger rolling updates when credentials rotate
RBAC permissions:

Added read permissions for secrets resources to allow fetching AC secrets.

Jira: https://issues.redhat.com/browse/OSPRH-22958

Depends-On: openstack-k8s-operators/keystone-operator#567

[softwarefactory-project-zuul]

Merge Failed.

This change or one of its cross-repo dependencies was unable to be automatically merged with the current state of its repository. Please rebase the change and upload a new patchset.
Warning:
Error merging github.com/openstack-k8s-operators/glance-operator for 812,c523b5160ca745bb9ca9f3ea7887137ff70e12d4

[softwarefactory-project-zuul]

Merge Failed.

This change or one of its cross-repo dependencies was unable to be automatically merged with the current state of its repository. Please rebase the change and upload a new patchset.
Warning:
Error merging github.com/openstack-k8s-operators/glance-operator for 812,9a85e7f38f14a4bc729bb710f537d461423a111d

[softwarefactory-project-zuul]

Merge Failed.

This change or one of its cross-repo dependencies was unable to be automatically merged with the current state of its repository. Please rebase the change and upload a new patchset.
Warning:
Error merging github.com/openstack-k8s-operators/glance-operator for 812,684db0114f215b3f04702d9c8aec6aa48bb5a7ac

[softwarefactory-project-zuul]

Merge Failed.

This change or one of its cross-repo dependencies was unable to be automatically merged with the current state of its repository. Please rebase the change and upload a new patchset.
Warning:
Error merging github.com/openstack-k8s-operators/keystone-operator for 567,560a7f552956fc9c80fece28fc7e7b01b59c2274

[fmount]

@Deydra71 @stuggi I have an additional though based on how we configure both swift and cinder backends for glance:

1. swift: https://github.com/openstack-k8s-operators/glance-operator/blob/main/config/samples/backends/swift/glance.yaml#L22
2. cinder: https://github.com/openstack-k8s-operators/glance-operator/blob/main/config/samples/backends/cinder/glance-common/glance.yaml#L21

Using appCred I think will break how we currently configure those backends, that only supports user/pwd auth method [1].
@konan-abhi my understanding is that we should start planning for changes in glance_store to use v3ApplicationCredentials if available, and fallback to v3Password to keep backward compatibility, but for now I think we always need an active user/password to populate such configuration.

[1] https://github.com/openstack/glance_store/blob/master/glance_store/_drivers/cinder/store.py#L435
[2] https://github.com/openstack/glance_store/blob/master/glance_store/_drivers/swift/store.py#L1614

[konan-abhi]

@Deydra71 @stuggi I have an additional though based on how we configure both swift and cinder backends for glance:

1. swift: https://github.com/openstack-k8s-operators/glance-operator/blob/main/config/samples/backends/swift/glance.yaml#L22

2. cinder: https://github.com/openstack-k8s-operators/glance-operator/blob/main/config/samples/backends/cinder/glance-common/glance.yaml#L21

Using appCred I think will break how we currently configure those backends, that only supports user/pwd auth method [1]. @konan-abhi my understanding is that we should start planning for changes in glance_store to use v3ApplicationCredentials if available, and fallback to v3Password to keep backward compatibility, but for now I think we always need an active user/password to populate such configuration.

@fmount yeah, we need to add this support in cinder and swift store. Then based on those changes we need to populate them via glance-operator.

[1] https://github.com/openstack/glance_store/blob/master/glance_store/_drivers/cinder/store.py#L435 [2] https://github.com/openstack/glance_store/blob/master/glance_store/_drivers/swift/store.py#L1614

[fmount]

Also @Deydra71 because we deploy keystone in kuttl as a dependency, we should add this scenario to ensure some coverage.

[softwarefactory-project-zuul]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/5050fa73d3b64876b3f22ac95cc6481b

❌ openstack-k8s-operators-content-provider FAILURE in 12m 12s
⚠️ glance-operator-kuttl SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider
⚠️ glance-operator-tempest SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider

[softwarefactory-project-zuul]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/0b93c8022a244477ac8ae9d3cb588a97

❌ openstack-k8s-operators-content-provider FAILURE in 15m 31s
⚠️ glance-operator-kuttl SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider
⚠️ glance-operator-tempest SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider

[softwarefactory-project-zuul]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/02d157db4a98477b93064bb59b5a52ce

❌ openstack-k8s-operators-content-provider FAILURE in 12m 43s
⚠️ glance-operator-kuttl SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider
⚠️ glance-operator-tempest SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider

[softwarefactory-project-zuul]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/7c38d661c55d47f1a71f26a60686497e

✔️ openstack-k8s-operators-content-provider SUCCESS in 1h 48m 20s
❌ glance-operator-kuttl FAILURE in 46m 08s
✔️ glance-operator-tempest SUCCESS in 1h 26m 09s

[xek]

recheck

[softwarefactory-project-zuul]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/5810322e21a145f496b3131c7a9d892d

✔️ openstack-k8s-operators-content-provider SUCCESS in 1h 14m 25s
✔️ glance-operator-kuttl SUCCESS in 46m 20s
❌ glance-operator-tempest FAILURE in 36m 50s

[vakwetu]

recheck

[softwarefactory-project-zuul]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/6476fac26fe74ed7816160502f21e74f

❌ openstack-k8s-operators-content-provider TIMED_OUT in 30m 59s
⚠️ glance-operator-kuttl SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider
⚠️ glance-operator-tempest SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider

[softwarefactory-project-zuul]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/88c1345458254fb693c37c3a7987a16c

❌ openstack-k8s-operators-content-provider FAILURE in 7m 05s
⚠️ glance-operator-kuttl SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider
⚠️ glance-operator-tempest SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider

[fmount]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Deydra71, fmount

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [fmount]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment