@@ -578,6 +578,20 @@ func (r *SwiftProxyReconciler) Reconcile(ctx context.Context, req ctrl.Request)
578578 return ctrl.Result {}, err
579579 }
580580
581+ // Get Application Credential data if available
582+ useAC := false
583+ acID := ""
584+ acSecret := ""
585+ // Try to get Application Credential for this service (via keystone api helper)
586+ if acData , err := keystonev1 .GetApplicationCredentialFromSecret (ctx , r .Client , instance .Namespace , swift .ServiceName ); err != nil {
587+ Log .Error (err , "Failed to get ApplicationCredential for service" , "service" , swift .ServiceName )
588+ } else if acData != nil {
589+ useAC = true
590+ acID = acData .ID
591+ acSecret = acData .Secret
592+ Log .Info ("Using ApplicationCredentials auth" , "service" , swift .ServiceName )
593+ }
594+
581595 // Create a Secret populated with content from templates/
582596 tpl := swiftproxy .SecretTemplates (
583597 instance ,
@@ -591,6 +605,9 @@ func (r *SwiftProxyReconciler) Reconcile(ctx context.Context, req ctrl.Request)
591605 os .GetRegion (),
592606 transportURLString ,
593607 instance .Spec .APITimeout ,
608+ useAC ,
609+ acID ,
610+ acSecret ,
594611 )
595612 err = secret .EnsureSecrets (ctx , helper , instance , tpl , & envVars )
596613 if err != nil {
@@ -846,6 +863,42 @@ func (r *SwiftProxyReconciler) SetupWithManager(ctx context.Context, mgr ctrl.Ma
846863 return nil
847864 }
848865
866+ // Application Credential secret watching function
867+ acSecretFn := func (_ context.Context , o client.Object ) []reconcile.Request {
868+ name := o .GetName ()
869+ ns := o .GetNamespace ()
870+ result := []reconcile.Request {}
871+
872+ // Only handle Secret objects
873+ if _ , isSecret := o .(* corev1.Secret ); ! isSecret {
874+ return nil
875+ }
876+
877+ // Check if this is a swift AC secret by name pattern (ac-swift-secret)
878+ expectedSecretName := keystonev1 .GetACSecretName ("swift" )
879+ if name == expectedSecretName {
880+ // get all SwiftProxy CRs in this namespace
881+ swiftProxies := & swiftv1beta1.SwiftProxyList {}
882+ listOpts := []client.ListOption {
883+ client .InNamespace (ns ),
884+ }
885+ if err := r .List (context .Background (), swiftProxies , listOpts ... ); err != nil {
886+ return nil
887+ }
888+
889+ // Enqueue reconcile for all swift proxy instances
890+ for _ , cr := range swiftProxies .Items {
891+ objKey := client.ObjectKey {
892+ Namespace : ns ,
893+ Name : cr .Name ,
894+ }
895+ result = append (result , reconcile.Request {NamespacedName : objKey })
896+ }
897+ }
898+
899+ return result
900+ }
901+
849902 return ctrl .NewControllerManagedBy (mgr ).
850903 For (& swiftv1beta1.SwiftProxy {}).
851904 Owns (& corev1.Secret {}).
@@ -859,6 +912,8 @@ func (r *SwiftProxyReconciler) SetupWithManager(ctx context.Context, mgr ctrl.Ma
859912 handler .EnqueueRequestsFromMapFunc (r .findObjectsForSrc ),
860913 builder .WithPredicates (predicate.ResourceVersionChangedPredicate {}),
861914 ).
915+ Watches (& corev1.Secret {},
916+ handler .EnqueueRequestsFromMapFunc (acSecretFn )).
862917 Watches (& memcachedv1.Memcached {},
863918 handler .EnqueueRequestsFromMapFunc (memcachedFn )).
864919 Watches (& topologyv1.Topology {},
0 commit comments