-
Story
-
Resolution: Unresolved
-
Major
-
None
-
None
-
None
-
False
-
-
False
-
Not Selected
-
rhos-ops-day1day2-hardprov
-
-
-
-
Important
Implement Zero Downtime Password Rotation (ZDPR) support for IronicInspector using Keystone Application Credentials
Description:
Implement Application Credential authentication support for the IronicInspector service to enable Zero Downtime Password Rotation (ZDPR).
Acceptance Criteria:
- IronicInspector controller watches the AppCred Secret (ac-ironic-secret)
- Configuration templates render auth_type=v3applicationcredential with AC_ID and AC_SECRET when AppCred Secret is available
- All auth sections in IronicInspector config support AppCred:
- [keystone_authtoken]
- [service_catalog]
- [ironic]
- [swift]
- IronicInspector deployment triggers a rolling update when the AppCred Secret changes
- Falls back cleanly to password authentication (auth_type=password) when AppCred Secret is missing or incomplete
- All configuration changes are backwards compatible with password-based auth
- Redeployment with new credentials during the grace period works without service disruption
Technical Context:
- Controller: controllers/ironicinspector_controller.go
- Config template: templates/ironicinspector/config/01-inspector.conf
- Current auth method: password-based in multiple config sections