)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":36412,"name":"Scott Davidson","email":"sdavidson327@gmail.com","username":"sd109"},"change_message_id":"62b7efd2ff5b24eb5023a401fc6fe6b2de38e830","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"e7efc316_01d09257","updated":"2025-07-21 15:44:00.000000000","message":"I like the proposal in general, would be great to have this functionality natively available in Magnum.","commit_id":"cf6f2444bcf7bdbce0d4e6aa1615903095906dc9"},{"author":{"_account_id":14394,"name":"Dale Smith","email":"dale@catalystcloud.nz","username":"dalees"},"change_message_id":"bfc281380fe70f2be29b883a6b4c0667eae48451","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"2fc32f52_243b3bb1","updated":"2025-08-06 00:14:58.000000000","message":"I worked with Matt to discuss and propose part of this spec, so I want to make sure others get a chance to comment and +2.\n\nI\u0027m in support of this merging and being implemented in Flamingo.","commit_id":"5f49ec40b3bcaf0128dcae0b4b8b5cd3051c9ce8"}],"specs/flamingo/credential-refresh.rst":[{"author":{"_account_id":36412,"name":"Scott Davidson","email":"sdavidson327@gmail.com","username":"sd109"},"change_message_id":"62b7efd2ff5b24eb5023a401fc6fe6b2de38e830","unresolved":true,"context_lines":[{"line_number":81,"context_line":"-----------"},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"The magnum-capi-helm driver is used here as an example implementation and will"},{"line_number":84,"context_line":"be the the initial driver to support this feature. It will follow this process"},{"line_number":85,"context_line":"to refresh application credentials in a cluster:"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"1. Change the cluster status to `UPDATE_IN_PROGRESS`."}],"source_content_type":"text/x-rst","patch_set":2,"id":"e6dfce5f_8623e3fe","line":84,"updated":"2025-07-21 15:44:00.000000000","message":"Nit: double word\n```suggestion\nbe the initial driver to support this feature. It will follow this process\n```","commit_id":"cf6f2444bcf7bdbce0d4e6aa1615903095906dc9"},{"author":{"_account_id":36412,"name":"Scott Davidson","email":"sdavidson327@gmail.com","username":"sd109"},"change_message_id":"b586a0b08d53de33d7464fcc752ee28c23b13b80","unresolved":false,"context_lines":[{"line_number":81,"context_line":"-----------"},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"The magnum-capi-helm driver is used here as an example implementation and will"},{"line_number":84,"context_line":"be the the initial driver to support this feature. It will follow this process"},{"line_number":85,"context_line":"to refresh application credentials in a cluster:"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"1. Change the cluster status to `UPDATE_IN_PROGRESS`."}],"source_content_type":"text/x-rst","patch_set":2,"id":"840d3c53_0850fb3f","line":84,"in_reply_to":"e6dfce5f_8623e3fe","updated":"2025-07-25 09:44:22.000000000","message":"Done","commit_id":"cf6f2444bcf7bdbce0d4e6aa1615903095906dc9"},{"author":{"_account_id":36412,"name":"Scott Davidson","email":"sdavidson327@gmail.com","username":"sd109"},"change_message_id":"62b7efd2ff5b24eb5023a401fc6fe6b2de38e830","unresolved":true,"context_lines":[{"line_number":89,"context_line":"   in-use."},{"line_number":90,"context_line":"3. Request a new application credential from the Keystone client, using a name"},{"line_number":91,"context_line":"   template."},{"line_number":92,"context_line":"4. Update the existing `Secret` with the new application credential."},{"line_number":93,"context_line":"5. Delete the old application credential."},{"line_number":94,"context_line":"6. Change the cluster status to `UPDATE_COMPLETE` on success, or"},{"line_number":95,"context_line":"   `UPDATE_FAILED` on failure."}],"source_content_type":"text/x-rst","patch_set":2,"id":"f175de4e_30d3a8a6","line":92,"updated":"2025-07-21 15:44:00.000000000","message":"Assuming that the secret referred to here is the one on the management cluster, it\u0027s worth noting that to fully rotate the app cred secret you also need to refresh the copy which exists in the `openstack-system` namespace on the user\u0027s cluster too.\n\nWhen using the standard capi-helm-charts stack including the cluster-api-addon-provider, functionality already exists to watch the management cluster secret and update the corresponding workload cluster secret [1]; however, updating the corresponding secret on the user cluster is not sufficient for workloads which use that secret to pick up the change. For example, the Cinder CSI deployment may need to be restarted in order for the pod(s) to start using the new secret. If the old application credential is deleted without this restart then the Cinder CSI (and other OpenStack Cloud Controller Manager integrations) will stop working and the user may have trouble tracking down the root cause.\n\nFor the Cinder CSI specifically, it should be possible to fix this limitation at the capi-helm-charts level with something like Reloader [2] and appropriate Helm values [3] but I\u0027m not sure if there\u0027s a good general solution for handling workloads on the user\u0027s cluster which depend on the rotated app cred secret.\n\n[1] https://github.com/azimuth-cloud/cluster-api-addon-provider/pull/49\n[2] https://github.com/stakater/Reloader\n[3] https://github.com/kubernetes/cloud-provider-openstack/blob/31fbaa4f17b145b3461fb94a12153ebbbe9ae992/charts/cinder-csi-plugin/values.yaml#L235","commit_id":"cf6f2444bcf7bdbce0d4e6aa1615903095906dc9"},{"author":{"_account_id":36412,"name":"Scott Davidson","email":"sdavidson327@gmail.com","username":"sd109"},"change_message_id":"b586a0b08d53de33d7464fcc752ee28c23b13b80","unresolved":false,"context_lines":[{"line_number":89,"context_line":"   in-use."},{"line_number":90,"context_line":"3. Request a new application credential from the Keystone client, using a name"},{"line_number":91,"context_line":"   template."},{"line_number":92,"context_line":"4. Update the existing `Secret` with the new application credential."},{"line_number":93,"context_line":"5. Delete the old application credential."},{"line_number":94,"context_line":"6. Change the cluster status to `UPDATE_COMPLETE` on success, or"},{"line_number":95,"context_line":"   `UPDATE_FAILED` on failure."}],"source_content_type":"text/x-rst","patch_set":2,"id":"f395e7f9_6635a24e","line":92,"in_reply_to":"4812db1e_1dfd39e1","updated":"2025-07-25 09:44:22.000000000","message":"Agreed that Reloader would be a nice addition to CAPI Helm charts regardless. I probably won\u0027t get round to that any time soon but happy to review a contribution from you or Matthew if either of you would like to have it available soon.","commit_id":"cf6f2444bcf7bdbce0d4e6aa1615903095906dc9"},{"author":{"_account_id":14394,"name":"Dale Smith","email":"dale@catalystcloud.nz","username":"dalees"},"change_message_id":"c2b859e1a9bf4606d4d9d2ae7f30a8609bf96d98","unresolved":true,"context_lines":[{"line_number":89,"context_line":"   in-use."},{"line_number":90,"context_line":"3. Request a new application credential from the Keystone client, using a name"},{"line_number":91,"context_line":"   template."},{"line_number":92,"context_line":"4. Update the existing `Secret` with the new application credential."},{"line_number":93,"context_line":"5. Delete the old application credential."},{"line_number":94,"context_line":"6. Change the cluster status to `UPDATE_COMPLETE` on success, or"},{"line_number":95,"context_line":"   `UPDATE_FAILED` on failure."}],"source_content_type":"text/x-rst","patch_set":2,"id":"4812db1e_1dfd39e1","line":92,"in_reply_to":"f175de4e_30d3a8a6","updated":"2025-07-21 23:08:39.000000000","message":"Thanks for the detail and links Scott! We\u0027ve done this a couple of times by hand and I have seen the cluster-api-addon-provider performing the release to update the workload secret once the management cluster secret is updated - it works well.\n\nAgree that there is a missing part to restart both the OCCM and Cinder CSI, and I\u0027m also thinking Reloader is the way forward for that. Perhaps we can add it to the CAPI Helm charts even before this proposal is implemented, so the missing piece of updating the management cluster secret \"just works\" :) (and in the meantime the manual operator action becomes a lot simpler).","commit_id":"cf6f2444bcf7bdbce0d4e6aa1615903095906dc9"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"fb170c8f579ad14010402745d1ac9b491d661813","unresolved":true,"context_lines":[{"line_number":24,"context_line":"Proposed change"},{"line_number":25,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"The proposed change introduces the following procedure to refresh credentials,"},{"line_number":28,"context_line":"the nature of which is dictated by the underlying driver."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"1. Cluster operator invokes credential refresh via the Magnum client:"}],"source_content_type":"text/x-rst","patch_set":4,"id":"8ccb73ad_6b5c6101","line":27,"range":{"start_line":27,"start_character":58,"end_line":27,"end_character":65},"updated":"2025-08-18 05:39:55.000000000","message":"Essentially it\u0027s rotate, not refresh - I don\u0027t mind the name - just thinking about end users","commit_id":"5f49ec40b3bcaf0128dcae0b4b8b5cd3051c9ce8"},{"author":{"_account_id":38227,"name":"Matthew Northcott","display_name":"Matthew Northcott","email":"matthewnorthcott@catalystcloud.nz","username":"northcottmt"},"change_message_id":"f938c895075050a87779c41dea37d5204ada509e","unresolved":false,"context_lines":[{"line_number":24,"context_line":"Proposed change"},{"line_number":25,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"The proposed change introduces the following procedure to refresh credentials,"},{"line_number":28,"context_line":"the nature of which is dictated by the underlying driver."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"1. Cluster operator invokes credential refresh via the Magnum client:"}],"source_content_type":"text/x-rst","patch_set":4,"id":"a6829ca1_4901ab1e","line":27,"range":{"start_line":27,"start_character":58,"end_line":27,"end_character":65},"in_reply_to":"8ccb73ad_6b5c6101","updated":"2025-08-19 23:55:51.000000000","message":"Thanks Michal. This is certainly true for the magnum-capi-helm driver and likely others in future. The proposal has been updated to reflect this.","commit_id":"5f49ec40b3bcaf0128dcae0b4b8b5cd3051c9ce8"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"fb170c8f579ad14010402745d1ac9b491d661813","unresolved":true,"context_lines":[{"line_number":154,"context_line":"Milestones"},{"line_number":155,"context_line":"----------"},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"* Add credential API, refresh endpoint, and associated policies to Magnum."},{"line_number":158,"context_line":"* Invoke driver from Magnum conductor."},{"line_number":159,"context_line":"* Update status, and refresh credentials in magnum-capi-helm driver."},{"line_number":160,"context_line":"* Add command to support credential refresh in Magnum client."}],"source_content_type":"text/x-rst","patch_set":4,"id":"7ba0751c_4e68365a","line":157,"range":{"start_line":157,"start_character":22,"end_line":157,"end_character":38},"updated":"2025-08-18 05:39:55.000000000","message":"if it\u0027s /v1/credential/\u003ccluster-uuid\u003e then it\u0027s not really a refresh endpoint ;-)","commit_id":"5f49ec40b3bcaf0128dcae0b4b8b5cd3051c9ce8"},{"author":{"_account_id":38227,"name":"Matthew Northcott","display_name":"Matthew Northcott","email":"matthewnorthcott@catalystcloud.nz","username":"northcottmt"},"change_message_id":"f938c895075050a87779c41dea37d5204ada509e","unresolved":false,"context_lines":[{"line_number":154,"context_line":"Milestones"},{"line_number":155,"context_line":"----------"},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"* Add credential API, refresh endpoint, and associated policies to Magnum."},{"line_number":158,"context_line":"* Invoke driver from Magnum conductor."},{"line_number":159,"context_line":"* Update status, and refresh credentials in magnum-capi-helm driver."},{"line_number":160,"context_line":"* Add command to support credential refresh in Magnum client."}],"source_content_type":"text/x-rst","patch_set":4,"id":"84c26792_ca25e923","line":157,"range":{"start_line":157,"start_character":22,"end_line":157,"end_character":38},"in_reply_to":"7ba0751c_4e68365a","updated":"2025-08-19 23:55:51.000000000","message":"Done","commit_id":"5f49ec40b3bcaf0128dcae0b4b8b5cd3051c9ce8"}]}