[1953] feat: populate Expiring/Expired Conditions for Application Credentials

Wires the App Credential helpers (#1953 prior commit) through the
validation flow and controller status path:

- pkg/common/validation/openstack: extends ValidationResult with an
  AppCred *utils.AppCredentialDetails field. validateFromCloudsYAML
  calls utils.FetchAppCredentialDetails after successful auth when
  auth_type is v3applicationcredential; populates result.AppCred when
  the metadata fetch succeeds, logs a non-fatal info message and
  leaves AppCred nil when the fetch is unavailable.

- internal/controller/openstackcreds_controller: setConditionsForValidResult
  now takes the AppCred details and uses utils.EvaluateAppCredExpiration
  to set Expiring / Expired Conditions. Mapping:
  - expired               -> Expired=True (Reason: Expired)
  - within 7 days         -> Expiring=True (Reason: Within7Days)
  - within 30 days        -> Expiring=True (Reason: Within30Days)
  - beyond / not App Cred -> Expiring=False, Expired=False (NotApplicable / Active)

- internal/controller/openstackcreds_controller: setConditionsForInvalidResult
  drops the inline heuristic switch and uses utils.MapKeystoneError on
  the raw validation error. Typed gophercloud HTTP status codes win
  over string matching when available.

Existing TestApplyValidationResult_ValidationFailure passes unchanged
(MapKeystoneError preserves the existing Reason output for 401 and
timeout error strings the test exercises).

Implements FR-007 / FR-008 / FR-009.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: gtherond

graphify-out/cache/ast/17a14629d1b606109bda909287117739ee4aafcecbb5bbf6a71de9785943a572.json

@@ -281,7 +281,7 @@ func (r *OpenstackCredsReconciler) applyValidationResult(ctx context.Context, sc
 		return nil
 	}
 
-	setConditionsForValidResult(&scope.OpenstackCreds.Status)
+	setConditionsForValidResult(&scope.OpenstackCreds.Status, result.AppCred)
 	ctxlog.Info("Updating status to success", "openstackcreds", scope.OpenstackCreds.Name)
 	if err := r.Status().Update(ctx, scope.OpenstackCreds); err != nil {
 		ctxlog.Error(err, "Error updating status of OpenstackCreds", "openstackcreds", scope.OpenstackCreds.Name)
@@ -525,18 +525,37 @@ func (r *OpenstackCredsReconciler) mapSecretToOpenstackCreds(ctx context.Context
 	return requests
 }
 
-// setConditionsForValidResult populates the OpenstackCreds Conditions for the
-// authenticated-and-validated case. Reasons specific to Application Credentials
-// (expiration, missing roles) are populated in the follow-up sub-issue #1953.
-//
-// Also writes the deprecated flat OpenStackValidationStatus/Message fields as a
-// derived view so the existing UI and pkg/vpwned proxy keep working through the
-// Conditions migration window.
-func setConditionsForValidResult(status *vjailbreakv1alpha1.OpenstackCredsStatus) {
+// authenticated-and-validated case. When an Application Credential is in use
+// and its metadata was fetched, Expiring / Expired are populated based on the
+// credential's expires_at; otherwise they remain NotApplicable. Also writes
+// the legacy flat OpenStackValidationStatus/Message fields as a derived view
+// so the existing UI and pkg/vpwned proxy keep working through the Conditions
+// migration window.
+func setConditionsForValidResult(status *vjailbreakv1alpha1.OpenstackCredsStatus, appCred *utils.AppCredentialDetails) {
 	utils.SetCondition(&status.Conditions, utils.ConditionCredentialsParsed, metav1.ConditionTrue, utils.ReasonParsed, "Credential data parsed successfully")
 	utils.SetCondition(&status.Conditions, utils.ConditionCredentialsValidated, metav1.ConditionTrue, utils.ReasonAuthSucceeded, "Authenticated to destination Keystone")
-	utils.SetCondition(&status.Conditions, utils.ConditionExpiring, metav1.ConditionFalse, utils.ReasonNotApplicable, "Credential is not an Application Credential")
-	utils.SetCondition(&status.Conditions, utils.ConditionExpired, metav1.ConditionFalse, utils.ReasonNotApplicable, "Credential is not an Application Credential")
+
+	if appCred == nil {
+		utils.SetCondition(&status.Conditions, utils.ConditionExpiring, metav1.ConditionFalse, utils.ReasonNotApplicable, "Credential is not an Application Credential or details unavailable")
+		utils.SetCondition(&status.Conditions, utils.ConditionExpired, metav1.ConditionFalse, utils.ReasonNotApplicable, "Credential is not an Application Credential or details unavailable")
+	} else {
+		within30, within7, expired := utils.EvaluateAppCredExpiration(appCred.ExpiresAt, time.Now())
+		switch {
+		case expired:
+			utils.SetCondition(&status.Conditions, utils.ConditionExpired, metav1.ConditionTrue, utils.ReasonExpired, fmt.Sprintf("Application Credential %s expired at %s", appCred.ID, appCred.ExpiresAt.Format(time.RFC3339)))
+			utils.SetCondition(&status.Conditions, utils.ConditionExpiring, metav1.ConditionFalse, utils.ReasonNotApplicable, "Credential already expired")
+		case within7:
+			utils.SetCondition(&status.Conditions, utils.ConditionExpiring, metav1.ConditionTrue, utils.ReasonWithin7Days, fmt.Sprintf("Application Credential %s expires at %s (within 7 days)", appCred.ID, appCred.ExpiresAt.Format(time.RFC3339)))
+			utils.SetCondition(&status.Conditions, utils.ConditionExpired, metav1.ConditionFalse, utils.ReasonActive, "Credential is active")
+		case within30:
+			utils.SetCondition(&status.Conditions, utils.ConditionExpiring, metav1.ConditionTrue, utils.ReasonWithin30Days, fmt.Sprintf("Application Credential %s expires at %s (within 30 days)", appCred.ID, appCred.ExpiresAt.Format(time.RFC3339)))
+			utils.SetCondition(&status.Conditions, utils.ConditionExpired, metav1.ConditionFalse, utils.ReasonActive, "Credential is active")
+		default:
+			utils.SetCondition(&status.Conditions, utils.ConditionExpiring, metav1.ConditionFalse, utils.ReasonNotApplicable, "Credential is not approaching expiration")
+			utils.SetCondition(&status.Conditions, utils.ConditionExpired, metav1.ConditionFalse, utils.ReasonActive, "Credential is active")
+		}
+	}
+
 	status.OpenStackValidationStatus = string(corev1.PodSucceeded)
 	status.OpenStackValidationMessage = "Successfully authenticated to Openstack"
 }
@@ -545,9 +564,9 @@ func setConditionsForValidResult(status *vjailbreakv1alpha1.OpenstackCredsStatus
 // validation-failure case. Distinguishes parse failures (CredentialsParsed=False
 // with a parse-specific Reason mapped from the sentinel error type returned by
 // utils.ParseCloudsYAML) from authentication failures (CredentialsParsed=True,
-// CredentialsValidated=False with an auth-specific Reason). Also writes the
-// deprecated flat OpenStackValidationStatus/Message fields as a derived view
-// for back-compat.
+// CredentialsValidated=False with a Reason from utils.MapKeystoneError). Also
+// writes the legacy flat OpenStackValidationStatus/Message fields as a derived
+// view for back-compat.
 func setConditionsForInvalidResult(status *vjailbreakv1alpha1.OpenstackCredsStatus, rawErr error, errMsg string) {
 	if parsedFalseReason := parseFailureReason(rawErr); parsedFalseReason != "" {
 		utils.SetCondition(&status.Conditions, utils.ConditionCredentialsParsed, metav1.ConditionFalse, parsedFalseReason, errMsg)
@@ -557,28 +576,16 @@ func setConditionsForInvalidResult(status *vjailbreakv1alpha1.OpenstackCredsStat
 		return
 	}
 
-	// Not a parse failure: parsing succeeded, authentication or environment
-	// check is what failed. Heuristic Reason mapping on the error message.
-	reason := utils.ReasonCredentialInvalidOrRevoked
-	switch {
-	case strings.Contains(errMsg, "401"), strings.Contains(errMsg, "invalid username"), strings.Contains(errMsg, "rejected or revoked"):
-		reason = utils.ReasonCredentialInvalidOrRevoked
-	case strings.Contains(errMsg, "404"), strings.Contains(errMsg, "Auth URL"):
-		reason = utils.ReasonKeystoneUnreachable
-	case strings.Contains(errMsg, "timeout"):
-		reason = utils.ReasonKeystoneUnreachable
-	case strings.Contains(errMsg, "x509"), strings.Contains(errMsg, "certificate"):
-		reason = utils.ReasonTLSVerificationFailed
-	}
+	reason := utils.MapKeystoneError(rawErr)
 	utils.SetCondition(&status.Conditions, utils.ConditionCredentialsParsed, metav1.ConditionTrue, utils.ReasonParsed, "Credential data parsed successfully")
 	utils.SetCondition(&status.Conditions, utils.ConditionCredentialsValidated, metav1.ConditionFalse, reason, errMsg)
 	status.OpenStackValidationStatus = constants.ValidationStatusFailed
 	status.OpenStackValidationMessage = errMsg
 }
 
-// parseFailureReason returns the appropriate ReasonInvalid* code when err
-// wraps one of the ParseCloudsYAML sentinel errors. Returns "" when err is not
-// a parse failure (caller treats as authentication-stage failure).
+// parseFailureReason returns the appropriate Reason code when err wraps one of
+// the ParseCloudsYAML sentinel errors. Returns "" when err is not a parse
+// failure (caller treats as authentication-stage failure).
 func parseFailureReason(err error) string {
 	if err == nil {
 		return ""

graphify-out/cache/ast/9279aca6d66f2bed83ce1f7c4a4122902f78ecfe27a75497022be38443669323.json

@@ -31,6 +31,12 @@ type ValidationResult struct {
 	Valid   bool
 	Message string
 	Error   error
+	// AppCred carries Application Credential metadata fetched after successful
+	// authentication when auth_type is v3applicationcredential and the
+	// credential's metadata could be retrieved. Nil for non-AppCred auth or
+	// when the metadata fetch was unavailable. Drives the Expiring / Expired
+	// Conditions on OpenstackCreds.status.
+	AppCred *utils.AppCredentialDetails
 }
 
 func authErrorMessage(err error, isTokenAuth bool) string {
@@ -254,11 +260,27 @@ func validateFromCloudsYAML(ctx context.Context, k8sClient client.Client, openst
 		}
 	}
 
-	return ValidationResult{
+	result := ValidationResult{
 		Valid:   true,
 		Message: "Successfully authenticated to Openstack",
 		Error:   nil,
 	}
+
+	// For v3applicationcredential auth, try to fetch the credential's metadata
+	// so the controller can populate the Expiring / Expired Conditions. A
+	// failure here is non-fatal: the credential itself authenticated, and
+	// the controller treats nil AppCred as "details unavailable".
+	if cfg.AuthType == "v3applicationcredential" && cfg.AuthOptions.ApplicationCredentialID != "" {
+		details, err := utils.FetchAppCredentialDetails(ctx, providerClient, cfg.AuthOptions.ApplicationCredentialID)
+		if err != nil {
+			ctrllog.FromContext(ctx).Info("could not fetch Application Credential details for status reporting",
+				"credentialID", cfg.AuthOptions.ApplicationCredentialID, "err", err.Error())
+		} else {
+			result.AppCred = details
+		}
+	}
+
+	return result
 }
 
 // getCredentialsFromSecret retrieves OpenStack credentials from a Kubernetes secret