[1952] fix: vpwned proxy writes Conditions; checkStatusSuccess prefers them

Devin found a real regression in the previous OR-based fallback at
checkStatusSuccess: when the vpwned proxy's RevalidateCredentials
endpoint writes OpenStackValidationStatus="Failed" (e.g. after a
password rotation), Conditions still carry stale CredentialsValidated=True
from the controller's last reconcile. The OR check (ready if either
is True) returned True from stale Conditions and allowed migrations
against known-bad credentials.

Two-part fix:

1. vpwned proxy now writes Conditions alongside the flat fields.
   updateOpenstackValidationStatus mirrors validationStatus into
   utils.ConditionCredentialsValidated with an appropriate Reason:
   - Succeeded -> True, AuthSucceeded
   - Failed    -> False, CredentialInvalidOrRevoked
   - Revalidating -> Unknown, ValidationStatusRevalidating
   Conditions and flat fields stay in sync regardless of which
   writer touched the resource last.

2. checkStatusSuccess updated semantics: Conditions are authoritative
   when present (now true for both controller and vpwned writes).
   Falls back to the legacy flat field only when the Conditions slice
   is entirely empty — that case still exists for pre-upgrade
   resources not yet re-reconciled.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: gtherond

graphify-out/cache/ast/815e5b6373ace2a937287b033e1f82d306e5eb009378f15d83d1b4d0a5ef809f.json

@@ -1864,15 +1864,18 @@ func (r *MigrationPlanReconciler) checkStatusSuccess(ctx context.Context,
 		if !ok {
 			return false, errors.Wrap(err, "failed to convert credentials to OpenstackCreds")
 		}
-		// Prefer the Kubernetes Condition (CredentialsValidated=True). Fall
-		// back to the legacy flat OpenStackValidationStatus field for
-		// resources that haven't been re-reconciled by the upgraded
-		// OpenstackCreds controller yet — those resources still carry the
-		// old flat status but no Conditions slice, and we shouldn't block
-		// MigrationPlan reconciliation on the upgrade window.
-		conditionReady := meta.IsStatusConditionTrue(openstackCreds.Status.Conditions, utils.ConditionCredentialsValidated)
-		legacyReady := openstackCreds.Status.OpenStackValidationStatus == string(corev1.PodSucceeded)
-		if !conditionReady && !legacyReady {
+		// Conditions are authoritative when present (the controller and the
+		// vpwned proxy both write them alongside the flat status field).
+		// Fall back to the legacy flat field only when the Conditions slice
+		// is entirely empty — that case exists for pre-upgrade resources
+		// not yet re-reconciled by the upgraded OpenstackCreds controller.
+		var ready bool
+		if len(openstackCreds.Status.Conditions) > 0 {
+			ready = meta.IsStatusConditionTrue(openstackCreds.Status.Conditions, utils.ConditionCredentialsValidated)
+		} else {
+			ready = openstackCreds.Status.OpenStackValidationStatus == string(corev1.PodSucceeded)
+		}
+		if !ready {
 			return false, errors.Errorf("openstackcreds '%s' CR is not validated", openstackCreds.Name)
 		}
 	}

graphify-out/cache/ast/ddb53e61dd66d7d56e521f01df4a6723e62066e37cf308c7c837dfeb184b8aaf.json

@@ -437,6 +437,27 @@ func (p *vjailbreakProxy) updateOpenstackValidationStatus(ctx context.Context, n
 		}
 		creds.Status.OpenStackValidationStatus = validationStatus
 		creds.Status.OpenStackValidationMessage = validationMessage
+
+		// Mirror the flat status into the Conditions slice. Without this, a
+		// vpwned write of "Failed" (e.g. from RevalidateCredentials after a
+		// password rotation) would leave stale CredentialsValidated=True from
+		// the controller's last reconcile, and downstream checks that prefer
+		// Conditions would allow migrations against known-bad credentials.
+		switch validationStatus {
+		case string(corev1.PodSucceeded):
+			migrationutils.SetCondition(&creds.Status.Conditions,
+				migrationutils.ConditionCredentialsValidated, metav1.ConditionTrue,
+				migrationutils.ReasonAuthSucceeded, validationMessage)
+		case constants.ValidationStatusFailed:
+			migrationutils.SetCondition(&creds.Status.Conditions,
+				migrationutils.ConditionCredentialsValidated, metav1.ConditionFalse,
+				migrationutils.ReasonCredentialInvalidOrRevoked, validationMessage)
+		case constants.ValidationStatusRevalidating:
+			migrationutils.SetCondition(&creds.Status.Conditions,
+				migrationutils.ConditionCredentialsValidated, metav1.ConditionUnknown,
+				constants.ValidationStatusRevalidating, validationMessage)
+		}
+
 		return p.K8sClient.Status().Update(ctx, creds)
 	})
 }