Sub-issue 2 — Application Credentials via clouds.yaml

Title: Support v3applicationcredential auth_type in clouds.yaml

Parent: #1951
Depends on: #1952

Labels (suggested): enhancement, area/credentials, area/security

Problem

After #1952 lands, OpenstackCreds parses clouds.yaml but in practice only with auth_type: v3password (username/password). Production and regulated deployments need OpenStack Application Credentials for:

• Revocation independent of the user account
• Role-subset scoping (grant only the roles vjailbreak needs, not full user impersonation)
• Optional expires_at for time-bounded one-shot migrations
• No user password stored at rest in Kubernetes Secrets

Proposal

Support auth_type: v3applicationcredential in clouds.yaml. The credential format is:

clouds:
  destination:
    auth_type: v3applicationcredential
    auth:
      auth_url: https://keystone.example.com:5000/v3
      application_credential_id: <id>
      application_credential_secret: <secret>
    region_name: RegionOne
    interface: public

github.com/gophercloud/utils/openstack/clientconfig (already imported in #1952) handles this auth_type natively; no new gophercloud auth code is required. The work is in surfacing Application-Credential-specific validation conditions on the OpenstackCreds resource and documenting the operator workflow.

Scope

• Verify clientconfig correctly constructs gophercloud.AuthOptions with ApplicationCredentialID / ApplicationCredentialSecret when auth_type: v3applicationcredential is set.
• Extend validation in k8s/migration/pkg/utils/credutils.go to:
  • Read expires_at via applicationcredentials.Get(...) after successful auth; populate Expiring and Expired Conditions per the contract from Accept clouds.yaml in OpenstackCreds Secret #1952.
  • Map Keystone error responses to specific Condition Reasons:
    • 401 → CredentialsValidated=False, Reason=CredentialInvalidOrRevoked
    • 403 from a downstream service → RolesSufficient=False, Reason=InsufficientRoles with role names extracted from the response body when available
    • Network failure → Reason=KeystoneUnreachable
    • TLS failure → Reason=TLSVerificationFailed
• Update OpenstackCredsController to populate Expiring / Expired / RolesSufficient Conditions per reconcile pass; rely on the periodic 1-hour requeue scheduled in Accept clouds.yaml in OpenstackCreds Secret #1952 for time-based transitions.
• Operator runbook section in docs/credentials.md covering:
  • Application Credential creation command (openstack application credential create ...)
  • Explicit enumeration of the minimum role set vjailbreak requires (member plus the vjailbreak-migrator role covering Cinder scheduler-stats and Nova hypervisor read)
  • Rotation workflow (create new App Cred, update Secret in place, watch picks up the change)
  • Revocation after migration

Acceptance criteria

• clouds.yaml with auth_type: v3applicationcredential authenticates successfully (no username/password required).
• App Cred whose expires_at is in the past → Expired=True. Within 7 days → Expiring=True, Reason=Within7Days. Within 30 days → Within30Days. Beyond 30 days → Expiring=False.
• Revoked App Cred → CredentialsValidated=False, Reason=CredentialInvalidOrRevoked on next reconcile.
• Insufficient roles → RolesSufficient=False, Reason=InsufficientRoles; missing role names listed in the condition message when Keystone provides them.
• Unit tests cover the auth-type parsing branch, expiration evaluation (past / within 7d / within 30d / beyond), and Keystone error mapping.
• Integration test runs a full validation flow against a real Keystone using an App Cred scoped to member + custom role.
• docs/credentials.md "Application Credentials (recommended)" section published, including the explicit role set enumeration.
• Negative test: revoke the App Cred mid-validation; confirm clean error message and condition transition.

Open questions for maintainers

• Surfacing the expiration-soon warning: log line, Kubernetes Event, or only the Condition. Recommend Condition + Event for operator visibility.
• Documentation placement: extend docs/credentials.md (created in Accept clouds.yaml in OpenstackCreds Secret #1952) versus a dedicated docs/application-credentials.md. Recommend the former for discoverability.
• Minimum Keystone version: confirm Queens (2018) as a documented prerequisite.

Branch name

1953-clouds-yaml-app-credentials (matches repo convention); branched off main after #1952 merges.