Add transport URL secret rotation with consumer finalizer

[lmiccini]

What this does

When infra-operator rotates a RabbitMQ transport URL (creating a new secret and user), consumer operators must hold a consumer finalizer on the old secret until all their pods have rolled out with the new credentials. Without this, infra-operator cleans up the old RabbitMQ user while pods are still connected with the old credentials, causing message-bus outages.

Approach (updated)

Note: this PR was reworked from the original grace-period design to an event-driven "applied input hash" design. The old approach released the finalizer after a fixed grace period based on the parent Ready condition, which was racy against the informer cache and could revoke credentials prematurely. The new approach releases the finalizer only once every child has provably rolled out.

1. Add a consumer finalizer to the current transport URL secret early in reconcile. Status.TransportURLSecret is set for first-time setup only (empty or unchanged); during rotation the status is updated solely by FinalizeSecretRotation at the end of reconcile.

2. Pass transportURL.Status.SecretName directly to sub-CR creation and config generation as a parameter — never read Status.TransportURLSecret for sub-CR specs.

3. Each child controller records an AppliedInputSecretHash in its status, set only after statefulset.IsReadyForInput / deployment.IsReadyForInput confirms — via an uncached API read — that the workload is fully rolled out with the expected CONFIG_HASH.

4. The parent mirrors a child's Ready condition only when its Generation == ObservedGeneration and AppliedInputSecretHash matches the current input hash; otherwise it sets the condition to Unknown.

5. Guard: FinalizeSecretRotation removes the consumer finalizer from the old secret only when every child reports the expected hash and is ready. The guard is computed from Conditions.AllSubConditionIsTrue() (not IsReady()), because Conditions.Init() resets the Ready condition to Unknown on every reconcile.

The same pattern applies to notification transport URL secrets and application-credential secrets where applicable.

Dependency

Depends on the lib-common IsReadyForInput / FinalizeSecretRotation helpers (currently pinned via a replace to the fork commit while the lib-common PR is in review).

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: lmiccini
Once this PR has been reviewed and has the lgtm label, please assign silvacarloss for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[centosinfra-prod-github-app]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/c61e6b3a068a499b876ec062cd7eec09

❌ openstack-k8s-operators-content-provider FAILURE in 8m 11s
⚠️ manila-operator-kuttl SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider
⚠️ manila-operator-tempest SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider

[centosinfra-prod-github-app]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/53a4661fb55e4b0b937ac296ebb24cb2

❌ openstack-k8s-operators-content-provider FAILURE in 12m 19s
⚠️ manila-operator-kuttl SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider
⚠️ manila-operator-tempest SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Advanced

Run ID: 4fb6ab8e-076c-4bc9-b28a-51dc3110ce16

---

_{Comment @coderabbitai help to get the list of available commands.}

[centosinfra-prod-github-app]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/396683d70bef4083b71592ba6e1c6401

✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 27m 00s
❌ manila-operator-kuttl NODE_FAILURE Node(set) request 099-0000176057 failed in 0s
❌ manila-operator-tempest FAILURE in 1h 55m 22s

[centosinfra-prod-github-app]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/34f7a90bb7104ee4b19dc55c75577a80

❌ openstack-k8s-operators-content-provider FAILURE in 6m 55s
⚠️ manila-operator-kuttl SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider
⚠️ manila-operator-tempest SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider

[centosinfra-prod-github-app]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/0a915b29c4fc429a8140a6c9a8577e48

✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 04m 13s
✔️ manila-operator-kuttl SUCCESS in 47m 21s
❌ manila-operator-tempest FAILURE in 1h 42m 58s

[centosinfra-prod-github-app]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/9378970daecc42ca91937f21de3a7e26

✔️ openstack-k8s-operators-content-provider SUCCESS in 3h 19m 30s
❌ manila-operator-kuttl POST_FAILURE in 23m 22s
❌ manila-operator-tempest FAILURE in 1h 42m 10s

[centosinfra-prod-github-app]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/7b8e2ac482834c398e925f71c9c084fc

❌ openstack-k8s-operators-content-provider RETRY_LIMIT in 1m 57s
⚠️ manila-operator-kuttl SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider
⚠️ manila-operator-tempest SKIPPED Skipped due to failed job openstack-k8s-operators-content-provider

[centosinfra-prod-github-app]

Build succeeded (check pipeline).
https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/baac763692dc41a18e555283f14f6c73

✔️ openstack-k8s-operators-content-provider SUCCESS in 1h 53m 31s
✔️ manila-operator-kuttl SUCCESS in 39m 36s
✔️ manila-operator-tempest SUCCESS in 1h 33m 07s

[centosinfra-prod-github-app]

Build succeeded (check pipeline).
https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/2cd40a07e6ea498c9a9d764447c32941

✔️ openstack-k8s-operators-content-provider SUCCESS in 1h 59m 56s
✔️ manila-operator-kuttl SUCCESS in 40m 16s
✔️ manila-operator-tempest SUCCESS in 1h 33m 47s