Support application credentials

[mdbooth]

/kind feature

CAPO doesn't currently support application credentials. From memory the issue relates to parsing project id from the cloud credentials. It's easily solved, as this can be obtained from the authentication response from keystone and is already exposed by Gophercloud.

Consider for inclusion in 0.6: #1145

[mdbooth]

/good-first-issue

[apricote]

We currently use Application Credentials with CAPO, one can just specify the project_id together with the application credentials and CAPO figures out the right thing to do, but the clouds.yaml can not be used by the OpenStack CLI like this.

I would like to clean this up 👍

/assign

[mdbooth]

I think the key is going to be https://pkg.go.dev/github.com/gophercloud/gophercloud#ProviderClient.GetAuthResult

However, I think it gets a bit messy here because the returned interface is insufficient so we may have to switch on the underlying type. Specifically I think we want to cast it to https://pkg.go.dev/github.com/gophercloud/gophercloud@v0.24.0/openstack/identity/v3/tokens#CreateResult, and call ExtractProject().

/cc @pierreprinetti @EmilienM

[apricote]

We discussed this in Slack and decided on refactoring provider.NewClient to explicitly return the ProjectID and pass it around to the clients that need it.

https://app.slack.com/client/T09NY5SBT/CFKJB65G9/thread/CFKJB65G9-1645786779.195309

[MPV]

I can also confirm that it's usable today, having a secret with a clouds.yaml that looks for example like this:

clouds:
  name-of-cloud-here:
    identity_api_version: 3
    auth:
      auth_url: ${auth_url}
      application_credential_id: ${credential_id}
      application_credential_secret: ${credential_secret}
      project_id: ${project_id}
    auth_type: "v3applicationcredential"

[mdbooth]

IIRC the problem with this is that OSC doesn't think it's valid. From memory I think it complains about trying to add scope to a scoped login? So yeah, but it's a major landmine not to be able to use the same clouds.yaml locally as in your cluster.