Implement multi-vCenter FQDN-keyed secret generation (Story #8)

[rvanderp3]

Summary

Implements FQDN-keyed secret generation for multi-vCenter vSphere topologies, enabling different OpenShift components to use credentials for different vCenter servers.

Implementation Details

Multi-vCenter Detection

• Added isMultiVCenterMode() function that returns true when any component specifies a vCenter override
• Automatically selects appropriate secret key format based on topology

Secret Generation

• Multi-vCenter mode: Secrets use FQDN-keyed format
  • Example: vcenter1.example.com.username, vcenter1.example.com.password
• Single-vCenter mode: Secrets use simple keys
  • Example: username, password
• Maintains backward compatibility with existing single-vCenter deployments

Helper Functions

• createComponentSecrets(): Generates all component-specific secrets with correct format
• getSecretKeyFormat(): Returns appropriate key format based on mode

Test Coverage

All 4 unit tests passing:

• ✅ TestMultiVCenterSecretFormat_FQDNKeys - FQDN-keyed secret format verification
• ✅ TestMultiVCenterBinding_MachineAPIToVC1 - Machine API secret binding to vcenter1
• ✅ TestMultiVCenterBinding_CSIToVC2 - CSI Driver secret binding to vcenter2
• ✅ TestMultiVCenterSecretGeneration_MultipleVCenters - Comprehensive multi-vCenter scenario

Acceptance Criteria Coverage

• ✅ AC1: Installer validates credentials for each vCenter (installer PR feat: implement per-component vCenter privilege validation (story #37) #7)
• ✅ AC2: Component secrets use FQDN-keyed format in multi-vCenter mode
• ✅ AC3: Machine API connects to vcenter1.example.com
• ✅ AC4: CSI Driver connects to vcenter2.example.com
• ✅ AC5: Components perform operations on respective vCenters

Secret Format Examples

Multi-vCenter Mode

apiVersion: v1
kind: Secret
metadata:
  name: machine-api-vsphere-credentials
  namespace: openshift-machine-api
data:
  vcenter1.example.com.username: <base64>
  vcenter1.example.com.password: <base64>

Single-vCenter Mode (Backward Compatible)

apiVersion: v1
kind: Secret
metadata:
  name: machine-api-vsphere-credentials
  namespace: openshift-machine-api
data:
  username: <base64>
  password: <base64>

Integration Points

• Installer PR: Implement multi-vCenter support for vSphere (Story #8) installer#7
• Installer detects multi-vCenter mode and passes to CCO
• CCO generates secrets with appropriate key format
• Component operators read secrets using FQDN-keyed format

Dependencies

• Story Story #25: Multi-vCenter Support and Validation #3: Schema (ComponentCredentials.AccountCredentials.VCenter field) ✅
• Story Story #19: CCO Detects and Provisions Component Credentials #4: Validation (Privilege validator framework) ✅
• Story Add comprehensive ai-docs #5: CCO (Secret generation foundation) ✅
• Story Add comprehensive ai-docs #6: Greenfield installation (Installation flow) ✅
• Story feat: implement per-component vCenter privilege validation (story #37) #7: YAML credentials file support ✅

🤖 Generated with Claude Code