feat: sensitive secret configs

[yanksyoon]

Applicable spec:

Overview

• Use Juju secrets for sensitive configuration values

Rationale

• Juju secret is a secure way to manage sensitive values

Juju Events Changes

Module Changes

Library Changes

Checklist

• The charm style guide was applied
• The contributing guide was applied
• The changes are compliant with ISD054 - Managing Charm Complexity
• The documentation for charmhub is updated.
• The PR is tagged with appropriate label (urgent, trivial, senior-review-required, documentation)
• The docs/changelog.md is updated with user-relevant changes in the format of keep a changelog v1.1.0
• The application version is incremented in app/pyproject.toml

No app changes

[Copilot]

Pull request overview

This PR migrates sensitive OpenStack password configuration from plaintext charm config to Juju secrets, updating runtime parsing and test scaffolding accordingly.

Changes:

• Switch openstack-password config to type: secret and update documentation in charmcraft.yaml.
• Update OpenStack clouds config parsing to read the password from a Juju secret via model.get_secret(...).get_content().
• Update unit/integration test fixtures to create and grant the OpenStack password secret.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/state.py	Fetch OpenStack password from a Juju secret and raise config errors on secret lookup/content failures.
charmcraft.yaml	Change openstack-password config option to type: secret and document required secret content format.
docs/changelog.md	Add changelog entry noting Juju secrets usage for sensitive config.
tests/unit/conftest.py	Update harness fixture to create/grant a user secret and set config to the secret id.
tests/unit/factories.py	Update mock charm config to use a secret id and mock model.get_secret() content.
tests/unit/test_state.py	Add unit tests for secret lookup/access errors and missing secret content key.
tests/integration/conftest.py	Add integration fixtures for OpenStack password secret, pass secret id via config, and grant secret to the app.

Comments suppressed due to low confidence (1)

tests/integration/conftest.py:436

• The declared return type says the third element is a set, but charmhub_info[...].keys() returns a dict_keys view. Either convert it (e.g., set(...)) or adjust the return annotation to match what’s actually returned, otherwise mypy/type-checking can fail.

async def _prepare_charmhub_app_config(ops_test, app_config: dict) -> tuple[str, dict, set]:
    """Prepare the application config for charmhub deployment.

    Args:
        ops_test: The pytest operator test instance.
        app_config: The base application configuration.

    Returns:
        A tuple of (channel, prepared_config, config_options).

    """
    charmhub_channel = "edge"
    ret_code, stdout, stderr = await ops_test.juju(
        "info", "--format", "json", "--channel", charmhub_channel, "github-runner-image-builder"
    )
    assert ret_code == 0, f"Failed to get charm info: {stderr}"
    charmhub_info = json.loads(stdout.strip())
    charmhub_config_options = charmhub_info["charm"]["config"]["Options"].keys()

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

This PR introduces support for providing the OpenStack password via Juju secrets, reducing the need to store sensitive credentials in plain-text charm config while keeping legacy configuration supported for backward compatibility.

Changes:

• Add a new openstack-password-secret charm config option (type secret) and document deprecation of openstack-password.
• Update OpenStack clouds config parsing to prefer fetching the password from a Juju secret when configured.
• Update unit and integration tests/factories to exercise secret-based and legacy password paths.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
src/state.py	Adds new config constant and updates _parse_openstack_clouds_config to fetch password from a Juju secret when provided.
charmcraft.yaml	Adds openstack-password-secret config option and marks openstack-password as deprecated in its description.
tests/unit/factories.py	Updates mock charm factory defaults to use the secret-based password path and mocks model.get_secret().
tests/unit/test_state.py	Adds unit coverage for secret-fetch error cases, missing password key in secret, legacy password fallback, and missing-password scenarios.
tests/integration/conftest.py	Adds integration secret creation/granting for OpenStack password and wires secret-based config into app deployment fixtures.
docs/changelog.md	Adds changelog entry describing the new secret-based password configuration and deprecation of the legacy option.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[yanksyoon]

Initial review