fix auth model

cmd/control-api/main.go

@@ -113,19 +113,7 @@ func runOrchestratorLoop(ctx context.Context, orch *orchestrator.Orchestrator, c
 
 func newOpenStackClient(ctx context.Context, cfg *config.ControlAPI) (openstack.FloatingIPClient, error) {
 	if cfg.OpenStack.Mode == "real" {
-		clientCfg := openstack.ClientConfig{
-			AuthURL:     os.Getenv(cfg.OpenStack.AuthURLEnv),
-			Token:       os.Getenv(cfg.OpenStack.TokenEnv),
-			ProjectID:   os.Getenv(cfg.OpenStack.ProjectIDEnv),
-			ProjectName: os.Getenv(cfg.OpenStack.ProjectNameEnv),
-			DomainName:  os.Getenv(cfg.OpenStack.ProjectDomainEnv),
-			Region:      os.Getenv(cfg.OpenStack.RegionEnv),
-		}
-		if clientCfg.AuthURL == "" || clientCfg.Token == "" {
-			return nil, fmt.Errorf("openstack.mode=real requires %s and %s to be set in the environment",
-				cfg.OpenStack.AuthURLEnv, cfg.OpenStack.TokenEnv)
-		}
-		return openstack.NewClient(ctx, clientCfg)
+		return newRealOpenStackClient(ctx, cfg)
 	}
 
 	// Mock mode: pre-seed one synthetic floating-ip resource per
@@ -137,3 +125,39 @@ func newOpenStackClient(ctx context.Context, cfg *config.ControlAPI) (openstack.
 	}
 	return mock, nil
 }
+
+func newRealOpenStackClient(ctx context.Context, cfg *config.ControlAPI) (openstack.FloatingIPClient, error) {
+	clientCfg := openstack.ClientConfig{
+		AuthURL:   os.Getenv(cfg.OpenStack.AuthURLEnv),
+		ProjectID: os.Getenv(cfg.OpenStack.ProjectIDEnv),
+		Region:    os.Getenv(cfg.OpenStack.RegionEnv),
+		Interface: os.Getenv(cfg.OpenStack.InterfaceEnv),
+	}
+
+	switch cfg.OpenStack.AuthMethod {
+	case "password":
+		clientCfg.Method = openstack.AuthMethodPassword
+		clientCfg.Username = os.Getenv(cfg.OpenStack.UsernameEnv)
+		clientCfg.Password = os.Getenv(cfg.OpenStack.PasswordEnv)
+		clientCfg.UserDomainName = os.Getenv(cfg.OpenStack.UserDomainNameEnv)
+		if clientCfg.Username == "" || clientCfg.Password == "" {
+			return nil, fmt.Errorf("openstack.auth_method=password requires %s and %s to be set in the environment",
+				cfg.OpenStack.UsernameEnv, cfg.OpenStack.PasswordEnv)
+		}
+	case "token", "":
+		clientCfg.Method = openstack.AuthMethodToken
+		clientCfg.Token = os.Getenv(cfg.OpenStack.TokenEnv)
+		if clientCfg.Token == "" {
+			return nil, fmt.Errorf("openstack.auth_method=token requires %s to be set in the environment", cfg.OpenStack.TokenEnv)
+		}
+	default:
+		return nil, fmt.Errorf("openstack.auth_method: unknown value %q (expected \"token\" or \"password\")", cfg.OpenStack.AuthMethod)
+	}
+
+	if clientCfg.AuthURL == "" || clientCfg.ProjectID == "" {
+		return nil, fmt.Errorf("openstack.mode=real requires %s and %s to be set in the environment",
+			cfg.OpenStack.AuthURLEnv, cfg.OpenStack.ProjectIDEnv)
+	}
+
+	return openstack.NewClient(ctx, clientCfg)
+}