openstack-k8s-operators · lmiccini · Aug 17, 2026
diff --git a/api/bases/cinder.openstack.org_cinderapis.yaml b/api/bases/cinder.openstack.org_cinderapis.yaml
@@ -1288,6 +1288,11 @@ spec:
                   type: object
                 description: API endpoints
                 type: object
+              appliedInputSecretHash:
+                description: |-
+                  AppliedInputSecretHash is the hash of the input Secret consumed by the
+                  currently ready workload.
+                type: string
               conditions:
                 description: Conditions
                 items:

diff --git a/api/bases/cinder.openstack.org_cinderbackups.yaml b/api/bases/cinder.openstack.org_cinderbackups.yaml
@@ -1100,6 +1100,11 @@ spec:
           status:
             description: CinderBackupStatus defines the observed state of CinderBackup
             properties:
+              appliedInputSecretHash:
+                description: |-
+                  AppliedInputSecretHash is the hash of the input Secret consumed by the
+                  currently ready workload.
+                type: string
               conditions:
                 description: Conditions
                 items:

diff --git a/api/bases/cinder.openstack.org_cinderschedulers.yaml b/api/bases/cinder.openstack.org_cinderschedulers.yaml
@@ -1100,6 +1100,11 @@ spec:
           status:
             description: CinderSchedulerStatus defines the observed state of CinderScheduler
             properties:
+              appliedInputSecretHash:
+                description: |-
+                  AppliedInputSecretHash is the hash of the input Secret consumed by the
+                  currently ready workload.
+                type: string
               conditions:
                 description: Conditions
                 items:

diff --git a/api/bases/cinder.openstack.org_cindervolumes.yaml b/api/bases/cinder.openstack.org_cindervolumes.yaml
@@ -1101,6 +1101,11 @@ spec:
           status:
             description: CinderVolumeStatus defines the observed state of CinderVolume
             properties:
+              appliedInputSecretHash:
+                description: |-
+                  AppliedInputSecretHash is the hash of the input Secret consumed by the
+                  currently ready workload.
+                type: string
               conditions:
                 description: Conditions
                 items:

diff --git a/api/go.mod b/api/go.mod
@@ -3,9 +3,9 @@ module github.com/openstack-k8s-operators/cinder-operator/api
 go 1.26.3
 
 require (
-	github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260811190835-054aa14112d8
-	github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260813160234-fdcb3ee3699d
-	github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260813160234-fdcb3ee3699d
+	github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260815111556-ad0006892c31
+	github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260824142420-113dc64ecfd4
+	github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260824142420-113dc64ecfd4
 	golang.org/x/exp v0.0.0-20260611194520-c48552f49976
 	k8s.io/api v0.33.13
 	k8s.io/apimachinery v0.33.13
@@ -35,7 +35,6 @@ require (
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/onsi/ginkgo/v2 v2.32.1 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/prometheus/client_golang v1.22.0 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect

diff --git a/api/go.sum b/api/go.sum
@@ -76,12 +76,12 @@ github.com/onsi/ginkgo/v2 v2.32.1 h1:6tlvcDm/3sE8lGJbZ4+d4mO3RLy24/tQWOFzVSQNIfw
 github.com/onsi/ginkgo/v2 v2.32.1/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=
 github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
 github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
-github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260811190835-054aa14112d8 h1:V+M1QXCXaYlrgMl863bjZWpCA0grSuePt2QjZ5QX6G0=
-github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260811190835-054aa14112d8/go.mod h1:nPqCNb6LtP2HIkAoOrM4Jr4BMdNnuY0puKx6v6fwOhI=
-github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260813160234-fdcb3ee3699d h1:+DIuFNo6jIF0/9bHYz3C6OnnMQIe3C5bbFv2bAJLLo8=
-github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260813160234-fdcb3ee3699d/go.mod h1:LY+Q6ms3A6E8DAKCpmvQaUxO5O2CKYm0XMcmTZ6PCcM=
-github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260813160234-fdcb3ee3699d h1:/FKQGhZ7sE0yXfK1hjmLGhDU18t5Ew3Ex3iUh8ZR81Y=
-github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260813160234-fdcb3ee3699d/go.mod h1:fJ9CCRKpo8mQODfv4UDJ3tjUTbyCznYslXQwCkDaGg0=
+github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260815111556-ad0006892c31 h1:DdvjIeuZcmcCj0Gaey10JSYXPUJpOVsFqk5x3aHtbrM=
+github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260815111556-ad0006892c31/go.mod h1:mrcugf1qcRO26DeSoMZFtxxZWW9a4nNk15MdBDFNP6Y=
+github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260824142420-113dc64ecfd4 h1:zDxe4n0GPQ+U8VFZyyCoQed+9Xauz4G22J/X6B4gq20=
+github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260824142420-113dc64ecfd4/go.mod h1:vDcTSyaI7R6tjtZOqonr0hzq8JMOfBhJCWZy0tVjQPw=
+github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260824142420-113dc64ecfd4 h1:atoyW+P7wLeLpKdfWG4vtBBErRVg23+0l3ZAM+cHibo=
+github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260824142420-113dc64ecfd4/go.mod h1:fJ9CCRKpo8mQODfv4UDJ3tjUTbyCznYslXQwCkDaGg0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=

diff --git a/api/v1beta1/cinderapi_types.go b/api/v1beta1/cinderapi_types.go
@@ -141,6 +141,10 @@ type CinderAPIStatus struct {
 
 	// LastAppliedTopology - the last applied Topology
 	LastAppliedTopology *topologyv1.TopoRef `json:"lastAppliedTopology,omitempty"`
+
+	// AppliedInputSecretHash is the hash of the input Secret consumed by the
+	// currently ready workload.
+	AppliedInputSecretHash string `json:"appliedInputSecretHash,omitempty"`
 }
 
 //+kubebuilder:object:root=true

diff --git a/api/v1beta1/cinderbackup_types.go b/api/v1beta1/cinderbackup_types.go
@@ -117,6 +117,10 @@ type CinderBackupStatus struct {
 
 	// LastAppliedTopology - the last applied Topology
 	LastAppliedTopology *topologyv1.TopoRef `json:"lastAppliedTopology,omitempty"`
+
+	// AppliedInputSecretHash is the hash of the input Secret consumed by the
+	// currently ready workload.
+	AppliedInputSecretHash string `json:"appliedInputSecretHash,omitempty"`
 }
 
 //+kubebuilder:object:root=true

diff --git a/api/v1beta1/cinderscheduler_types.go b/api/v1beta1/cinderscheduler_types.go
@@ -117,6 +117,10 @@ type CinderSchedulerStatus struct {
 
 	// LastAppliedTopology - the last applied Topology
 	LastAppliedTopology *topologyv1.TopoRef `json:"lastAppliedTopology,omitempty"`
+
+	// AppliedInputSecretHash is the hash of the input Secret consumed by the
+	// currently ready workload.
+	AppliedInputSecretHash string `json:"appliedInputSecretHash,omitempty"`
 }
 
 //+kubebuilder:object:root=true

diff --git a/api/v1beta1/cindervolume_types.go b/api/v1beta1/cindervolume_types.go
@@ -124,6 +124,10 @@ type CinderVolumeStatus struct {
 
 	// LastAppliedTopology - the last applied Topology
 	LastAppliedTopology *topologyv1.TopoRef `json:"lastAppliedTopology,omitempty"`
+
+	// AppliedInputSecretHash is the hash of the input Secret consumed by the
+	// currently ready workload.
+	AppliedInputSecretHash string `json:"appliedInputSecretHash,omitempty"`
 }
 
 //+kubebuilder:object:root=true

diff --git a/cmd/main.go b/cmd/main.go
@@ -255,41 +255,46 @@ func main() {
 	}
 
 	if err := (&controller.CinderReconciler{
-		Client:  mgr.GetClient(),
-		Scheme:  mgr.GetScheme(),
-		Kclient: kclient,
+		Client:    mgr.GetClient(),
+		Scheme:    mgr.GetScheme(),
+		Kclient:   kclient,
+		APIReader: mgr.GetAPIReader(),
 	}).SetupWithManager(mgr); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "Cinder")
 		os.Exit(1)
 	}
 	if err := (&controller.CinderAPIReconciler{
-		Client:  mgr.GetClient(),
-		Scheme:  mgr.GetScheme(),
-		Kclient: kclient,
+		Client:    mgr.GetClient(),
+		Scheme:    mgr.GetScheme(),
+		Kclient:   kclient,
+		APIReader: mgr.GetAPIReader(),
 	}).SetupWithManager(context.Background(), mgr); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "CinderAPI")
 		os.Exit(1)
 	}
 	if err := (&controller.CinderBackupReconciler{
-		Client:  mgr.GetClient(),
-		Scheme:  mgr.GetScheme(),
-		Kclient: kclient,
+		Client:    mgr.GetClient(),
+		Scheme:    mgr.GetScheme(),
+		Kclient:   kclient,
+		APIReader: mgr.GetAPIReader(),
 	}).SetupWithManager(context.Background(), mgr); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "CinderBackup")
 		os.Exit(1)
 	}
 	if err := (&controller.CinderSchedulerReconciler{
-		Client:  mgr.GetClient(),
-		Scheme:  mgr.GetScheme(),
-		Kclient: kclient,
+		Client:    mgr.GetClient(),
+		Scheme:    mgr.GetScheme(),
+		Kclient:   kclient,
+		APIReader: mgr.GetAPIReader(),
 	}).SetupWithManager(context.Background(), mgr); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "CinderScheduler")
 		os.Exit(1)
 	}
 	if err := (&controller.CinderVolumeReconciler{
-		Client:  mgr.GetClient(),
-		Scheme:  mgr.GetScheme(),
-		Kclient: kclient,
+		Client:    mgr.GetClient(),
+		Scheme:    mgr.GetScheme(),
+		Kclient:   kclient,
+		APIReader: mgr.GetAPIReader(),
 	}).SetupWithManager(context.Background(), mgr); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "CinderVolume")
 		os.Exit(1)

diff --git a/config/crd/bases/cinder.openstack.org_cinderapis.yaml b/config/crd/bases/cinder.openstack.org_cinderapis.yaml
@@ -1288,6 +1288,11 @@ spec:
                   type: object
                 description: API endpoints
                 type: object
+              appliedInputSecretHash:
+                description: |-
+                  AppliedInputSecretHash is the hash of the input Secret consumed by the
+                  currently ready workload.
+                type: string
               conditions:
                 description: Conditions
                 items:

diff --git a/config/crd/bases/cinder.openstack.org_cinderbackups.yaml b/config/crd/bases/cinder.openstack.org_cinderbackups.yaml
@@ -1100,6 +1100,11 @@ spec:
           status:
             description: CinderBackupStatus defines the observed state of CinderBackup
             properties:
+              appliedInputSecretHash:
+                description: |-
+                  AppliedInputSecretHash is the hash of the input Secret consumed by the
+                  currently ready workload.
+                type: string
               conditions:
                 description: Conditions
                 items:

diff --git a/config/crd/bases/cinder.openstack.org_cinderschedulers.yaml b/config/crd/bases/cinder.openstack.org_cinderschedulers.yaml
@@ -1100,6 +1100,11 @@ spec:
           status:
             description: CinderSchedulerStatus defines the observed state of CinderScheduler
             properties:
+              appliedInputSecretHash:
+                description: |-
+                  AppliedInputSecretHash is the hash of the input Secret consumed by the
+                  currently ready workload.
+                type: string
               conditions:
                 description: Conditions
                 items:

diff --git a/config/crd/bases/cinder.openstack.org_cindervolumes.yaml b/config/crd/bases/cinder.openstack.org_cindervolumes.yaml
@@ -1101,6 +1101,11 @@ spec:
           status:
             description: CinderVolumeStatus defines the observed state of CinderVolume
             properties:
+              appliedInputSecretHash:
+                description: |-
+                  AppliedInputSecretHash is the hash of the input Secret consumed by the
+                  currently ready workload.
+                type: string
               conditions:
                 description: Conditions
                 items:

diff --git a/go.mod b/go.mod
@@ -9,12 +9,12 @@ require (
 	github.com/onsi/ginkgo/v2 v2.32.1
 	github.com/onsi/gomega v1.42.1
 	github.com/openstack-k8s-operators/cinder-operator/api v0.0.0-00010101000000-000000000000
-	github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260811190835-054aa14112d8
+	github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260815111556-ad0006892c31
 	github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260813151745-0d7ef88e4045
-	github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260813160234-fdcb3ee3699d
-	github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260813160234-fdcb3ee3699d
-	github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260813160234-fdcb3ee3699d
-	github.com/openstack-k8s-operators/lib-common/modules/users v0.0.0-20260813160234-fdcb3ee3699d
+	github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260824142420-113dc64ecfd4
+	github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260824142420-113dc64ecfd4
+	github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260824142420-113dc64ecfd4
+	github.com/openstack-k8s-operators/lib-common/modules/users v0.0.0-20260824142420-113dc64ecfd4
 	github.com/openstack-k8s-operators/mariadb-operator/api v0.6.1-0.20260813083726-eee3e1c5aa5c
 	golang.org/x/exp v0.0.0-20260611194520-c48552f49976
 	gopkg.in/ini.v1 v1.67.3
@@ -61,7 +61,7 @@ require (
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/openshift/api v3.9.0+incompatible // indirect
-	github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260813160234-fdcb3ee3699d // indirect
+	github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260824142420-113dc64ecfd4 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/prometheus/client_golang v1.22.0 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect

diff --git a/go.sum b/go.sum
@@ -116,20 +116,20 @@ github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
 github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
 github.com/openshift/api v0.0.0-20260710141509-36dec0bfafe4 h1:YVY7Mb0AdJBbNgC/Zz9R/ZwhixOmZNA8P+6ZPaDW/0M=
 github.com/openshift/api v0.0.0-20260710141509-36dec0bfafe4/go.mod h1:SPLf21TYPipzCO67BURkCfK6dcIIxx0oNRVWaOyRcXM=
-github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260811190835-054aa14112d8 h1:V+M1QXCXaYlrgMl863bjZWpCA0grSuePt2QjZ5QX6G0=
-github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260811190835-054aa14112d8/go.mod h1:nPqCNb6LtP2HIkAoOrM4Jr4BMdNnuY0puKx6v6fwOhI=
+github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260815111556-ad0006892c31 h1:DdvjIeuZcmcCj0Gaey10JSYXPUJpOVsFqk5x3aHtbrM=
+github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260815111556-ad0006892c31/go.mod h1:mrcugf1qcRO26DeSoMZFtxxZWW9a4nNk15MdBDFNP6Y=
 github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260813151745-0d7ef88e4045 h1:WeWvFRHMGvLi3bYdXeOqEXt5RVAzvSyEMQgdAGlixPo=
 github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260813151745-0d7ef88e4045/go.mod h1:eSJVec0eCTSudlsQ5+bNMHmn9aI1af2zNwMGStuzNOw=
-github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260813160234-fdcb3ee3699d h1:+DIuFNo6jIF0/9bHYz3C6OnnMQIe3C5bbFv2bAJLLo8=
-github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260813160234-fdcb3ee3699d/go.mod h1:LY+Q6ms3A6E8DAKCpmvQaUxO5O2CKYm0XMcmTZ6PCcM=
-github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260813160234-fdcb3ee3699d h1:btd0N5D9BwZPfXmUCcN5hPPi/v2RlIjsaNwZkbLdtx4=
-github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260813160234-fdcb3ee3699d/go.mod h1:Q5wcK4PnlDJ55H+M38CFNLzL53OHYiwq81mR/gKtJXs=
-github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260813160234-fdcb3ee3699d h1:/FKQGhZ7sE0yXfK1hjmLGhDU18t5Ew3Ex3iUh8ZR81Y=
-github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260813160234-fdcb3ee3699d/go.mod h1:fJ9CCRKpo8mQODfv4UDJ3tjUTbyCznYslXQwCkDaGg0=
-github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260813160234-fdcb3ee3699d h1:vNwsb5o+p2V5cBc2EX0TBWU7FmfWH5HPJMVd6ctkD8g=
-github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260813160234-fdcb3ee3699d/go.mod h1:tT5uXteekJ3lRgFO5/C3i6Q5A7dj40SDy6XbOJhnRuw=
-github.com/openstack-k8s-operators/lib-common/modules/users v0.0.0-20260813160234-fdcb3ee3699d h1:Tj/j5+ihxeQgfn0j7i65/U1NMPwNoZOEVdG3ZcTprn0=
-github.com/openstack-k8s-operators/lib-common/modules/users v0.0.0-20260813160234-fdcb3ee3699d/go.mod h1:jmVVRfwuFQ3fHLIOAkUrtLgOwEL6j45POzS3PBJuwyM=
+github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260824142420-113dc64ecfd4 h1:zDxe4n0GPQ+U8VFZyyCoQed+9Xauz4G22J/X6B4gq20=
+github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260824142420-113dc64ecfd4/go.mod h1:vDcTSyaI7R6tjtZOqonr0hzq8JMOfBhJCWZy0tVjQPw=
+github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260824142420-113dc64ecfd4 h1:cYQFMrD6zcVsyCXExm07a6wuVLMJmXSNQNaBK23Lu3M=
+github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260824142420-113dc64ecfd4/go.mod h1:Q5wcK4PnlDJ55H+M38CFNLzL53OHYiwq81mR/gKtJXs=
+github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260824142420-113dc64ecfd4 h1:atoyW+P7wLeLpKdfWG4vtBBErRVg23+0l3ZAM+cHibo=
+github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260824142420-113dc64ecfd4/go.mod h1:fJ9CCRKpo8mQODfv4UDJ3tjUTbyCznYslXQwCkDaGg0=
+github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260824142420-113dc64ecfd4 h1:n1ve1cxcG8ZAXCHb8SuNOA/+hXm+GYOl2Wp6oig6Mbo=
+github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260824142420-113dc64ecfd4/go.mod h1:tT5uXteekJ3lRgFO5/C3i6Q5A7dj40SDy6XbOJhnRuw=
+github.com/openstack-k8s-operators/lib-common/modules/users v0.0.0-20260824142420-113dc64ecfd4 h1:zvCfemkF/LjcRNUCbRlnU4tOu71u+TTwf78RrGJTWZU=
+github.com/openstack-k8s-operators/lib-common/modules/users v0.0.0-20260824142420-113dc64ecfd4/go.mod h1:jmVVRfwuFQ3fHLIOAkUrtLgOwEL6j45POzS3PBJuwyM=
 github.com/openstack-k8s-operators/mariadb-operator/api v0.6.1-0.20260813083726-eee3e1c5aa5c h1:N7KthVNlHdLJ6FZwpYsdsOdomm8eX6IXprWFqW3e7mc=
 github.com/openstack-k8s-operators/mariadb-operator/api v0.6.1-0.20260813083726-eee3e1c5aa5c/go.mod h1:6T332Zk4/uC+ac27ZzQ7oslcePpk0PTcrFtoRohPxjg=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=

diff --git a/internal/cinder/const.go b/internal/cinder/const.go
@@ -79,6 +79,11 @@ const (
 	// ACConsumerFinalizer is added to AC secrets that cinder is actively consuming
 	ACConsumerFinalizer = "openstack.org/cinder-ac-consumer"
 
+	// TransportConsumerFinalizer is added to transport URL secrets that cinder
+	// is actively consuming, preventing the infra-operator from cleaning up
+	// old RabbitMQ users before cinder pods have rolled out new credentials
+	TransportConsumerFinalizer = "openstack.org/cinder-transport-consumer"
+
 	// ShortDuration is a short duration for quick retries
 	ShortDuration = time.Duration(5) * time.Second
 	// NormalDuration is the normal duration for standard retries