Summary

Fix the rotate_app_creds day2ops procedure failing at the credential verification step with:
'list object' has no attribute 'clouds'

Why

The to_nice_yaml(indent=4) filter prepends ---\n to the clouds.yaml content. When this content is piped into the OCP openstack-credentials secret via oc set data, the secret stores the YAML document separator. On readback, Ansible's from_yaml interprets the ----prefixed content as a multi-document YAML and returns a list (with one element) instead of a dict.
The verification assert then fails because it expects ocp_creds.clouds.openstack.auth_type but ocp_creds is a list, not a mapping.

What failed

Task: Verify credentials rotated to application credentials
Error from Zuul job (shiftstack-rhel9-rhoso18.0-ocp421, Jun 30):
The conditional check 'ocp_creds.clouds.openstack.auth_type == 'v3applicationcredential'' failed. The error was: error while evaluating conditional (ocp_creds.clouds.openstack.auth_type == 'v3applicationcredential'): 'list object' has no attribute 'clouds'. 'list object' has no attribute 'clouds'

Note: The credential rotation itself succeeds — the secret IS correctly updated. Only the verification readback parsing fails.

How

Two fixes applied to rotate_app_creds.yml:

1. Prevention — strip --- before writing to the secret:

# Before (buggy):
cat {{ clouds_yaml_file_path }} | sed 's/{{ user_cloud }}:/openstack:/' | \
oc set data -n kube-system secret/openstack-credentials clouds.yaml=-

# After (fixed):
cat {{ clouds_yaml_file_path }} | sed '/^---$/d' | sed 's/{{ user_cloud }}:/openstack:/' | \
oc set data -n kube-system secret/openstack-credentials clouds.yaml=-

2. Defensive parsing — handle both list and dict from from_yaml:

# Before (buggy):
- name: Parse OCP credentials
  ansible.builtin.set_fact:
    ocp_creds: "{{ ocp_creds_output.stdout | from_yaml }}"

# After (fixed):
- name: Parse OCP credentials
  vars:
    parsed_yaml: "{{ ocp_creds_output.stdout | from_yaml }}"
  ansible.builtin.set_fact:
    ocp_creds: "{{ (parsed_yaml is mapping) | ternary(parsed_yaml, parsed_yaml[0]) }}"

Test Plan

• ansible-lint passes (production profile)
• Day2ops rotation passes on a running OCP cluster
• oc get secret -n kube-system openstack-credentials content has no leading ---
• ocp_creds correctly parsed as dict with auth_type: v3applicationcredential

References

Bug: https://redhat.atlassian.net/browse/OCPBUGS-95045
Parent feature: https://redhat.atlassian.net/browse/OSPRH-6485
Failing job: shiftstack-rhel9-rhoso18.0-ocp421 periodic run (Jun 30, 2026)