Broken network/compute/dns clients if multiple openstack regions exist

[MichaelEischer]

How to categorize this issue?

/area networking, os, storage
/kind bug
/platform openstack

What happened:

When multiple regions exist in the OpenStack service catalog, then the gardener-extension-provider-openstack may fail to create a working client to access the compute / network / dns service of openstack. The clients use the first public endpoint in the OpenStack service catalog, which might be the correct one or not. This results in a complete failure to create machines, networks, DNS etc.

As far as I can tell, only the terraform based flow is affected, not the new infraflow variant. See below for a Proof of Concept fix.

What you expected to happen:

Communication with the OpenStack API should use the correct endpoints.

How to reproduce it (as minimally and precisely as possible):

I unfortunately don't have an easy way to reproduce. Essentially you need an openstack installation, then add a second region to the service catalog (some placeholder entries for compute, network and dns should work, as long as their name is stored before the actual region). The buggy client instances will use the first region returned by the service catalog, independent of where the actual resources are located.

Anything else we need to know?:

There is a proof of concept fix at here

Environment:

• Gardener version (if relevant):
• Extension version: 1.38.2 / 1.39.2 (issue also affects the latest master branch)
• Kubernetes version (use kubectl version): 1.28
• Cloud provider or hardware configuration: OpenStack with multiple regions in the service catalog