Create empty secure.yml in /tmp to ensure secrets.yml takes precedence

When loading credentials from secrets.yml, the OpenStack SDK might still
find /etc/openstack/secure.yml with a different password. Creating an
empty /tmp/secure.yml ensures the SDK uses the password from secrets.yml.

AI-assisted: Claude Code

Signed-off-by: Christian Berendt <berendt@osism.tech>

Author: berendt

osism/commands/loadbalancer.py

@@ -10,8 +10,6 @@
 from tabulate import tabulate
 import yaml
 
-import openstack
-
 from osism.commands.octavia import wait_for_amphora_boot
 from osism.tasks.openstack import (
     cleanup_cloud_environment,

osism/commands/server.py

@@ -6,7 +6,6 @@
 from cliff.command import Command
 import dateutil
 from loguru import logger
-import openstack
 from prompt_toolkit import prompt
 from tabulate import tabulate
 

osism/commands/volume.py

@@ -6,7 +6,6 @@
 from cliff.command import Command
 import dateutil
 from loguru import logger
-import openstack
 from prompt_toolkit import prompt
 import pytz
 from tabulate import tabulate

osism/tasks/openstack.py

@@ -377,6 +377,13 @@ def setup_cloud_environment(cloud):
             yaml.dump(clouds_config, f)
         temp_files_to_cleanup.append(dst_clouds)
 
+        # Create an empty secure.yml in /tmp to prevent SDK from reading
+        # /etc/openstack/secure.yml which might have a different (wrong) password
+        dst_secure = "/tmp/secure.yml"
+        with open(dst_secure, "w") as f:
+            yaml.dump({}, f)
+        temp_files_to_cleanup.append(dst_secure)
+
         # Change working directory to /tmp so subprocesses find the config
         os.chdir("/tmp")