feat: bridge metadata with haproxy

[gboutry]

Run the local Nova metadata endpoint with HAProxy instead of the removed nova-api-metadata script. Neutron continues to call the host-local metadata endpoint while HAProxy forwards requests to the Nova metadata ingress route and preserves the metadata request path.

Parse the metadata ingress URL into HAProxy backend settings, support HTTP and HTTPS upstreams, and verify HTTPS upstream certificates using the received CA bundle when one is configured. Keep response headers compatible with the Neutron metadata proxy path.

Require both the Nova metadata ingress URL and metadata proxy shared secret from relation data. The hypervisor must not generate its own metadata secret because Nova validates requests with the secret owned by nova-k8s.

[Copilot]

Pull request overview

This PR replaces the local nova-api-metadata script-based endpoint with an HAProxy-based “metadata bridge” that keeps Neutron talking to a host-local metadata endpoint while forwarding requests to the Nova metadata ingress URL (HTTP/HTTPS), including optional TLS verification with a provided CA bundle.

Changes:

• Add a new HAProxy config template for bridging local metadata requests to a Nova metadata ingress URL, including HTTPS + CA verification support.
• Update hook context building to parse the ingress URL into HAProxy backend settings and adjust which templates/services are rendered/started.
• Update unit tests to validate the new URL parsing and template/service behavior (including trailing newline preservation).

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
openstack_hypervisor/hooks.py	Adds URL parsing into context, changes required config for nova-api-metadata, adds haproxy dir/template wiring, and stops generating metadata secrets.
openstack_hypervisor/services.py	Replaces nova-api-metadata execution with launching HAProxy using the rendered config.
templates/nova_metadata_haproxy.cfg.j2	New HAProxy config template that binds locally and forwards to the ingress backend (optionally with TLS verification).
templates/neutron_ovn_metadata_agent.ini.j2	Points Neutron OVN metadata agent to the new local metadata host/port settings.
tests/unit/test_hooks.py	Adds unit coverage for ingress URL parsing and updates readiness checks.
tests/unit/test_services.py	Adds unit coverage for the new HAProxy-based metadata service runner behavior.
tests/unit/test_templates.py	Extends template render context and adds assertions for the new HAProxy template and Neutron metadata agent config.
snap/snapcraft.yaml	Makes libvirt patch application conditional to avoid failing on inapplicable patches.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[MylesJP]

Looks sensible to me. I'll give Hemanth a chance to weigh in but the change to HAProxy makes sense.