[lappesj]

Summary

Prepare the v0.11.1 patch release with authenticated OpenStack client reuse across reconciliations.

• Cache clients by the complete provider configuration; coalesce concurrent initialization and bound the cache to 128 entries per provider flavor.
• Authenticate before publishing cached clients so failed initial authentication is not retained and token expiry is known.
• Expire clients before their tokens, invalidate the matching generation on HTTP 401, and bound shared reauthentication to 30 seconds.
• Preserve credential/scope isolation and keep Swift authentication uncached.
• Classify existing gophercloud and x/sync dependencies as direct dependencies; no dependency version changes.

Verification

• GitHub CI passed: unit tests, lint, generated diff, and local deployment.
• Client tests passed locally with the race detector across 20 runs.
• Development package publication passed.
• Deployed commit fdaf977 to de101-dev through the JFrog GHCR mirror using GitOps; runtime digest verified.
• Real controller / mock Keystone tests passed: 24 role reads across six managed resources and two ProviderConfigs used one token; initial HTTP 429 recovery, revoked-token HTTP 401 recovery with allow_reauth=false, and 20-second token expiry without an expiry HTTP 401.
• All nine Observe-only fixture resources were Ready/Synced and were cleaned up with their dummy credentials and mock infrastructure.
• All 296 pre-existing OpenStack managed resources remained Synced, including all 11 original RoleAssignments Ready/Synced. One pre-existing NotReady resource was unchanged.

Release checklist

• Confirm v0.11.1 stable release scope.
• Commit and push the dated CHANGELOG.md release entry (3957bdd).
• Resolve the DCO sign-off check for all three commits.
• Complete required review and merge into main.
• Create/update release-v0.11 and tag v0.11.1 using the Tag workflow.
• Publish the tagged package to GHCR and Upbound; verify mirror availability.
• Publish GitHub release notes.

No production deployment is included. The existing dev canary override remains unchanged by this release preparation.