awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(k8-operator): PushSecret CRd causing endless snapshot updates

Browse Source
This commit is contained in:
Daniel Hougaard
2024-12-10 04:31:55 +04:00
parent a757ea22a1
commit 0edf0dac98
1 changed files with 33 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

57
k8-operator/controllers/infisicalpushsecret/infisicalpushsecret_helper.go
View File

@@ -148,15 +148,6 @@ func (r *InfisicalPushSecretReconciler) ReconcileInfisicalPushSecret(ctx context
IncludeImports: false, IncludeImports: false,
}) })
existingSecretsContainsKey := func(key string) bool {
for _, secret := range existingSecrets {
if secret.SecretKey == key {
return true
}
}
return false
}
getExistingSecretByKey := func(key string) *infisicalSdk.Secret { getExistingSecretByKey := func(key string) *infisicalSdk.Secret {
for _, secret := range existingSecrets { for _, secret := range existingSecrets {
if secret.SecretKey == key { if secret.SecretKey == key {
@@ -175,6 +166,15 @@ func (r *InfisicalPushSecretReconciler) ReconcileInfisicalPushSecret(ctx context
return nil return nil
} }
updateExistingSecretByKey := func(key string, newSecretValue string) {
for i := range existingSecrets {
if existingSecrets[i].SecretKey == key {
existingSecrets[i].SecretValue = newSecretValue
break
}
}
}
if err != nil { if err != nil {
return fmt.Errorf("unable to list secrets [err=%s]", err) return fmt.Errorf("unable to list secrets [err=%s]", err)
} }
@@ -192,7 +192,8 @@ func (r *InfisicalPushSecretReconciler) ReconcileInfisicalPushSecret(ctx context
infisicalPushSecret.Status.ManagedSecrets = make(map[string]string) // (string[id], string[key] ) infisicalPushSecret.Status.ManagedSecrets = make(map[string]string) // (string[id], string[key] )
for secretKey, secretValue := range kubeSecrets { for secretKey, secretValue := range kubeSecrets {
if existingSecretsContainsKey(secretKey) { if exists := getExistingSecretByKey(secretKey); exists != nil {
if updatePolicy == string(constants.PUSH_SECRET_REPLACE_POLICY_ENABLED) { if updatePolicy == string(constants.PUSH_SECRET_REPLACE_POLICY_ENABLED) {
updatedSecret, err := infisicalClient.Secrets().Update(infisicalSdk.UpdateSecretOptions{ updatedSecret, err := infisicalClient.Secrets().Update(infisicalSdk.UpdateSecretOptions{
SecretKey: secretKey, SecretKey: secretKey,
@@ -306,7 +307,7 @@ func (r *InfisicalPushSecretReconciler) ReconcileInfisicalPushSecret(ctx context
// We need to check if any new secrets have been added in the kube secret // We need to check if any new secrets have been added in the kube secret
for currentSecretKey := range kubeSecrets { for currentSecretKey := range kubeSecrets {
if !existingSecretsContainsKey(currentSecretKey) { if exists := getExistingSecretByKey(currentSecretKey); exists == nil {
// Some secrets has been added, verify that the secret that has been added is not already managed by the operator // Some secrets has been added, verify that the secret that has been added is not already managed by the operator
if _, ok := infisicalPushSecret.Status.ManagedSecrets[currentSecretKey]; !ok { if _, ok := infisicalPushSecret.Status.ManagedSecrets[currentSecretKey]; !ok {
@@ -332,21 +333,29 @@ func (r *InfisicalPushSecretReconciler) ReconcileInfisicalPushSecret(ctx context
} }
} else { } else {
if updatePolicy == string(constants.PUSH_SECRET_REPLACE_POLICY_ENABLED) { if updatePolicy == string(constants.PUSH_SECRET_REPLACE_POLICY_ENABLED) {
updatedSecret, err := infisicalClient.Secrets().Update(infisicalSdk.UpdateSecretOptions{
SecretKey: currentSecretKey,
NewSecretValue: kubeSecrets[currentSecretKey],
ProjectID: destination.ProjectID,
Environment: destination.EnvironmentSlug,
SecretPath: destination.SecretsPath,
})
if err != nil { existingSecret := getExistingSecretByKey(currentSecretKey)
secretsFailedToUpdate = append(secretsFailedToUpdate, currentSecretKey)
logger.Info(fmt.Sprintf("unable to update secret [key=%s] [err=%s]", currentSecretKey, err)) if existingSecret != nil && existingSecret.SecretValue != kubeSecrets[currentSecretKey] {
continue logger.Info(fmt.Sprintf("Secret with key [key=%s] has changed value. Updating secret in Infisical", currentSecretKey))
updatedSecret, err := infisicalClient.Secrets().Update(infisicalSdk.UpdateSecretOptions{
SecretKey: currentSecretKey,
NewSecretValue: kubeSecrets[currentSecretKey],
ProjectID: destination.ProjectID,
Environment: destination.EnvironmentSlug,
SecretPath: destination.SecretsPath,
})
if err != nil {
secretsFailedToUpdate = append(secretsFailedToUpdate, currentSecretKey)
logger.Info(fmt.Sprintf("unable to update secret [key=%s] [err=%s]", currentSecretKey, err))
continue
}
updateExistingSecretByKey(currentSecretKey, kubeSecrets[currentSecretKey])
infisicalPushSecret.Status.ManagedSecrets[updatedSecret.ID] = currentSecretKey
} }
infisicalPushSecret.Status.ManagedSecrets[updatedSecret.ID] = currentSecretKey
} }
} }
} }