awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: requested changes

Browse Source
This commit is contained in:
Daniel Hougaard
2024-12-06 01:43:41 +04:00
parent e67b0540dd
commit 2f922d6343
6 changed files with 54 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
k8-operator/api/v1alpha1/infisicalpushsecret_types.go
View File

@@ -10,7 +10,7 @@ type InfisicalPushSecretDestination struct {
SecretsPath string `json:"secretsPath"` SecretsPath string `json:"secretsPath"`
// +kubebuilder:validation:Required // +kubebuilder:validation:Required
// +kubebuilder:validation:Immutable // +kubebuilder:validation:Immutable
EnvSlug string `json:"envSlug"` EnvironmentSlug string `json:"EnvironmentSlug"`
// +kubebuilder:validation:Required // +kubebuilder:validation:Required
// +kubebuilder:validation:Immutable // +kubebuilder:validation:Immutable
ProjectID string `json:"projectId"` ProjectID string `json:"projectId"`

4
k8-operator/config/crd/bases/secrets.infisical.com_infisicalpushsecrets.yaml
View File

@@ -114,14 +114,14 @@ spec:
type: string type: string
destination: destination:
properties: properties:
envSlug: EnvironmentSlug:
type: string type: string
projectId: projectId:
type: string type: string
secretsPath: secretsPath:
type: string type: string
required: required:
- envSlug - EnvironmentSlug
- projectId - projectId
- secretsPath - secretsPath
type: object type: object

6
k8-operator/controllers/infisicalpushsecret/conditions.go
View File

@@ -51,7 +51,7 @@ func (r *InfisicalPushSecretReconciler) SetFailedToReplaceSecretsConditions(ctx
Type: "secrets.infisical.com/FailedToReplaceSecrets", Type: "secrets.infisical.com/FailedToReplaceSecrets",
Status: metav1.ConditionFalse, Status: metav1.ConditionFalse,
Reason: "OK", Reason: "OK",
Message: "No errors, no secrets failed to be replaced", Message: "No errors, no secrets failed to be replaced in Infisical",
}) })
} }
@@ -75,7 +75,7 @@ func (r *InfisicalPushSecretReconciler) SetFailedToCreateSecretsConditions(ctx c
Type: "secrets.infisical.com/FailedToCreateSecrets", Type: "secrets.infisical.com/FailedToCreateSecrets",
Status: metav1.ConditionFalse, Status: metav1.ConditionFalse,
Reason: "OK", Reason: "OK",
Message: "No errors, no secrets failed to be created", Message: "No errors, no secrets failed to be created in Infisical",
}) })
} }
@@ -99,7 +99,7 @@ func (r *InfisicalPushSecretReconciler) SetFailedToUpdateSecretsConditions(ctx c
Type: "secrets.infisical.com/FailedToUpdateSecrets", Type: "secrets.infisical.com/FailedToUpdateSecrets",
Status: metav1.ConditionFalse, Status: metav1.ConditionFalse,
Reason: "OK", Reason: "OK",
Message: "No errors, no secrets failed to be updated", Message: "No errors, no secrets failed to be updated in Infisical",
}) })
} }

40
k8-operator/controllers/infisicalpushsecret/infisicalpushsecret_controller.go
View File

@@ -58,10 +58,10 @@ func (r *InfisicalPushSecretReconciler) Reconcile(ctx context.Context, req ctrl.
logger := r.GetLogger(req) logger := r.GetLogger(req)
var infisicalPushSecretCR secretsv1alpha1.InfisicalPushSecret var infisicalPushSecretCRD secretsv1alpha1.InfisicalPushSecret
requeueTime := time.Minute // seconds requeueTime := time.Minute // seconds
err := r.Get(ctx, req.NamespacedName, &infisicalPushSecretCR) err := r.Get(ctx, req.NamespacedName, &infisicalPushSecretCRD)
if err != nil { if err != nil {
if errors.IsNotFound(err) { if errors.IsNotFound(err) {
logger.Info("Infisical Push Secret CRD not found") logger.Info("Infisical Push Secret CRD not found")
@@ -77,25 +77,25 @@ func (r *InfisicalPushSecretReconciler) Reconcile(ctx context.Context, req ctrl.
} }
// Add finalizer if it doesn't exist // Add finalizer if it doesn't exist
if !controllerutil.ContainsFinalizer(&infisicalPushSecretCR, constants.INFISICAL_PUSH_SECRET_FINALIZER_NAME) { if !controllerutil.ContainsFinalizer(&infisicalPushSecretCRD, constants.INFISICAL_PUSH_SECRET_FINALIZER_NAME) {
controllerutil.AddFinalizer(&infisicalPushSecretCR, constants.INFISICAL_PUSH_SECRET_FINALIZER_NAME) controllerutil.AddFinalizer(&infisicalPushSecretCRD, constants.INFISICAL_PUSH_SECRET_FINALIZER_NAME)
if err := r.Update(ctx, &infisicalPushSecretCR); err != nil { if err := r.Update(ctx, &infisicalPushSecretCRD); err != nil {
return ctrl.Result{}, err return ctrl.Result{}, err
} }
} }
// Check if it's being deleted // Check if it's being deleted
if !infisicalPushSecretCR.DeletionTimestamp.IsZero() { if !infisicalPushSecretCRD.DeletionTimestamp.IsZero() {
logger.Info("Handling deletion of InfisicalPushSecret") logger.Info("Handling deletion of InfisicalPushSecret")
if controllerutil.ContainsFinalizer(&infisicalPushSecretCR, constants.INFISICAL_PUSH_SECRET_FINALIZER_NAME) { if controllerutil.ContainsFinalizer(&infisicalPushSecretCRD, constants.INFISICAL_PUSH_SECRET_FINALIZER_NAME) {
// We remove finalizers before running deletion logic to be completely safe from stuck resources // We remove finalizers before running deletion logic to be completely safe from stuck resources
infisicalPushSecretCR.ObjectMeta.Finalizers = []string{} infisicalPushSecretCRD.ObjectMeta.Finalizers = []string{}
if err := r.Update(ctx, &infisicalPushSecretCR); err != nil { if err := r.Update(ctx, &infisicalPushSecretCRD); err != nil {
logger.Error(err, fmt.Sprintf("Error removing finalizers from InfisicalPushSecret %s", infisicalPushSecretCR.Name)) logger.Error(err, fmt.Sprintf("Error removing finalizers from InfisicalPushSecret %s", infisicalPushSecretCRD.Name))
return ctrl.Result{}, err return ctrl.Result{}, err
} }
if err := r.DeleteManagedSecrets(ctx, logger, infisicalPushSecretCR); err != nil { if err := r.DeleteManagedSecrets(ctx, logger, infisicalPushSecretCRD); err != nil {
return ctrl.Result{}, err // Even if this fails, we still want to delete the CRD return ctrl.Result{}, err // Even if this fails, we still want to delete the CRD
} }
@@ -103,9 +103,9 @@ func (r *InfisicalPushSecretReconciler) Reconcile(ctx context.Context, req ctrl.
return ctrl.Result{}, nil return ctrl.Result{}, nil
} }
if infisicalPushSecretCR.Spec.ResyncInterval != "" { if infisicalPushSecretCRD.Spec.ResyncInterval != "" {
duration, err := util.ConvertResyncIntervalToDuration(infisicalPushSecretCR.Spec.ResyncInterval) duration, err := util.ConvertResyncIntervalToDuration(infisicalPushSecretCRD.Spec.ResyncInterval)
if err != nil { if err != nil {
logger.Error(err, fmt.Sprintf("unable to convert resync interval to duration. Will requeue after [requeueTime=%v]", requeueTime)) logger.Error(err, fmt.Sprintf("unable to convert resync interval to duration. Will requeue after [requeueTime=%v]", requeueTime))
@@ -123,7 +123,7 @@ func (r *InfisicalPushSecretReconciler) Reconcile(ctx context.Context, req ctrl.
} }
// Check if the resource is already marked for deletion // Check if the resource is already marked for deletion
if infisicalPushSecretCR.GetDeletionTimestamp() != nil { if infisicalPushSecretCRD.GetDeletionTimestamp() != nil {
return ctrl.Result{ return ctrl.Result{
Requeue: false, Requeue: false,
}, nil }, nil
@@ -138,14 +138,14 @@ func (r *InfisicalPushSecretReconciler) Reconcile(ctx context.Context, req ctrl.
}, nil }, nil
} }
if infisicalPushSecretCR.Spec.HostAPI == "" { if infisicalPushSecretCRD.Spec.HostAPI == "" {
api.API_HOST_URL = infisicalConfig["hostAPI"] api.API_HOST_URL = infisicalConfig["hostAPI"]
} else { } else {
api.API_HOST_URL = infisicalPushSecretCR.Spec.HostAPI api.API_HOST_URL = infisicalPushSecretCRD.Spec.HostAPI
} }
if infisicalPushSecretCR.Spec.TLS.CaRef.SecretName != "" { if infisicalPushSecretCRD.Spec.TLS.CaRef.SecretName != "" {
api.API_CA_CERTIFICATE, err = r.getInfisicalCaCertificateFromKubeSecret(ctx, infisicalPushSecretCR) api.API_CA_CERTIFICATE, err = r.getInfisicalCaCertificateFromKubeSecret(ctx, infisicalPushSecretCRD)
if err != nil { if err != nil {
logger.Error(err, fmt.Sprintf("unable to fetch CA certificate. Will requeue after [requeueTime=%v]", requeueTime)) logger.Error(err, fmt.Sprintf("unable to fetch CA certificate. Will requeue after [requeueTime=%v]", requeueTime))
return ctrl.Result{ return ctrl.Result{
@@ -158,8 +158,8 @@ func (r *InfisicalPushSecretReconciler) Reconcile(ctx context.Context, req ctrl.
api.API_CA_CERTIFICATE = "" api.API_CA_CERTIFICATE = ""
} }
err = r.ReconcileInfisicalPushSecret(ctx, logger, infisicalPushSecretCR) err = r.ReconcileInfisicalPushSecret(ctx, logger, infisicalPushSecretCRD)
r.SetSuccessfullyReconciledConditions(ctx, &infisicalPushSecretCR, err) r.SetSuccessfullyReconciledConditions(ctx, &infisicalPushSecretCRD, err)
if err != nil { if err != nil {
logger.Error(err, fmt.Sprintf("unable to reconcile Infisical Push Secret. Will requeue after [requeueTime=%v]", requeueTime)) logger.Error(err, fmt.Sprintf("unable to reconcile Infisical Push Secret. Will requeue after [requeueTime=%v]", requeueTime))

22
k8-operator/controllers/infisicalpushsecret/infisicalpushsecret_helper.go
View File

@@ -143,7 +143,7 @@ func (r *InfisicalPushSecretReconciler) ReconcileInfisicalPushSecret(ctx context
destination := infisicalPushSecret.Spec.Destination destination := infisicalPushSecret.Spec.Destination
existingSecrets, err := infisicalClient.Secrets().List(infisicalSdk.ListSecretsOptions{ existingSecrets, err := infisicalClient.Secrets().List(infisicalSdk.ListSecretsOptions{
ProjectID: destination.ProjectID, ProjectID: destination.ProjectID,
Environment: destination.EnvSlug, Environment: destination.EnvironmentSlug,
SecretPath: destination.SecretsPath, SecretPath: destination.SecretsPath,
IncludeImports: false, IncludeImports: false,
}) })
@@ -197,7 +197,7 @@ func (r *InfisicalPushSecretReconciler) ReconcileInfisicalPushSecret(ctx context
updatedSecret, err := infisicalClient.Secrets().Update(infisicalSdk.UpdateSecretOptions{ updatedSecret, err := infisicalClient.Secrets().Update(infisicalSdk.UpdateSecretOptions{
SecretKey: secretKey, SecretKey: secretKey,
ProjectID: destination.ProjectID, ProjectID: destination.ProjectID,
Environment: destination.EnvSlug, Environment: destination.EnvironmentSlug,
SecretPath: destination.SecretsPath, SecretPath: destination.SecretsPath,
NewSecretValue: secretValue, NewSecretValue: secretValue,
}) })
@@ -215,7 +215,7 @@ func (r *InfisicalPushSecretReconciler) ReconcileInfisicalPushSecret(ctx context
SecretKey: secretKey, SecretKey: secretKey,
SecretValue: secretValue, SecretValue: secretValue,
ProjectID: destination.ProjectID, ProjectID: destination.ProjectID,
Environment: destination.EnvSlug, Environment: destination.EnvironmentSlug,
SecretPath: destination.SecretsPath, SecretPath: destination.SecretsPath,
}) })
@@ -245,7 +245,7 @@ func (r *InfisicalPushSecretReconciler) ReconcileInfisicalPushSecret(ctx context
deletedSecret, err := infisicalClient.Secrets().Delete(infisicalSdk.DeleteSecretOptions{ deletedSecret, err := infisicalClient.Secrets().Delete(infisicalSdk.DeleteSecretOptions{
SecretKey: existingSecret.SecretKey, SecretKey: existingSecret.SecretKey,
ProjectID: destination.ProjectID, ProjectID: destination.ProjectID,
Environment: destination.EnvSlug, Environment: destination.EnvironmentSlug,
SecretPath: destination.SecretsPath, SecretPath: destination.SecretsPath,
}) })
@@ -259,7 +259,7 @@ func (r *InfisicalPushSecretReconciler) ReconcileInfisicalPushSecret(ctx context
SecretKey: managedSecretKey, SecretKey: managedSecretKey,
SecretValue: existingSecret.SecretValue, SecretValue: existingSecret.SecretValue,
ProjectID: destination.ProjectID, ProjectID: destination.ProjectID,
Environment: destination.EnvSlug, Environment: destination.EnvironmentSlug,
SecretPath: destination.SecretsPath, SecretPath: destination.SecretsPath,
}) })
@@ -288,7 +288,7 @@ func (r *InfisicalPushSecretReconciler) ReconcileInfisicalPushSecret(ctx context
deletedSecret, err := infisicalClient.Secrets().Delete(infisicalSdk.DeleteSecretOptions{ deletedSecret, err := infisicalClient.Secrets().Delete(infisicalSdk.DeleteSecretOptions{
SecretKey: managedSecretKey, SecretKey: managedSecretKey,
ProjectID: destination.ProjectID, ProjectID: destination.ProjectID,
Environment: destination.EnvSlug, Environment: destination.EnvironmentSlug,
SecretPath: destination.SecretsPath, SecretPath: destination.SecretsPath,
}) })
@@ -318,7 +318,7 @@ func (r *InfisicalPushSecretReconciler) ReconcileInfisicalPushSecret(ctx context
SecretKey: currentSecretKey, SecretKey: currentSecretKey,
SecretValue: kubeSecrets[currentSecretKey], SecretValue: kubeSecrets[currentSecretKey],
ProjectID: destination.ProjectID, ProjectID: destination.ProjectID,
Environment: destination.EnvSlug, Environment: destination.EnvironmentSlug,
SecretPath: destination.SecretsPath, SecretPath: destination.SecretsPath,
}) })
@@ -336,7 +336,7 @@ func (r *InfisicalPushSecretReconciler) ReconcileInfisicalPushSecret(ctx context
SecretKey: currentSecretKey, SecretKey: currentSecretKey,
NewSecretValue: kubeSecrets[currentSecretKey], NewSecretValue: kubeSecrets[currentSecretKey],
ProjectID: destination.ProjectID, ProjectID: destination.ProjectID,
Environment: destination.EnvSlug, Environment: destination.EnvironmentSlug,
SecretPath: destination.SecretsPath, SecretPath: destination.SecretsPath,
}) })
@@ -369,7 +369,7 @@ func (r *InfisicalPushSecretReconciler) ReconcileInfisicalPushSecret(ctx context
SecretKey: secretKey, SecretKey: secretKey,
NewSecretValue: secretValue, NewSecretValue: secretValue,
ProjectID: destination.ProjectID, ProjectID: destination.ProjectID,
Environment: destination.EnvSlug, Environment: destination.EnvironmentSlug,
SecretPath: destination.SecretsPath, SecretPath: destination.SecretsPath,
}) })
@@ -435,7 +435,7 @@ func (r *InfisicalPushSecretReconciler) DeleteManagedSecrets(ctx context.Context
destination := infisicalPushSecret.Spec.Destination destination := infisicalPushSecret.Spec.Destination
existingSecrets, err := infisicalClient.Secrets().List(infisicalSdk.ListSecretsOptions{ existingSecrets, err := infisicalClient.Secrets().List(infisicalSdk.ListSecretsOptions{
ProjectID: destination.ProjectID, ProjectID: destination.ProjectID,
Environment: destination.EnvSlug, Environment: destination.EnvironmentSlug,
SecretPath: destination.SecretsPath, SecretPath: destination.SecretsPath,
IncludeImports: false, IncludeImports: false,
}) })
@@ -457,7 +457,7 @@ func (r *InfisicalPushSecretReconciler) DeleteManagedSecrets(ctx context.Context
_, err := infisicalClient.Secrets().Delete(infisicalSdk.DeleteSecretOptions{ _, err := infisicalClient.Secrets().Delete(infisicalSdk.DeleteSecretOptions{
SecretKey: managedSecretKey, SecretKey: managedSecretKey,
ProjectID: destination.ProjectID, ProjectID: destination.ProjectID,
Environment: destination.EnvSlug, Environment: destination.EnvironmentSlug,
SecretPath: destination.SecretsPath, SecretPath: destination.SecretsPath,
}) })

34
k8-operator/controllers/infisicalsecret/infisicalsecret_controller.go
View File

@@ -52,10 +52,10 @@ func (r *InfisicalSecretReconciler) Reconcile(ctx context.Context, req ctrl.Requ
logger := r.GetLogger(req) logger := r.GetLogger(req)
var infisicalSecretCR secretsv1alpha1.InfisicalSecret var infisicalSecretCRD secretsv1alpha1.InfisicalSecret
requeueTime := time.Minute // seconds requeueTime := time.Minute // seconds
err := r.Get(ctx, req.NamespacedName, &infisicalSecretCR) err := r.Get(ctx, req.NamespacedName, &infisicalSecretCRD)
if err != nil { if err != nil {
if errors.IsNotFound(err) { if errors.IsNotFound(err) {
return ctrl.Result{ return ctrl.Result{
@@ -71,18 +71,18 @@ func (r *InfisicalSecretReconciler) Reconcile(ctx context.Context, req ctrl.Requ
// Remove finalizers if they exist. This is to support previous InfisicalSecret CRD's that have finalizers on them. // Remove finalizers if they exist. This is to support previous InfisicalSecret CRD's that have finalizers on them.
// In order to delete secrets with finalizers, we first remove the finalizers so we can use the simplified and improved deletion process // In order to delete secrets with finalizers, we first remove the finalizers so we can use the simplified and improved deletion process
if !infisicalSecretCR.ObjectMeta.DeletionTimestamp.IsZero() && len(infisicalSecretCR.ObjectMeta.Finalizers) > 0 { if !infisicalSecretCRD.ObjectMeta.DeletionTimestamp.IsZero() && len(infisicalSecretCRD.ObjectMeta.Finalizers) > 0 {
infisicalSecretCR.ObjectMeta.Finalizers = []string{} infisicalSecretCRD.ObjectMeta.Finalizers = []string{}
if err := r.Update(ctx, &infisicalSecretCR); err != nil { if err := r.Update(ctx, &infisicalSecretCRD); err != nil {
logger.Error(err, fmt.Sprintf("Error removing finalizers from Infisical Secret %s", infisicalSecretCR.Name)) logger.Error(err, fmt.Sprintf("Error removing finalizers from Infisical Secret %s", infisicalSecretCRD.Name))
return ctrl.Result{}, err return ctrl.Result{}, err
} }
// Our finalizers have been removed, so the reconciler can do nothing. // Our finalizers have been removed, so the reconciler can do nothing.
return ctrl.Result{}, nil return ctrl.Result{}, nil
} }
if infisicalSecretCR.Spec.ResyncInterval != 0 { if infisicalSecretCRD.Spec.ResyncInterval != 0 {
requeueTime = time.Second * time.Duration(infisicalSecretCR.Spec.ResyncInterval) requeueTime = time.Second * time.Duration(infisicalSecretCRD.Spec.ResyncInterval)
logger.Info(fmt.Sprintf("Manual re-sync interval set. Interval: %v", requeueTime)) logger.Info(fmt.Sprintf("Manual re-sync interval set. Interval: %v", requeueTime))
} else { } else {
@@ -90,7 +90,7 @@ func (r *InfisicalSecretReconciler) Reconcile(ctx context.Context, req ctrl.Requ
} }
// Check if the resource is already marked for deletion // Check if the resource is already marked for deletion
if infisicalSecretCR.GetDeletionTimestamp() != nil { if infisicalSecretCRD.GetDeletionTimestamp() != nil {
return ctrl.Result{ return ctrl.Result{
Requeue: false, Requeue: false,
}, nil }, nil
@@ -105,14 +105,14 @@ func (r *InfisicalSecretReconciler) Reconcile(ctx context.Context, req ctrl.Requ
}, nil }, nil
} }
if infisicalSecretCR.Spec.HostAPI == "" { if infisicalSecretCRD.Spec.HostAPI == "" {
api.API_HOST_URL = infisicalConfig["hostAPI"] api.API_HOST_URL = infisicalConfig["hostAPI"]
} else { } else {
api.API_HOST_URL = infisicalSecretCR.Spec.HostAPI api.API_HOST_URL = infisicalSecretCRD.Spec.HostAPI
} }
if infisicalSecretCR.Spec.TLS.CaRef.SecretName != "" { if infisicalSecretCRD.Spec.TLS.CaRef.SecretName != "" {
api.API_CA_CERTIFICATE, err = r.getInfisicalCaCertificateFromKubeSecret(ctx, infisicalSecretCR) api.API_CA_CERTIFICATE, err = r.getInfisicalCaCertificateFromKubeSecret(ctx, infisicalSecretCRD)
if err != nil { if err != nil {
logger.Error(err, fmt.Sprintf("unable to fetch CA certificate. Will requeue after [requeueTime=%v]", requeueTime)) logger.Error(err, fmt.Sprintf("unable to fetch CA certificate. Will requeue after [requeueTime=%v]", requeueTime))
return ctrl.Result{ return ctrl.Result{
@@ -125,8 +125,8 @@ func (r *InfisicalSecretReconciler) Reconcile(ctx context.Context, req ctrl.Requ
api.API_CA_CERTIFICATE = "" api.API_CA_CERTIFICATE = ""
} }
err = r.ReconcileInfisicalSecret(ctx, logger, infisicalSecretCR) err = r.ReconcileInfisicalSecret(ctx, logger, infisicalSecretCRD)
r.SetReadyToSyncSecretsConditions(ctx, &infisicalSecretCR, err) r.SetReadyToSyncSecretsConditions(ctx, &infisicalSecretCRD, err)
if err != nil { if err != nil {
@@ -136,8 +136,8 @@ func (r *InfisicalSecretReconciler) Reconcile(ctx context.Context, req ctrl.Requ
}, nil }, nil
} }
numDeployments, err := r.ReconcileDeploymentsWithManagedSecrets(ctx, logger, infisicalSecretCR) numDeployments, err := r.ReconcileDeploymentsWithManagedSecrets(ctx, logger, infisicalSecretCRD)
r.SetInfisicalAutoRedeploymentReady(ctx, logger, &infisicalSecretCR, numDeployments, err) r.SetInfisicalAutoRedeploymentReady(ctx, logger, &infisicalSecretCRD, numDeployments, err)
if err != nil { if err != nil {
logger.Error(err, fmt.Sprintf("unable to reconcile auto redeployment. Will requeue after [requeueTime=%v]", requeueTime)) logger.Error(err, fmt.Sprintf("unable to reconcile auto redeployment. Will requeue after [requeueTime=%v]", requeueTime))
return ctrl.Result{ return ctrl.Result{