awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(k8s): fixed dynamic secret bugs

Browse Source
This commit is contained in:
Daniel Hougaard
2024-12-11 22:22:52 +04:00
parent 0edf0dac98
commit 35d3581e23
3 changed files with 20 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
k8-operator/controllers/infisicaldynamicsecret/conditions.go
View File

@@ -118,33 +118,6 @@ func (r *InfisicalDynamicSecretReconciler) SetCreatedLeaseStatus(ctx context.Con
}
}
func (r *InfisicalDynamicSecretReconciler) SetRevokedLeaseStatus(ctx context.Context, logger logr.Logger, infisicalDynamicSecret *v1alpha1.InfisicalDynamicSecret, errorToConditionOn error) {
if infisicalDynamicSecret.Status.Conditions == nil {
infisicalDynamicSecret.Status.Conditions = []metav1.Condition{}
}
if errorToConditionOn == nil {
meta.SetStatusCondition(&infisicalDynamicSecret.Status.Conditions, metav1.Condition{
Type: "secrets.infisical.com/LeaseRevoked",
Status: metav1.ConditionTrue,
Reason: "OK",
Message: "Infisical has successfully revoked the lease",
})
} else {
meta.SetStatusCondition(&infisicalDynamicSecret.Status.Conditions, metav1.Condition{
Type: "secrets.infisical.com/LeaseRevoked",
Status: metav1.ConditionFalse,
Reason: "Error",
Message: fmt.Sprintf("Failed to revoke the lease because: %v", errorToConditionOn),
})
}
err := r.Client.Status().Update(ctx, infisicalDynamicSecret)
if err != nil {
logger.Error(err, "Could not set condition for LeaseRevoked")
}
}
func (r *InfisicalDynamicSecretReconciler) SetReconcileStatus(ctx context.Context, logger logr.Logger, infisicalDynamicSecret *v1alpha1.InfisicalDynamicSecret, errorToConditionOn error) {
if infisicalDynamicSecret.Status.Conditions == nil {
infisicalDynamicSecret.Status.Conditions = []metav1.Condition{}

1
k8-operator/controllers/infisicaldynamicsecret/infisicaldynamicsecret_controller.go
View File

@@ -86,7 +86,6 @@ func (r *InfisicalDynamicSecretReconciler) Reconcile(ctx context.Context, req ct
}
err := r.HandleLeaseRevocation(ctx, logger, infisicalDynamicSecretCRD)
r.SetRevokedLeaseStatus(ctx, logger, &infisicalDynamicSecretCRD, err)
if infisicalDynamicSecretsResourceVariablesMap != nil {
if rv, ok := infisicalDynamicSecretsResourceVariablesMap[string(infisicalDynamicSecretCRD.GetUID())]; ok {

33
k8-operator/controllers/infisicaldynamicsecret/infisicaldynamicsecret_helper.go
View File

@@ -256,7 +256,7 @@ func (r *InfisicalDynamicSecretReconciler) updateResourceVariables(infisicalDyna
infisicalDynamicSecretsResourceVariablesMap[string(infisicalDynamicSecret.UID)] = resourceVariables
}
func (r *InfisicalDynamicSecretReconciler) HandleLeaseRevocation(ctx context.Context, logger logr.Logger, infisicalDynamicSecret v1alpha1.InfisicalDynamicSecret) error {
func (r *InfisicalDynamicSecretReconciler) HandleLeaseRevocation(ctx context.Context, logger logr.Logger, infisicalDynamicSecret *v1alpha1.InfisicalDynamicSecret) error {
if infisicalDynamicSecret.Spec.LeaseRevocationPolicy != string(constants.DYNAMIC_SECRET_LEASE_REVOCATION_POLICY_ENABLED) {
return nil
}
@@ -266,7 +266,6 @@ func (r *InfisicalDynamicSecretReconciler) HandleLeaseRevocation(ctx context.Con
logger.Info("Authenticating for lease revocation")
authDetails, err := r.handleAuthentication(ctx, infisicalDynamicSecret, infisicalClient)
r.SetAuthenticatedStatus(ctx, logger, &infisicalDynamicSecret, err)
if err != nil {
return fmt.Errorf("unable to authenticate for lease revocation [err=%s]", err)
@@ -349,20 +348,28 @@ func (r *InfisicalDynamicSecretReconciler) ReconcileInfisicalDynamicSecret(ctx c
Namespace: infisicalDynamicSecret.Spec.ManagedSecretReference.SecretNamespace,
})
if err != nil && !k8Errors.IsNotFound(err) {
annotationValue := ""
if infisicalDynamicSecret.Status.Lease != nil {
annotationValue = fmt.Sprintf("%s-%d", infisicalDynamicSecret.Status.Lease.ID, infisicalDynamicSecret.Status.Lease.Version)
}
r.createInfisicalManagedKubeSecret(ctx, logger, *infisicalDynamicSecret, annotationValue)
}
if err != nil {
if k8Errors.IsNotFound(err) {
return nextReconcile, fmt.Errorf("destination secret not found")
}
return nextReconcile, fmt.Errorf("unable to fetch destination secret")
annotationValue := ""
if infisicalDynamicSecret.Status.Lease != nil {
annotationValue = fmt.Sprintf("%s-%d", infisicalDynamicSecret.Status.Lease.ID, infisicalDynamicSecret.Status.Lease.Version)
}
r.createInfisicalManagedKubeSecret(ctx, logger, *infisicalDynamicSecret, annotationValue)
destination, err = util.GetKubeSecretByNamespacedName(ctx, r.Client, types.NamespacedName{
Name: infisicalDynamicSecret.Spec.ManagedSecretReference.SecretName,
Namespace: infisicalDynamicSecret.Spec.ManagedSecretReference.SecretNamespace,
})
if err != nil {
return nextReconcile, fmt.Errorf("unable to fetch destination secret after creation [err=%s]", err)
}
} else {
return nextReconcile, fmt.Errorf("unable to fetch destination secret")
}
}
if infisicalDynamicSecret.Status.Lease == nil {