awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(k8s): disable clustergenerator watching in namespace scoped installation

Browse Source
This commit is contained in:
Daniel Hougaard
2025-05-20 23:03:58 +04:00
parent 8d8a3efd77
commit 52feabd786
2 changed files with 21 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
k8-operator/controllers/infisicalpushsecret/infisicalpushsecret_controller.go
View File

@@ -30,9 +30,9 @@ import (
// InfisicalSecretReconciler reconciles a InfisicalSecret object // InfisicalSecretReconciler reconciles a InfisicalSecret object
type InfisicalPushSecretReconciler struct { type InfisicalPushSecretReconciler struct {
client.Client client.Client
IsNamespaceScoped bool
BaseLogger logr.Logger BaseLogger logr.Logger
Scheme *runtime.Scheme Scheme *runtime.Scheme
} }
var infisicalPushSecretResourceVariablesMap map[string]util.ResourceVariables = make(map[string]util.ResourceVariables) var infisicalPushSecretResourceVariablesMap map[string]util.ResourceVariables = make(map[string]util.ResourceVariables)
@@ -51,7 +51,7 @@ func (r *InfisicalPushSecretReconciler) GetLogger(req ctrl.Request) logr.Logger
//+kubebuilder:rbac:groups="",resources=pods,verbs=get;list //+kubebuilder:rbac:groups="",resources=pods,verbs=get;list
//+kubebuilder:rbac:groups="authentication.k8s.io",resources=tokenreviews,verbs=create //+kubebuilder:rbac:groups="authentication.k8s.io",resources=tokenreviews,verbs=create
//+kubebuilder:rbac:groups="",resources=serviceaccounts/token,verbs=create //+kubebuilder:rbac:groups="",resources=serviceaccounts/token,verbs=create
// +kubebuilder:rbac:groups=secrets.infisical.com,resources=clustergenerators,verbs=get;list;watch;create;update;patch;delete //+kubebuilder:rbac:groups=secrets.infisical.com,resources=clustergenerators,verbs=get;list;watch;create;update;patch;delete
// Reconcile is part of the main kubernetes reconciliation loop which aims to // Reconcile is part of the main kubernetes reconciliation loop which aims to
// move the current state of the cluster closer to the desired state. // move the current state of the cluster closer to the desired state.
// For more details, check Reconcile and its Result here: // For more details, check Reconcile and its Result here:
@@ -249,19 +249,26 @@ func (r *InfisicalPushSecretReconciler) SetupWithManager(mgr ctrl.Manager) error
}, },
} }
return ctrl.NewControllerManagedBy(mgr). controllerManager := ctrl.NewControllerManagedBy(mgr).
For(&secretsv1alpha1.InfisicalPushSecret{}, builder.WithPredicates( For(&secretsv1alpha1.InfisicalPushSecret{}, builder.WithPredicates(
specChangeOrDelete, specChangeOrDelete,
)). )).
Watches( Watches(
&source.Kind{Type: &corev1.Secret{}}, &source.Kind{Type: &corev1.Secret{}},
handler.EnqueueRequestsFromMapFunc(r.findPushSecretsForSecret), handler.EnqueueRequestsFromMapFunc(r.findPushSecretsForSecret),
). )
Watches(
if !r.IsNamespaceScoped {
r.BaseLogger.Info("Watching ClusterGenerators for namespace scoped operator")
controllerManager.Watches(
&source.Kind{Type: &secretsv1alpha1.ClusterGenerator{}}, &source.Kind{Type: &secretsv1alpha1.ClusterGenerator{}},
handler.EnqueueRequestsFromMapFunc(r.findPushSecretsForClusterGenerator), handler.EnqueueRequestsFromMapFunc(r.findPushSecretsForClusterGenerator),
). )
Complete(r) } else {
r.BaseLogger.Info("Not watching ClusterGenerators for namespace scoped operator")
}
return controllerManager.Complete(r)
} }
func (r *InfisicalPushSecretReconciler) findPushSecretsForClusterGenerator(o client.Object) []reconcile.Request { func (r *InfisicalPushSecretReconciler) findPushSecretsForClusterGenerator(o client.Object) []reconcile.Request {
@@ -277,6 +284,7 @@ func (r *InfisicalPushSecretReconciler) findPushSecretsForClusterGenerator(o cli
} }
requests := []reconcile.Request{} requests := []reconcile.Request{}
for _, pushSecret := range pushSecrets.Items { for _, pushSecret := range pushSecrets.Items {
if pushSecret.Spec.Push.Generators != nil { if pushSecret.Spec.Push.Generators != nil {
for _, generator := range pushSecret.Spec.Push.Generators { for _, generator := range pushSecret.Spec.Push.Generators {

7
k8-operator/main.go
View File

@@ -99,9 +99,10 @@ func main() {
} }
if err = (&infisicalPushSecretController.InfisicalPushSecretReconciler{ if err = (&infisicalPushSecretController.InfisicalPushSecretReconciler{
Client: mgr.GetClient(), Client: mgr.GetClient(),
Scheme: mgr.GetScheme(), Scheme: mgr.GetScheme(),
BaseLogger: ctrl.Log, BaseLogger: ctrl.Log,
IsNamespaceScoped: namespace != "",
}).SetupWithManager(mgr); err != nil { }).SetupWithManager(mgr); err != nil {
setupLog.Error(err, "unable to create controller", "controller", "InfisicalPushSecret") setupLog.Error(err, "unable to create controller", "controller", "InfisicalPushSecret")
os.Exit(1) os.Exit(1)