diff --git a/k8-operator/config/samples/crd/infisicalsecret/infisicalSecretCrd.yaml b/k8-operator/config/samples/crd/infisicalsecret/infisicalSecretCrd.yaml index 0e51f5baf..76e654d30 100644 --- a/k8-operator/config/samples/crd/infisicalsecret/infisicalSecretCrd.yaml +++ b/k8-operator/config/samples/crd/infisicalsecret/infisicalSecretCrd.yaml @@ -7,7 +7,7 @@ metadata: annotations: example.com/annotation-to-be-passed-to-managed-secret: "sample-value" spec: - hostAPI: http://localhost:8080/api + hostAPI: http://localhost:8085/api resyncInterval: 10 instantUpdates: true # tls: @@ -32,7 +32,7 @@ spec: # Universal Auth universalAuth: secretsScope: - projectSlug: + projectSlug: test-j7-kx envSlug: dev # "dev", "staging", "prod", etc.. secretsPath: "/" # Root is "/" recursive: true # Wether or not to use recursive mode (Fetches all secrets in an environment from a given secret path, and all folders inside the path) / defaults to false diff --git a/k8-operator/config/samples/k8s-auth/sample.yaml b/k8-operator/config/samples/k8s-auth/sample.yaml index 1d49f537b..31f1be5b6 100644 --- a/k8-operator/config/samples/k8s-auth/sample.yaml +++ b/k8-operator/config/samples/k8s-auth/sample.yaml @@ -1,32 +1,28 @@ apiVersion: secrets.infisical.com/v1alpha1 kind: InfisicalSecret metadata: - name: infisicalsecret-sample - labels: - label-to-be-passed-to-managed-secret: sample-value - annotations: - example.com/annotation-to-be-passed-to-managed-secret: "sample-value" + name: infisicalsecret-sample + labels: + label-to-be-passed-to-managed-secret: sample-value + annotations: + example.com/annotation-to-be-passed-to-managed-secret: "sample-value" spec: - hostAPI: http://localhost:8085/api - resyncInterval: 10 - authentication: - # Native Kubernetes Auth - kubernetesAuth: - identityId: 25d05878-0a2f-47c5-b889-46b70fb2dbfc - serviceAccountRef: - name: infisical-auth - namespace: default - - # secretsScope is identical to the secrets scope in the universalAuth field in this sample. - secretsScope: - projectSlug: test-j7-kx - envSlug: dev - secretsPath: "/" - recursive: true - - - managedSecretReference: - secretName: managed-secret-k8s + hostAPI: http://localhost:8085/api + resyncInterval: 10 + authentication: + # Universal Auth + universalAuth: + secretsScope: + projectSlug: test-j7-kx + envSlug: dev # "dev", "staging", "prod", etc.. + secretsPath: "/" # Root is "/" + recursive: true # Wether or not to use recursive mode (Fetches all secrets in an environment from a given secret path, and all folders inside the path) / defaults to false + credentialsRef: + secretName: universal-auth-credentials secretNamespace: default - creationPolicy: "Orphan" ## Owner | Orphan - # secretType: kubernetes.io/dockerconfigjson + + managedSecretReference: + secretName: managed-secret-k8s + secretNamespace: default + creationPolicy: "Orphan" ## Owner | Orphan + # secretType: kubernetes.io/dockerconfigjson diff --git a/k8-operator/config/samples/universalAuthIdentitySecret.yaml b/k8-operator/config/samples/universalAuthIdentitySecret.yaml index e940c4293..f0414e804 100644 --- a/k8-operator/config/samples/universalAuthIdentitySecret.yaml +++ b/k8-operator/config/samples/universalAuthIdentitySecret.yaml @@ -4,5 +4,5 @@ metadata: name: universal-auth-credentials type: Opaque stringData: - clientId: - clientSecret: + clientId: 86c17800-00b9-4556-89a8-ea11ac6f8371 + clientSecret: c5bc415b2fe4d40d9d7560bcf3f78cbf65edacc618d293503df1b6f175467933 diff --git a/k8-operator/internal/api/api.go b/k8-operator/internal/api/api.go index e69f0ae1f..546b309a3 100644 --- a/k8-operator/internal/api/api.go +++ b/k8-operator/internal/api/api.go @@ -3,7 +3,7 @@ package api import ( "fmt" - "github.com/Infisical/infisical/k8-operator/packages/model" + "github.com/Infisical/infisical/k8-operator/internal/model" "github.com/go-resty/resty/v2" ) diff --git a/k8-operator/internal/controller/infisicalsecret_controller.go b/k8-operator/internal/controller/infisicalsecret_controller.go index 9ebca1f07..7154cd0f3 100644 --- a/k8-operator/internal/controller/infisicalsecret_controller.go +++ b/k8-operator/internal/controller/infisicalsecret_controller.go @@ -203,14 +203,14 @@ func (r *InfisicalSecretReconciler) Reconcile(ctx context.Context, req ctrl.Requ if infisicalSecretCRD.Spec.InstantUpdates { logger.Info("Instant updates are enabled") - if err := r.EnsureEventStream(ctx, logger, &infisicalSecretCRD); err != nil { + if err := handler.OpenInstantUpdatesStream(ctx, logger, &infisicalSecretCRD, infisicalSecretResourceVariablesMap, r.SourceCh); err != nil { logger.Error(err, fmt.Sprintf("unable to ensure event stream. Will requeue after [requeueTime=%v]", requeueTime)) return ctrl.Result{ RequeueAfter: requeueTime, }, nil } } else { - r.CloseEventStream(ctx, logger, &infisicalSecretCRD) + handler.CloseInstantUpdatesStream(ctx, logger, &infisicalSecretCRD, infisicalSecretResourceVariablesMap) } // Sync again after the specified time diff --git a/k8-operator/internal/services/infisicalsecret/handler.go b/k8-operator/internal/services/infisicalsecret/handler.go index 5657d701d..7fa75581a 100644 --- a/k8-operator/internal/services/infisicalsecret/handler.go +++ b/k8-operator/internal/services/infisicalsecret/handler.go @@ -7,6 +7,7 @@ import ( "k8s.io/apimachinery/pkg/runtime" "k8s.io/apimachinery/pkg/types" "sigs.k8s.io/controller-runtime/pkg/client" + "sigs.k8s.io/controller-runtime/pkg/event" "github.com/Infisical/infisical/k8-operator/api/v1alpha1" "github.com/Infisical/infisical/k8-operator/internal/api" @@ -100,3 +101,22 @@ func (h *InfisicalSecretHandler) SetInfisicalAutoRedeploymentReady(ctx context.C } reconciler.SetInfisicalAutoRedeploymentReady(ctx, logger, infisicalSecret, numDeployments, errorToConditionOn) } + +func (h *InfisicalSecretHandler) CloseInstantUpdatesStream(ctx context.Context, logger logr.Logger, infisicalSecret *v1alpha1.InfisicalSecret, resourceVariablesMap map[string]util.ResourceVariables) error { + reconciler := &InfisicalSecretReconciler{ + Client: h.Client, + Scheme: h.Scheme, + IsNamespaceScoped: h.IsNamespaceScoped, + } + return reconciler.CloseInstantUpdatesStream(ctx, logger, infisicalSecret, resourceVariablesMap) +} + +// Ensures that SSE stream is open, incase if the stream is already opened - this is a noop +func (h *InfisicalSecretHandler) OpenInstantUpdatesStream(ctx context.Context, logger logr.Logger, infisicalSecret *v1alpha1.InfisicalSecret, resourceVariablesMap map[string]util.ResourceVariables, eventCh chan<- event.TypedGenericEvent[client.Object]) error { + reconciler := &InfisicalSecretReconciler{ + Client: h.Client, + Scheme: h.Scheme, + IsNamespaceScoped: h.IsNamespaceScoped, + } + return reconciler.OpenInstantUpdatesStream(ctx, logger, infisicalSecret, resourceVariablesMap, eventCh) +} diff --git a/k8-operator/internal/services/infisicalsecret/reconciler.go b/k8-operator/internal/services/infisicalsecret/reconciler.go index d93e010d4..c76a78bd2 100644 --- a/k8-operator/internal/services/infisicalsecret/reconciler.go +++ b/k8-operator/internal/services/infisicalsecret/reconciler.go @@ -36,9 +36,7 @@ const FINALIZER_NAME = "secrets.finalizers.infisical.com" type InfisicalSecretReconciler struct { client.Client - Scheme *runtime.Scheme - - SourceCh chan event.TypedGenericEvent[client.Object] + Scheme *runtime.Scheme IsNamespaceScoped bool } @@ -533,7 +531,33 @@ func (r *InfisicalSecretReconciler) ReconcileInfisicalSecret(ctx context.Context return secretsCount, nil } -func (r *InfisicalSecretReconciler) EnsureEventStream(ctx context.Context, logger logr.Logger, secret *v1alpha1.InfisicalSecret, variables util.ResourceVariables) error { +func (r *InfisicalSecretReconciler) CloseInstantUpdatesStream(ctx context.Context, logger logr.Logger, infisicalSecret *v1alpha1.InfisicalSecret, resourceVariablesMap map[string]util.ResourceVariables) error { + if infisicalSecret == nil { + return fmt.Errorf("infisicalSecret is nil") + } + + variables := r.getResourceVariables(*infisicalSecret, resourceVariablesMap) + + if !variables.AuthDetails.IsMachineIdentityAuth { + return fmt.Errorf("only machine identity is supported for subscriptions") + } + + conn := variables.ServerSentEvents + + if _, ok := conn.Get(); ok { + conn.Close() + } + + return nil +} + +func (r *InfisicalSecretReconciler) OpenInstantUpdatesStream(ctx context.Context, logger logr.Logger, infisicalSecret *v1alpha1.InfisicalSecret, resourceVariablesMap map[string]util.ResourceVariables, eventCh chan<- event.TypedGenericEvent[client.Object]) error { + if infisicalSecret == nil { + return fmt.Errorf("infisicalSecret is nil") + } + + variables := r.getResourceVariables(*infisicalSecret, resourceVariablesMap) + if !variables.AuthDetails.IsMachineIdentityAuth { return fmt.Errorf("only machine identity is supported for subscriptions") } @@ -613,8 +637,8 @@ func (r *InfisicalSecretReconciler) EnsureEventStream(ctx context.Context, logge select { case ev := <-events: logger.Info("Received SSE Event", "event", ev) - r.SourceCh <- event.TypedGenericEvent[client.Object]{ - Object: secret, + eventCh <- event.TypedGenericEvent[client.Object]{ + Object: infisicalSecret, } case err := <-errors: logger.Error(err, "Error occurred") @@ -627,17 +651,3 @@ func (r *InfisicalSecretReconciler) EnsureEventStream(ctx context.Context, logge return nil } - -func (r *InfisicalSecretReconciler) CloseEventStream(ctx context.Context, logger logr.Logger, variables util.ResourceVariables) error { - if !variables.AuthDetails.IsMachineIdentityAuth { - return fmt.Errorf("only machine identity is supported for subscriptions") - } - - conn := variables.ServerSentEvents - - if _, ok := conn.Get(); ok { - conn.Close() - } - - return nil -} diff --git a/k8-operator/internal/util/models.go b/k8-operator/internal/util/models.go index 16de4608d..e583858fa 100644 --- a/k8-operator/internal/util/models.go +++ b/k8-operator/internal/util/models.go @@ -3,7 +3,7 @@ package util import ( "context" - "github.com/Infisical/infisical/k8-operator/packages/util/sse" + "github.com/Infisical/infisical/k8-operator/internal/util/sse" infisicalSdk "github.com/infisical/go-sdk" )