fix: v4 changes

k8-operator/config/samples/crd/infisicalsecret/infisicalSecretCrd.yaml

@@ -7,7 +7,7 @@ metadata:
   annotations:
     example.com/annotation-to-be-passed-to-managed-secret: "sample-value"
 spec:
-  hostAPI: http://localhost:8080/api
+  hostAPI: http://localhost:8085/api
   resyncInterval: 10
   instantUpdates: true
   # tls:
@@ -32,7 +32,7 @@ spec:
     # Universal Auth
     universalAuth:
       secretsScope:
-        projectSlug: <your-project-slug>
+        projectSlug: test-j7-kx
         envSlug: dev # "dev", "staging", "prod", etc..
         secretsPath: "/" # Root is "/"
         recursive: true # Wether or not to use recursive mode (Fetches all secrets in an environment from a given secret path, and all folders inside the path) / defaults to false

k8-operator/config/samples/k8s-auth/sample.yaml

@@ -1,32 +1,28 @@
 apiVersion: secrets.infisical.com/v1alpha1
 kind: InfisicalSecret
 metadata:
-    name: infisicalsecret-sample
-    labels:
-        label-to-be-passed-to-managed-secret: sample-value
-    annotations:
-        example.com/annotation-to-be-passed-to-managed-secret: "sample-value"
+  name: infisicalsecret-sample
+  labels:
+    label-to-be-passed-to-managed-secret: sample-value
+  annotations:
+    example.com/annotation-to-be-passed-to-managed-secret: "sample-value"
 spec:
-    hostAPI: http://localhost:8085/api
-    resyncInterval: 10
-    authentication:
-        # Native Kubernetes Auth
-        kubernetesAuth:
-            identityId: 25d05878-0a2f-47c5-b889-46b70fb2dbfc
-            serviceAccountRef:
-              name: infisical-auth
-              namespace: default
-
-            # secretsScope is identical to the secrets scope in the universalAuth field in this sample.
-            secretsScope:
-                projectSlug: test-j7-kx
-                envSlug: dev
-                secretsPath: "/"
-                recursive: true
-
-
-    managedSecretReference:
-        secretName: managed-secret-k8s
+  hostAPI: http://localhost:8085/api
+  resyncInterval: 10
+  authentication:
+    # Universal Auth
+    universalAuth:
+      secretsScope:
+        projectSlug: test-j7-kx
+        envSlug: dev # "dev", "staging", "prod", etc..
+        secretsPath: "/" # Root is "/"
+        recursive: true # Wether or not to use recursive mode (Fetches all secrets in an environment from a given secret path, and all folders inside the path) / defaults to false
+      credentialsRef:
+        secretName: universal-auth-credentials
         secretNamespace: default
-        creationPolicy: "Orphan" ## Owner | Orphan
-        # secretType: kubernetes.io/dockerconfigjson
+
+  managedSecretReference:
+    secretName: managed-secret-k8s
+    secretNamespace: default
+    creationPolicy: "Orphan" ## Owner | Orphan
+    # secretType: kubernetes.io/dockerconfigjson

k8-operator/config/samples/universalAuthIdentitySecret.yaml

@@ -4,5 +4,5 @@ metadata:
   name: universal-auth-credentials
 type: Opaque
 stringData:
-    clientId: <your-client-id>
-    clientSecret: <your-client-secret>
+    clientId: 86c17800-00b9-4556-89a8-ea11ac6f8371
+    clientSecret: c5bc415b2fe4d40d9d7560bcf3f78cbf65edacc618d293503df1b6f175467933

k8-operator/internal/api/api.go

@@ -3,7 +3,7 @@ package api
 import (
 	"fmt"
 
-	"github.com/Infisical/infisical/k8-operator/packages/model"
+	"github.com/Infisical/infisical/k8-operator/internal/model"
 	"github.com/go-resty/resty/v2"
 )
 

k8-operator/internal/controller/infisicalsecret_controller.go

@@ -203,14 +203,14 @@ func (r *InfisicalSecretReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 	if infisicalSecretCRD.Spec.InstantUpdates {
 		logger.Info("Instant updates are enabled")
 
-		if err := r.EnsureEventStream(ctx, logger, &infisicalSecretCRD); err != nil {
+		if err := handler.OpenInstantUpdatesStream(ctx, logger, &infisicalSecretCRD, infisicalSecretResourceVariablesMap, r.SourceCh); err != nil {
 			logger.Error(err, fmt.Sprintf("unable to ensure event stream. Will requeue after [requeueTime=%v]", requeueTime))
 			return ctrl.Result{
 				RequeueAfter: requeueTime,
 			}, nil
 		}
 	} else {
-		r.CloseEventStream(ctx, logger, &infisicalSecretCRD)
+		handler.CloseInstantUpdatesStream(ctx, logger, &infisicalSecretCRD, infisicalSecretResourceVariablesMap)
 	}
 
 	// Sync again after the specified time

k8-operator/internal/services/infisicalsecret/handler.go

@@ -7,6 +7,7 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/event"
 
 	"github.com/Infisical/infisical/k8-operator/api/v1alpha1"
 	"github.com/Infisical/infisical/k8-operator/internal/api"
@@ -100,3 +101,22 @@ func (h *InfisicalSecretHandler) SetInfisicalAutoRedeploymentReady(ctx context.C
 	}
 	reconciler.SetInfisicalAutoRedeploymentReady(ctx, logger, infisicalSecret, numDeployments, errorToConditionOn)
 }
+
+func (h *InfisicalSecretHandler) CloseInstantUpdatesStream(ctx context.Context, logger logr.Logger, infisicalSecret *v1alpha1.InfisicalSecret, resourceVariablesMap map[string]util.ResourceVariables) error {
+	reconciler := &InfisicalSecretReconciler{
+		Client:            h.Client,
+		Scheme:            h.Scheme,
+		IsNamespaceScoped: h.IsNamespaceScoped,
+	}
+	return reconciler.CloseInstantUpdatesStream(ctx, logger, infisicalSecret, resourceVariablesMap)
+}
+
+// Ensures that SSE stream is open, incase if the stream is already opened - this is a noop
+func (h *InfisicalSecretHandler) OpenInstantUpdatesStream(ctx context.Context, logger logr.Logger, infisicalSecret *v1alpha1.InfisicalSecret, resourceVariablesMap map[string]util.ResourceVariables, eventCh chan<- event.TypedGenericEvent[client.Object]) error {
+	reconciler := &InfisicalSecretReconciler{
+		Client:            h.Client,
+		Scheme:            h.Scheme,
+		IsNamespaceScoped: h.IsNamespaceScoped,
+	}
+	return reconciler.OpenInstantUpdatesStream(ctx, logger, infisicalSecret, resourceVariablesMap, eventCh)
+}

k8-operator/internal/services/infisicalsecret/reconciler.go

@@ -36,9 +36,7 @@ const FINALIZER_NAME = "secrets.finalizers.infisical.com"
 
 type InfisicalSecretReconciler struct {
 	client.Client
-	Scheme *runtime.Scheme
-
-	SourceCh          chan event.TypedGenericEvent[client.Object]
+	Scheme            *runtime.Scheme
 	IsNamespaceScoped bool
 }
 
@@ -533,7 +531,33 @@ func (r *InfisicalSecretReconciler) ReconcileInfisicalSecret(ctx context.Context
 	return secretsCount, nil
 }
 
-func (r *InfisicalSecretReconciler) EnsureEventStream(ctx context.Context, logger logr.Logger, secret *v1alpha1.InfisicalSecret, variables util.ResourceVariables) error {
+func (r *InfisicalSecretReconciler) CloseInstantUpdatesStream(ctx context.Context, logger logr.Logger, infisicalSecret *v1alpha1.InfisicalSecret, resourceVariablesMap map[string]util.ResourceVariables) error {
+	if infisicalSecret == nil {
+		return fmt.Errorf("infisicalSecret is nil")
+	}
+
+	variables := r.getResourceVariables(*infisicalSecret, resourceVariablesMap)
+
+	if !variables.AuthDetails.IsMachineIdentityAuth {
+		return fmt.Errorf("only machine identity is supported for subscriptions")
+	}
+
+	conn := variables.ServerSentEvents
+
+	if _, ok := conn.Get(); ok {
+		conn.Close()
+	}
+
+	return nil
+}
+
+func (r *InfisicalSecretReconciler) OpenInstantUpdatesStream(ctx context.Context, logger logr.Logger, infisicalSecret *v1alpha1.InfisicalSecret, resourceVariablesMap map[string]util.ResourceVariables, eventCh chan<- event.TypedGenericEvent[client.Object]) error {
+	if infisicalSecret == nil {
+		return fmt.Errorf("infisicalSecret is nil")
+	}
+
+	variables := r.getResourceVariables(*infisicalSecret, resourceVariablesMap)
+
 	if !variables.AuthDetails.IsMachineIdentityAuth {
 		return fmt.Errorf("only machine identity is supported for subscriptions")
 	}
@@ -613,8 +637,8 @@ func (r *InfisicalSecretReconciler) EnsureEventStream(ctx context.Context, logge
 			select {
 			case ev := <-events:
 				logger.Info("Received SSE Event", "event", ev)
-				r.SourceCh <- event.TypedGenericEvent[client.Object]{
-					Object: secret,
+				eventCh <- event.TypedGenericEvent[client.Object]{
+					Object: infisicalSecret,
 				}
 			case err := <-errors:
 				logger.Error(err, "Error occurred")
@@ -627,17 +651,3 @@ func (r *InfisicalSecretReconciler) EnsureEventStream(ctx context.Context, logge
 
 	return nil
 }
-
-func (r *InfisicalSecretReconciler) CloseEventStream(ctx context.Context, logger logr.Logger, variables util.ResourceVariables) error {
-	if !variables.AuthDetails.IsMachineIdentityAuth {
-		return fmt.Errorf("only machine identity is supported for subscriptions")
-	}
-
-	conn := variables.ServerSentEvents
-
-	if _, ok := conn.Get(); ok {
-		conn.Close()
-	}
-
-	return nil
-}

k8-operator/internal/util/models.go

@@ -3,7 +3,7 @@ package util
 import (
 	"context"
 
-	"github.com/Infisical/infisical/k8-operator/packages/util/sse"
+	"github.com/Infisical/infisical/k8-operator/internal/util/sse"
 	infisicalSdk "github.com/infisical/go-sdk"
 )