From dda6b1d23323d0b0cfa5d072fdfc46cacd29aebd Mon Sep 17 00:00:00 2001 From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com> Date: Tue, 18 Jun 2024 20:15:22 +0200 Subject: [PATCH 1/5] Update infisicalsecret_controller.go --- .../controllers/infisicalsecret_controller.go | 41 ++++++++++++++++++- 1 file changed, 40 insertions(+), 1 deletion(-) diff --git a/k8-operator/controllers/infisicalsecret_controller.go b/k8-operator/controllers/infisicalsecret_controller.go index 2078341d8..2f463b3bb 100644 --- a/k8-operator/controllers/infisicalsecret_controller.go +++ b/k8-operator/controllers/infisicalsecret_controller.go @@ -5,11 +5,17 @@ import ( "fmt" "time" + corev1 "k8s.io/api/core/v1" "k8s.io/apimachinery/pkg/api/errors" "k8s.io/apimachinery/pkg/runtime" ctrl "sigs.k8s.io/controller-runtime" + "sigs.k8s.io/controller-runtime/pkg/builder" "sigs.k8s.io/controller-runtime/pkg/client" controllerUtil "sigs.k8s.io/controller-runtime/pkg/controller/controllerutil" + "sigs.k8s.io/controller-runtime/pkg/event" + "sigs.k8s.io/controller-runtime/pkg/handler" + "sigs.k8s.io/controller-runtime/pkg/predicate" + "sigs.k8s.io/controller-runtime/pkg/source" secretsv1alpha1 "github.com/Infisical/infisical/k8-operator/api/v1alpha1" "github.com/Infisical/infisical/k8-operator/packages/api" @@ -154,9 +160,42 @@ func (r *InfisicalSecretReconciler) Reconcile(ctx context.Context, req ctrl.Requ }, nil } -// SetupWithManager sets up the controller with the Manager. func (r *InfisicalSecretReconciler) SetupWithManager(mgr ctrl.Manager) error { return ctrl.NewControllerManagedBy(mgr). For(&secretsv1alpha1.InfisicalSecret{}). + Watches( + &source.Kind{Type: &corev1.Secret{}}, + handler.EnqueueRequestsFromMapFunc(func(a client.Object) []ctrl.Request { + var requests []ctrl.Request + infisicalSecrets := &secretsv1alpha1.InfisicalSecretList{} + err := r.List(context.Background(), infisicalSecrets) + if err != nil { + fmt.Printf("unable to list Infisical Secrets from cluster because [err=%v]", err) + return requests + } + + for _, infisicalSecret := range infisicalSecrets.Items { + isManagedSecret := a.GetName() == infisicalSecret.Spec.ManagedSecretReference.SecretName && a.GetNamespace() == infisicalSecret.Spec.ManagedSecretReference.SecretNamespace + + // If a managed secret is deleted, we should re-reconcile the InfisicalSecret resource that the managed secret belongs to. + if isManagedSecret { + requests = append(requests, ctrl.Request{ + NamespacedName: client.ObjectKey{ + Namespace: infisicalSecret.Namespace, + Name: infisicalSecret.Name, + }, + }) + fmt.Printf("\nManaged secret deleted: [name=%v] [namespace=[%v]\n", a.GetName(), a.GetNamespace()) + } + } + + return requests + }), + builder.WithPredicates(predicate.Funcs{ + DeleteFunc: func(e event.DeleteEvent) bool { + return true + }, + }), + ). Complete(r) } From 577b432861323298a4e77f428feb324d6c3dd238 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com> Date: Tue, 18 Jun 2024 20:45:17 +0200 Subject: [PATCH 2/5] feat(k8-operator): reconcile when managed secret is deleted --- .../controllers/infisicalsecret_controller.go | 78 ++++++++++++------- 1 file changed, 52 insertions(+), 26 deletions(-) diff --git a/k8-operator/controllers/infisicalsecret_controller.go b/k8-operator/controllers/infisicalsecret_controller.go index 2f463b3bb..8c5141989 100644 --- a/k8-operator/controllers/infisicalsecret_controller.go +++ b/k8-operator/controllers/infisicalsecret_controller.go @@ -75,6 +75,31 @@ func (r *InfisicalSecretReconciler) handleFinalizer(ctx context.Context, infisic return nil } +func (r *InfisicalSecretReconciler) handleManagedSecretDeletion(a client.Object) []ctrl.Request { + var requests []ctrl.Request + infisicalSecrets := &secretsv1alpha1.InfisicalSecretList{} + err := r.List(context.Background(), infisicalSecrets) + if err != nil { + fmt.Printf("unable to list Infisical Secrets from cluster because [err=%v]", err) + return requests + } + + for _, infisicalSecret := range infisicalSecrets.Items { + if a.GetName() == infisicalSecret.Spec.ManagedSecretReference.SecretName && + a.GetNamespace() == infisicalSecret.Spec.ManagedSecretReference.SecretNamespace { + requests = append(requests, ctrl.Request{ + NamespacedName: client.ObjectKey{ + Namespace: infisicalSecret.Namespace, + Name: infisicalSecret.Name, + }, + }) + fmt.Printf("\nManaged secret deleted in resource %s: [name=%v] [namespace=%v]\n", infisicalSecret.Name, a.GetName(), a.GetNamespace()) + } + } + + return requests +} + func (r *InfisicalSecretReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) { var infisicalSecretCR secretsv1alpha1.InfisicalSecret requeueTime := time.Minute // seconds @@ -165,33 +190,9 @@ func (r *InfisicalSecretReconciler) SetupWithManager(mgr ctrl.Manager) error { For(&secretsv1alpha1.InfisicalSecret{}). Watches( &source.Kind{Type: &corev1.Secret{}}, - handler.EnqueueRequestsFromMapFunc(func(a client.Object) []ctrl.Request { - var requests []ctrl.Request - infisicalSecrets := &secretsv1alpha1.InfisicalSecretList{} - err := r.List(context.Background(), infisicalSecrets) - if err != nil { - fmt.Printf("unable to list Infisical Secrets from cluster because [err=%v]", err) - return requests - } - - for _, infisicalSecret := range infisicalSecrets.Items { - isManagedSecret := a.GetName() == infisicalSecret.Spec.ManagedSecretReference.SecretName && a.GetNamespace() == infisicalSecret.Spec.ManagedSecretReference.SecretNamespace - - // If a managed secret is deleted, we should re-reconcile the InfisicalSecret resource that the managed secret belongs to. - if isManagedSecret { - requests = append(requests, ctrl.Request{ - NamespacedName: client.ObjectKey{ - Namespace: infisicalSecret.Namespace, - Name: infisicalSecret.Name, - }, - }) - fmt.Printf("\nManaged secret deleted: [name=%v] [namespace=[%v]\n", a.GetName(), a.GetNamespace()) - } - } - - return requests - }), + handler.EnqueueRequestsFromMapFunc(r.handleManagedSecretDeletion), builder.WithPredicates(predicate.Funcs{ + // Always return true to ensure we process all delete events DeleteFunc: func(e event.DeleteEvent) bool { return true }, @@ -199,3 +200,28 @@ func (r *InfisicalSecretReconciler) SetupWithManager(mgr ctrl.Manager) error { ). Complete(r) } + +func (r *InfisicalSecretReconciler) HandleManagedSecretDeletion(a client.Object) []ctrl.Request { + var requests []ctrl.Request + infisicalSecrets := &secretsv1alpha1.InfisicalSecretList{} + err := r.List(context.Background(), infisicalSecrets) + if err != nil { + fmt.Printf("unable to list Infisical Secrets from cluster because [err=%v]", err) + return requests + } + + for _, infisicalSecret := range infisicalSecrets.Items { + if a.GetName() == infisicalSecret.Spec.ManagedSecretReference.SecretName && + a.GetNamespace() == infisicalSecret.Spec.ManagedSecretReference.SecretNamespace { + requests = append(requests, ctrl.Request{ + NamespacedName: client.ObjectKey{ + Namespace: infisicalSecret.Namespace, + Name: infisicalSecret.Name, + }, + }) + fmt.Printf("\nManaged secret deleted in resource %s: [name=%v] [namespace=%v]\n", infisicalSecret.Name, a.GetName(), a.GetNamespace()) + } + } + + return requests +} From 467e3aab5616fd4890716cef6aa463cab8ec80ed Mon Sep 17 00:00:00 2001 From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com> Date: Tue, 18 Jun 2024 20:50:14 +0200 Subject: [PATCH 3/5] Update infisicalsecret_controller.go --- .../controllers/infisicalsecret_controller.go | 25 ------------------- 1 file changed, 25 deletions(-) diff --git a/k8-operator/controllers/infisicalsecret_controller.go b/k8-operator/controllers/infisicalsecret_controller.go index 8c5141989..a56e650da 100644 --- a/k8-operator/controllers/infisicalsecret_controller.go +++ b/k8-operator/controllers/infisicalsecret_controller.go @@ -200,28 +200,3 @@ func (r *InfisicalSecretReconciler) SetupWithManager(mgr ctrl.Manager) error { ). Complete(r) } - -func (r *InfisicalSecretReconciler) HandleManagedSecretDeletion(a client.Object) []ctrl.Request { - var requests []ctrl.Request - infisicalSecrets := &secretsv1alpha1.InfisicalSecretList{} - err := r.List(context.Background(), infisicalSecrets) - if err != nil { - fmt.Printf("unable to list Infisical Secrets from cluster because [err=%v]", err) - return requests - } - - for _, infisicalSecret := range infisicalSecrets.Items { - if a.GetName() == infisicalSecret.Spec.ManagedSecretReference.SecretName && - a.GetNamespace() == infisicalSecret.Spec.ManagedSecretReference.SecretNamespace { - requests = append(requests, ctrl.Request{ - NamespacedName: client.ObjectKey{ - Namespace: infisicalSecret.Namespace, - Name: infisicalSecret.Name, - }, - }) - fmt.Printf("\nManaged secret deleted in resource %s: [name=%v] [namespace=%v]\n", infisicalSecret.Name, a.GetName(), a.GetNamespace()) - } - } - - return requests -} From 27d5d90d026147789e0922e4cbf5d79136ebcfcb Mon Sep 17 00:00:00 2001 From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com> Date: Wed, 19 Jun 2024 15:00:51 +0200 Subject: [PATCH 4/5] Update infisicalsecret_controller.go --- k8-operator/controllers/infisicalsecret_controller.go | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/k8-operator/controllers/infisicalsecret_controller.go b/k8-operator/controllers/infisicalsecret_controller.go index a56e650da..788888101 100644 --- a/k8-operator/controllers/infisicalsecret_controller.go +++ b/k8-operator/controllers/infisicalsecret_controller.go @@ -75,7 +75,7 @@ func (r *InfisicalSecretReconciler) handleFinalizer(ctx context.Context, infisic return nil } -func (r *InfisicalSecretReconciler) handleManagedSecretDeletion(a client.Object) []ctrl.Request { +func (r *InfisicalSecretReconciler) handleManagedSecretDeletion(secret client.Object) []ctrl.Request { var requests []ctrl.Request infisicalSecrets := &secretsv1alpha1.InfisicalSecretList{} err := r.List(context.Background(), infisicalSecrets) @@ -85,15 +85,15 @@ func (r *InfisicalSecretReconciler) handleManagedSecretDeletion(a client.Object) } for _, infisicalSecret := range infisicalSecrets.Items { - if a.GetName() == infisicalSecret.Spec.ManagedSecretReference.SecretName && - a.GetNamespace() == infisicalSecret.Spec.ManagedSecretReference.SecretNamespace { + if secret.GetName() == infisicalSecret.Spec.ManagedSecretReference.SecretName && + secret.GetNamespace() == infisicalSecret.Spec.ManagedSecretReference.SecretNamespace { requests = append(requests, ctrl.Request{ NamespacedName: client.ObjectKey{ Namespace: infisicalSecret.Namespace, Name: infisicalSecret.Name, }, }) - fmt.Printf("\nManaged secret deleted in resource %s: [name=%v] [namespace=%v]\n", infisicalSecret.Name, a.GetName(), a.GetNamespace()) + fmt.Printf("\nManaged secret deleted in resource %s: [name=%v] [namespace=%v]\n", infisicalSecret.Name, secret.GetName(), secret.GetNamespace()) } } From d47c586a52819edbb234bb8cbc6548e63faadde3 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com> Date: Wed, 19 Jun 2024 15:26:06 +0200 Subject: [PATCH 5/5] Helm --- helm-charts/secrets-operator/Chart.yaml | 2 +- helm-charts/secrets-operator/values.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/helm-charts/secrets-operator/Chart.yaml b/helm-charts/secrets-operator/Chart.yaml index 28bc3403f..88fd68827 100644 --- a/helm-charts/secrets-operator/Chart.yaml +++ b/helm-charts/secrets-operator/Chart.yaml @@ -18,4 +18,4 @@ version: v0.6.1 # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. # It is recommended to use it with quotes. -appVersion: "v0.6.0" +appVersion: "v0.6.1" diff --git a/helm-charts/secrets-operator/values.yaml b/helm-charts/secrets-operator/values.yaml index 716cec7dc..001ef4b10 100644 --- a/helm-charts/secrets-operator/values.yaml +++ b/helm-charts/secrets-operator/values.yaml @@ -32,7 +32,7 @@ controllerManager: - ALL image: repository: infisical/kubernetes-operator - tag: v0.6.0 + tag: v0.6.1 resources: limits: cpu: 500m