awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(k8-operator): improvements for dynamic secrets

Browse Source
This commit is contained in:
Daniel Hougaard
2024-12-09 00:22:22 +04:00
parent 74df374998
commit a757ea22a1
4 changed files with 50 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
k8-operator/config/samples/crd/infisicaldynamicsecret/dynamicSecret.yaml Normal file
View File

@@ -0,0 +1,27 @@
apiVersion: secrets.infisical.com/v1alpha1
kind: InfisicalDynamicSecret
metadata:
name: infisicaldynamicsecret-demo
spec:
hostAPI: https://app.infisical.com/api
dynamicSecret:
secretName: <dynamic-secret-name>
projectId: <project-id>
secretsPath: <secret-path>
environmentSlug: <env-slug>
leaseRevocationPolicy: Revoke # Revoke or None. Revoke will revoke leases created by the operator if the CRD is deleted.
leaseTTL: 1m # TTL for the leases created. Must be below 24 hours.
# Reference to the secret that you want to store the lease credentials in. If a secret with the name specified name does not exist, it will automatically be created.
managedSecretReference:
secretName: lease
secretNamespace: default
creationPolicy: Orphan # Orphan or Owner
authentication:
universalAuth:
credentialsRef:
secretName: universal-auth-credentials # universal-auth-credentials
secretNamespace: default # default

0
k8-operator/config/samples/sample.yaml → k8-operator/config/samples/crd/infisicalsecret/infisicalSecretCrd.yaml
View File

2
k8-operator/controllers/infisicaldynamicsecret/infisicaldynamicsecret_controller.go
View File

@@ -132,7 +132,7 @@ func (r *InfisicalDynamicSecretReconciler) Reconcile(ctx context.Context, req ct
api.API_CA_CERTIFICATE = ""
}
nextReconcile, err := r.ReconcileInfisicalDynamicSecret(ctx, logger, infisicalDynamicSecretCRD)
nextReconcile, err := r.ReconcileInfisicalDynamicSecret(ctx, logger, &infisicalDynamicSecretCRD)
r.SetReconcileStatus(ctx, logger, &infisicalDynamicSecretCRD, err)
if err == nil && nextReconcile.Seconds() >= 5 {

44
k8-operator/controllers/infisicaldynamicsecret/infisicaldynamicsecret_helper.go
View File

@@ -207,10 +207,6 @@ func (r *InfisicalDynamicSecretReconciler) CreateDynamicSecretLease(ctx context.
return fmt.Errorf("unable to update destination secret [err=%s]", err)
}
if err := r.Client.Status().Update(ctx, infisicalDynamicSecret); err != nil {
return fmt.Errorf("unable to update InfisicalDynamicSecret status [err=%s]", err)
}
logger.Info(fmt.Sprintf("New lease successfully created [leaseId=%s]", lease.Id))
return nil
}
@@ -320,9 +316,9 @@ func (r *InfisicalDynamicSecretReconciler) HandleLeaseRevocation(ctx context.Con
return nil
}
func (r *InfisicalDynamicSecretReconciler) ReconcileInfisicalDynamicSecret(ctx context.Context, logger logr.Logger, infisicalDynamicSecret v1alpha1.InfisicalDynamicSecret) (time.Duration, error) {
func (r *InfisicalDynamicSecretReconciler) ReconcileInfisicalDynamicSecret(ctx context.Context, logger logr.Logger, infisicalDynamicSecret *v1alpha1.InfisicalDynamicSecret) (time.Duration, error) {
resourceVariables := r.getResourceVariables(infisicalDynamicSecret)
resourceVariables := r.getResourceVariables(*infisicalDynamicSecret)
infisicalClient := resourceVariables.InfisicalClient
cancelCtx := resourceVariables.CancelCtx
authDetails := resourceVariables.AuthDetails
@@ -334,14 +330,14 @@ func (r *InfisicalDynamicSecretReconciler) ReconcileInfisicalDynamicSecret(ctx c
if authDetails.AuthStrategy == "" {
logger.Info("No authentication strategy found. Attempting to authenticate")
authDetails, err = r.handleAuthentication(ctx, infisicalDynamicSecret, infisicalClient)
r.SetAuthenticatedStatus(ctx, logger, &infisicalDynamicSecret, err)
authDetails, err = r.handleAuthentication(ctx, *infisicalDynamicSecret, infisicalClient)
r.SetAuthenticatedStatus(ctx, logger, infisicalDynamicSecret, err)
if err != nil {
return nextReconcile, fmt.Errorf("unable to authenticate [err=%s]", err)
}
r.updateResourceVariables(infisicalDynamicSecret, util.ResourceVariables{
r.updateResourceVariables(*infisicalDynamicSecret, util.ResourceVariables{
InfisicalClient: infisicalClient,
CancelCtx: cancelCtx,
AuthDetails: authDetails,
@@ -358,7 +354,7 @@ func (r *InfisicalDynamicSecretReconciler) ReconcileInfisicalDynamicSecret(ctx c
if infisicalDynamicSecret.Status.Lease != nil {
annotationValue = fmt.Sprintf("%s-%d", infisicalDynamicSecret.Status.Lease.ID, infisicalDynamicSecret.Status.Lease.Version)
}
r.createInfisicalManagedKubeSecret(ctx, logger, infisicalDynamicSecret, annotationValue)
r.createInfisicalManagedKubeSecret(ctx, logger, *infisicalDynamicSecret, annotationValue)
}
if err != nil {
@@ -370,8 +366,8 @@ func (r *InfisicalDynamicSecretReconciler) ReconcileInfisicalDynamicSecret(ctx c
}
if infisicalDynamicSecret.Status.Lease == nil {
err := r.CreateDynamicSecretLease(ctx, logger, infisicalClient, &infisicalDynamicSecret, destination)
r.SetCreatedLeaseStatus(ctx, logger, &infisicalDynamicSecret, err)
err := r.CreateDynamicSecretLease(ctx, logger, infisicalClient, infisicalDynamicSecret, destination)
r.SetCreatedLeaseStatus(ctx, logger, infisicalDynamicSecret, err)
return defaultNextReconcile, err // Short requeue after creation
} else {
@@ -381,8 +377,8 @@ func (r *InfisicalDynamicSecretReconciler) ReconcileInfisicalDynamicSecret(ctx c
// Calculate from creation to expiration
originalLeaseDuration := leaseExpiresAt.Sub(infisicalDynamicSecret.Status.Lease.CreationTimestamp.Time)
// 30% of the original duration (if the TTL has 30% or less of its time left, renew)
renewalThreshold := originalLeaseDuration * 30 / 100
// 30% of the original duration (if the TTL has 50% or less of its time left, renew)
renewalThreshold := originalLeaseDuration * 50 / 100
timeUntilExpiration := time.Until(leaseExpiresAt)
nextReconcile = timeUntilExpiration / 2
@@ -407,8 +403,8 @@ func (r *InfisicalDynamicSecretReconciler) ReconcileInfisicalDynamicSecret(ctx c
timeUntilMaxTTL,
maxTTLThreshold))
err := r.CreateDynamicSecretLease(ctx, logger, infisicalClient, &infisicalDynamicSecret, destination)
r.SetCreatedLeaseStatus(ctx, logger, &infisicalDynamicSecret, err)
err := r.CreateDynamicSecretLease(ctx, logger, infisicalClient, infisicalDynamicSecret, destination)
r.SetCreatedLeaseStatus(ctx, logger, infisicalDynamicSecret, err)
return defaultNextReconcile, err // Short requeue after creation
}
}
@@ -416,8 +412,8 @@ func (r *InfisicalDynamicSecretReconciler) ReconcileInfisicalDynamicSecret(ctx c
// Fail-safe: If the lease has expired we create a new dynamic secret directly.
if now.After(leaseExpiresAt) {
logger.Info("Lease has expired, creating new lease...")
err = r.CreateDynamicSecretLease(ctx, logger, infisicalClient, &infisicalDynamicSecret, destination)
r.SetCreatedLeaseStatus(ctx, logger, &infisicalDynamicSecret, err)
err = r.CreateDynamicSecretLease(ctx, logger, infisicalClient, infisicalDynamicSecret, destination)
r.SetCreatedLeaseStatus(ctx, logger, infisicalDynamicSecret, err)
return defaultNextReconcile, err // Short requeue after creation
}
@@ -427,13 +423,13 @@ func (r *InfisicalDynamicSecretReconciler) ReconcileInfisicalDynamicSecret(ctx c
timeUntilExpiration,
renewalThreshold))
err = r.RenewDynamicSecretLease(ctx, logger, infisicalClient, &infisicalDynamicSecret, destination)
r.SetLeaseRenewalStatus(ctx, logger, &infisicalDynamicSecret, err)
err = r.RenewDynamicSecretLease(ctx, logger, infisicalClient, infisicalDynamicSecret, destination)
r.SetLeaseRenewalStatus(ctx, logger, infisicalDynamicSecret, err)
if err == constants.ErrInvalidLease {
logger.Info("Failed to renew expired lease, creating new lease...")
err = r.CreateDynamicSecretLease(ctx, logger, infisicalClient, &infisicalDynamicSecret, destination)
r.SetCreatedLeaseStatus(ctx, logger, &infisicalDynamicSecret, err)
err = r.CreateDynamicSecretLease(ctx, logger, infisicalClient, infisicalDynamicSecret, destination)
r.SetCreatedLeaseStatus(ctx, logger, infisicalDynamicSecret, err)
}
return defaultNextReconcile, err // Short requeue after renewal/creation
@@ -451,5 +447,9 @@ func (r *InfisicalDynamicSecretReconciler) ReconcileInfisicalDynamicSecret(ctx c
nextReconcile = max(5*time.Second, min(nextReconcile, 5*time.Minute))
}
if err := r.Client.Status().Update(ctx, infisicalDynamicSecret); err != nil {
return nextReconcile, fmt.Errorf("unable to update InfisicalDynamicSecret status [err=%s]", err)
}
return nextReconcile, nil
}