diff --git a/k8-operator/config/samples/crd/infisicaldynamicsecret/dynamicSecret.yaml b/k8-operator/config/samples/crd/infisicaldynamicsecret/dynamicSecret.yaml new file mode 100644 index 000000000..b34259927 --- /dev/null +++ b/k8-operator/config/samples/crd/infisicaldynamicsecret/dynamicSecret.yaml @@ -0,0 +1,27 @@ +apiVersion: secrets.infisical.com/v1alpha1 +kind: InfisicalDynamicSecret +metadata: + name: infisicaldynamicsecret-demo +spec: + hostAPI: https://app.infisical.com/api + + dynamicSecret: + secretName: + projectId: + secretsPath: + environmentSlug: + + leaseRevocationPolicy: Revoke # Revoke or None. Revoke will revoke leases created by the operator if the CRD is deleted. + leaseTTL: 1m # TTL for the leases created. Must be below 24 hours. + + # Reference to the secret that you want to store the lease credentials in. If a secret with the name specified name does not exist, it will automatically be created. + managedSecretReference: + secretName: lease + secretNamespace: default + creationPolicy: Orphan # Orphan or Owner + + authentication: + universalAuth: + credentialsRef: + secretName: universal-auth-credentials # universal-auth-credentials + secretNamespace: default # default diff --git a/k8-operator/config/samples/sample.yaml b/k8-operator/config/samples/crd/infisicalsecret/infisicalSecretCrd.yaml similarity index 100% rename from k8-operator/config/samples/sample.yaml rename to k8-operator/config/samples/crd/infisicalsecret/infisicalSecretCrd.yaml diff --git a/k8-operator/controllers/infisicaldynamicsecret/infisicaldynamicsecret_controller.go b/k8-operator/controllers/infisicaldynamicsecret/infisicaldynamicsecret_controller.go index 9be907e96..468a0e799 100644 --- a/k8-operator/controllers/infisicaldynamicsecret/infisicaldynamicsecret_controller.go +++ b/k8-operator/controllers/infisicaldynamicsecret/infisicaldynamicsecret_controller.go @@ -132,7 +132,7 @@ func (r *InfisicalDynamicSecretReconciler) Reconcile(ctx context.Context, req ct api.API_CA_CERTIFICATE = "" } - nextReconcile, err := r.ReconcileInfisicalDynamicSecret(ctx, logger, infisicalDynamicSecretCRD) + nextReconcile, err := r.ReconcileInfisicalDynamicSecret(ctx, logger, &infisicalDynamicSecretCRD) r.SetReconcileStatus(ctx, logger, &infisicalDynamicSecretCRD, err) if err == nil && nextReconcile.Seconds() >= 5 { diff --git a/k8-operator/controllers/infisicaldynamicsecret/infisicaldynamicsecret_helper.go b/k8-operator/controllers/infisicaldynamicsecret/infisicaldynamicsecret_helper.go index f049d6883..c5d7a5a06 100644 --- a/k8-operator/controllers/infisicaldynamicsecret/infisicaldynamicsecret_helper.go +++ b/k8-operator/controllers/infisicaldynamicsecret/infisicaldynamicsecret_helper.go @@ -207,10 +207,6 @@ func (r *InfisicalDynamicSecretReconciler) CreateDynamicSecretLease(ctx context. return fmt.Errorf("unable to update destination secret [err=%s]", err) } - if err := r.Client.Status().Update(ctx, infisicalDynamicSecret); err != nil { - return fmt.Errorf("unable to update InfisicalDynamicSecret status [err=%s]", err) - } - logger.Info(fmt.Sprintf("New lease successfully created [leaseId=%s]", lease.Id)) return nil } @@ -320,9 +316,9 @@ func (r *InfisicalDynamicSecretReconciler) HandleLeaseRevocation(ctx context.Con return nil } -func (r *InfisicalDynamicSecretReconciler) ReconcileInfisicalDynamicSecret(ctx context.Context, logger logr.Logger, infisicalDynamicSecret v1alpha1.InfisicalDynamicSecret) (time.Duration, error) { +func (r *InfisicalDynamicSecretReconciler) ReconcileInfisicalDynamicSecret(ctx context.Context, logger logr.Logger, infisicalDynamicSecret *v1alpha1.InfisicalDynamicSecret) (time.Duration, error) { - resourceVariables := r.getResourceVariables(infisicalDynamicSecret) + resourceVariables := r.getResourceVariables(*infisicalDynamicSecret) infisicalClient := resourceVariables.InfisicalClient cancelCtx := resourceVariables.CancelCtx authDetails := resourceVariables.AuthDetails @@ -334,14 +330,14 @@ func (r *InfisicalDynamicSecretReconciler) ReconcileInfisicalDynamicSecret(ctx c if authDetails.AuthStrategy == "" { logger.Info("No authentication strategy found. Attempting to authenticate") - authDetails, err = r.handleAuthentication(ctx, infisicalDynamicSecret, infisicalClient) - r.SetAuthenticatedStatus(ctx, logger, &infisicalDynamicSecret, err) + authDetails, err = r.handleAuthentication(ctx, *infisicalDynamicSecret, infisicalClient) + r.SetAuthenticatedStatus(ctx, logger, infisicalDynamicSecret, err) if err != nil { return nextReconcile, fmt.Errorf("unable to authenticate [err=%s]", err) } - r.updateResourceVariables(infisicalDynamicSecret, util.ResourceVariables{ + r.updateResourceVariables(*infisicalDynamicSecret, util.ResourceVariables{ InfisicalClient: infisicalClient, CancelCtx: cancelCtx, AuthDetails: authDetails, @@ -358,7 +354,7 @@ func (r *InfisicalDynamicSecretReconciler) ReconcileInfisicalDynamicSecret(ctx c if infisicalDynamicSecret.Status.Lease != nil { annotationValue = fmt.Sprintf("%s-%d", infisicalDynamicSecret.Status.Lease.ID, infisicalDynamicSecret.Status.Lease.Version) } - r.createInfisicalManagedKubeSecret(ctx, logger, infisicalDynamicSecret, annotationValue) + r.createInfisicalManagedKubeSecret(ctx, logger, *infisicalDynamicSecret, annotationValue) } if err != nil { @@ -370,8 +366,8 @@ func (r *InfisicalDynamicSecretReconciler) ReconcileInfisicalDynamicSecret(ctx c } if infisicalDynamicSecret.Status.Lease == nil { - err := r.CreateDynamicSecretLease(ctx, logger, infisicalClient, &infisicalDynamicSecret, destination) - r.SetCreatedLeaseStatus(ctx, logger, &infisicalDynamicSecret, err) + err := r.CreateDynamicSecretLease(ctx, logger, infisicalClient, infisicalDynamicSecret, destination) + r.SetCreatedLeaseStatus(ctx, logger, infisicalDynamicSecret, err) return defaultNextReconcile, err // Short requeue after creation } else { @@ -381,8 +377,8 @@ func (r *InfisicalDynamicSecretReconciler) ReconcileInfisicalDynamicSecret(ctx c // Calculate from creation to expiration originalLeaseDuration := leaseExpiresAt.Sub(infisicalDynamicSecret.Status.Lease.CreationTimestamp.Time) - // 30% of the original duration (if the TTL has 30% or less of its time left, renew) - renewalThreshold := originalLeaseDuration * 30 / 100 + // 30% of the original duration (if the TTL has 50% or less of its time left, renew) + renewalThreshold := originalLeaseDuration * 50 / 100 timeUntilExpiration := time.Until(leaseExpiresAt) nextReconcile = timeUntilExpiration / 2 @@ -407,8 +403,8 @@ func (r *InfisicalDynamicSecretReconciler) ReconcileInfisicalDynamicSecret(ctx c timeUntilMaxTTL, maxTTLThreshold)) - err := r.CreateDynamicSecretLease(ctx, logger, infisicalClient, &infisicalDynamicSecret, destination) - r.SetCreatedLeaseStatus(ctx, logger, &infisicalDynamicSecret, err) + err := r.CreateDynamicSecretLease(ctx, logger, infisicalClient, infisicalDynamicSecret, destination) + r.SetCreatedLeaseStatus(ctx, logger, infisicalDynamicSecret, err) return defaultNextReconcile, err // Short requeue after creation } } @@ -416,8 +412,8 @@ func (r *InfisicalDynamicSecretReconciler) ReconcileInfisicalDynamicSecret(ctx c // Fail-safe: If the lease has expired we create a new dynamic secret directly. if now.After(leaseExpiresAt) { logger.Info("Lease has expired, creating new lease...") - err = r.CreateDynamicSecretLease(ctx, logger, infisicalClient, &infisicalDynamicSecret, destination) - r.SetCreatedLeaseStatus(ctx, logger, &infisicalDynamicSecret, err) + err = r.CreateDynamicSecretLease(ctx, logger, infisicalClient, infisicalDynamicSecret, destination) + r.SetCreatedLeaseStatus(ctx, logger, infisicalDynamicSecret, err) return defaultNextReconcile, err // Short requeue after creation } @@ -427,13 +423,13 @@ func (r *InfisicalDynamicSecretReconciler) ReconcileInfisicalDynamicSecret(ctx c timeUntilExpiration, renewalThreshold)) - err = r.RenewDynamicSecretLease(ctx, logger, infisicalClient, &infisicalDynamicSecret, destination) - r.SetLeaseRenewalStatus(ctx, logger, &infisicalDynamicSecret, err) + err = r.RenewDynamicSecretLease(ctx, logger, infisicalClient, infisicalDynamicSecret, destination) + r.SetLeaseRenewalStatus(ctx, logger, infisicalDynamicSecret, err) if err == constants.ErrInvalidLease { logger.Info("Failed to renew expired lease, creating new lease...") - err = r.CreateDynamicSecretLease(ctx, logger, infisicalClient, &infisicalDynamicSecret, destination) - r.SetCreatedLeaseStatus(ctx, logger, &infisicalDynamicSecret, err) + err = r.CreateDynamicSecretLease(ctx, logger, infisicalClient, infisicalDynamicSecret, destination) + r.SetCreatedLeaseStatus(ctx, logger, infisicalDynamicSecret, err) } return defaultNextReconcile, err // Short requeue after renewal/creation @@ -451,5 +447,9 @@ func (r *InfisicalDynamicSecretReconciler) ReconcileInfisicalDynamicSecret(ctx c nextReconcile = max(5*time.Second, min(nextReconcile, 5*time.Minute)) } + if err := r.Client.Status().Update(ctx, infisicalDynamicSecret); err != nil { + return nextReconcile, fmt.Errorf("unable to update InfisicalDynamicSecret status [err=%s]", err) + } + return nextReconcile, nil }