awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-07 20:27:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(k8-operator): improvements for dynamic secrets

Browse Source
This commit is contained in:
Daniel Hougaard
2024-12-09 00:22:22 +04:00
parent 74df374998
commit a757ea22a1
4 changed files with 50 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
k8-operator/config/samples/crd/infisicaldynamicsecret/dynamicSecret.yaml
+27
View File
@@ -0,0 +1,27 @@
apiVersion: secrets.infisical.com/v1alpha1
kind: InfisicalDynamicSecret
metadata:
name: infisicaldynamicsecret-demo
spec:
hostAPI: https://app.infisical.com/api
dynamicSecret:
secretName: <dynamic-secret-name>
projectId: <project-id>
secretsPath: <secret-path>
environmentSlug: <env-slug>
leaseRevocationPolicy: Revoke # Revoke or None. Revoke will revoke leases created by the operator if the CRD is deleted.
leaseTTL: 1m # TTL for the leases created. Must be below 24 hours.
# Reference to the secret that you want to store the lease credentials in. If a secret with the name specified name does not exist, it will automatically be created.
managedSecretReference:
secretName: lease
secretNamespace: default
creationPolicy: Orphan # Orphan or Owner
authentication:
universalAuth:
credentialsRef:
secretName: universal-auth-credentials # universal-auth-credentials
secretNamespace: default # default
k8-operator/config/samples/sample.yaml → k8-operator/config/samples/crd/infisicalsecret/infisicalSecretCrd.yaml
View File
k8-operator/controllers/infisicaldynamicsecret/infisicaldynamicsecret_controller.go
+1 -1
View File
@@ -132,7 +132,7 @@ func (r *InfisicalDynamicSecretReconciler) Reconcile(ctx context.Context, req ct
api.API_CA_CERTIFICATE = "" api.API_CA_CERTIFICATE = ""
} }
nextReconcile, err := r.ReconcileInfisicalDynamicSecret(ctx, logger, infisicalDynamicSecretCRD) nextReconcile, err := r.ReconcileInfisicalDynamicSecret(ctx, logger, &infisicalDynamicSecretCRD)
r.SetReconcileStatus(ctx, logger, &infisicalDynamicSecretCRD, err) r.SetReconcileStatus(ctx, logger, &infisicalDynamicSecretCRD, err)
if err == nil && nextReconcile.Seconds() >= 5 { if err == nil && nextReconcile.Seconds() >= 5 {
k8-operator/controllers/infisicaldynamicsecret/infisicaldynamicsecret_helper.go
+22 -22
View File
@@ -207,10 +207,6 @@ func (r *InfisicalDynamicSecretReconciler) CreateDynamicSecretLease(ctx context.
return fmt.Errorf("unable to update destination secret [err=%s]", err) return fmt.Errorf("unable to update destination secret [err=%s]", err)
} }
if err := r.Client.Status().Update(ctx, infisicalDynamicSecret); err != nil {
return fmt.Errorf("unable to update InfisicalDynamicSecret status [err=%s]", err)
}
logger.Info(fmt.Sprintf("New lease successfully created [leaseId=%s]", lease.Id)) logger.Info(fmt.Sprintf("New lease successfully created [leaseId=%s]", lease.Id))
return nil return nil
} }
@@ -320,9 +316,9 @@ func (r *InfisicalDynamicSecretReconciler) HandleLeaseRevocation(ctx context.Con
return nil return nil
} }
func (r *InfisicalDynamicSecretReconciler) ReconcileInfisicalDynamicSecret(ctx context.Context, logger logr.Logger, infisicalDynamicSecret v1alpha1.InfisicalDynamicSecret) (time.Duration, error) { func (r *InfisicalDynamicSecretReconciler) ReconcileInfisicalDynamicSecret(ctx context.Context, logger logr.Logger, infisicalDynamicSecret *v1alpha1.InfisicalDynamicSecret) (time.Duration, error) {
resourceVariables := r.getResourceVariables(infisicalDynamicSecret) resourceVariables := r.getResourceVariables(*infisicalDynamicSecret)
infisicalClient := resourceVariables.InfisicalClient infisicalClient := resourceVariables.InfisicalClient
cancelCtx := resourceVariables.CancelCtx cancelCtx := resourceVariables.CancelCtx
authDetails := resourceVariables.AuthDetails authDetails := resourceVariables.AuthDetails
@@ -334,14 +330,14 @@ func (r *InfisicalDynamicSecretReconciler) ReconcileInfisicalDynamicSecret(ctx c
if authDetails.AuthStrategy == "" { if authDetails.AuthStrategy == "" {
logger.Info("No authentication strategy found. Attempting to authenticate") logger.Info("No authentication strategy found. Attempting to authenticate")
authDetails, err = r.handleAuthentication(ctx, infisicalDynamicSecret, infisicalClient) authDetails, err = r.handleAuthentication(ctx, *infisicalDynamicSecret, infisicalClient)
r.SetAuthenticatedStatus(ctx, logger, &infisicalDynamicSecret, err) r.SetAuthenticatedStatus(ctx, logger, infisicalDynamicSecret, err)
if err != nil { if err != nil {
return nextReconcile, fmt.Errorf("unable to authenticate [err=%s]", err) return nextReconcile, fmt.Errorf("unable to authenticate [err=%s]", err)
} }
r.updateResourceVariables(infisicalDynamicSecret, util.ResourceVariables{ r.updateResourceVariables(*infisicalDynamicSecret, util.ResourceVariables{
InfisicalClient: infisicalClient, InfisicalClient: infisicalClient,
CancelCtx: cancelCtx, CancelCtx: cancelCtx,
AuthDetails: authDetails, AuthDetails: authDetails,
@@ -358,7 +354,7 @@ func (r *InfisicalDynamicSecretReconciler) ReconcileInfisicalDynamicSecret(ctx c
if infisicalDynamicSecret.Status.Lease != nil { if infisicalDynamicSecret.Status.Lease != nil {
annotationValue = fmt.Sprintf("%s-%d", infisicalDynamicSecret.Status.Lease.ID, infisicalDynamicSecret.Status.Lease.Version) annotationValue = fmt.Sprintf("%s-%d", infisicalDynamicSecret.Status.Lease.ID, infisicalDynamicSecret.Status.Lease.Version)
} }
r.createInfisicalManagedKubeSecret(ctx, logger, infisicalDynamicSecret, annotationValue) r.createInfisicalManagedKubeSecret(ctx, logger, *infisicalDynamicSecret, annotationValue)
} }
if err != nil { if err != nil {
@@ -370,8 +366,8 @@ func (r *InfisicalDynamicSecretReconciler) ReconcileInfisicalDynamicSecret(ctx c
} }
if infisicalDynamicSecret.Status.Lease == nil { if infisicalDynamicSecret.Status.Lease == nil {
err := r.CreateDynamicSecretLease(ctx, logger, infisicalClient, &infisicalDynamicSecret, destination) err := r.CreateDynamicSecretLease(ctx, logger, infisicalClient, infisicalDynamicSecret, destination)
r.SetCreatedLeaseStatus(ctx, logger, &infisicalDynamicSecret, err) r.SetCreatedLeaseStatus(ctx, logger, infisicalDynamicSecret, err)
return defaultNextReconcile, err // Short requeue after creation return defaultNextReconcile, err // Short requeue after creation
} else { } else {
@@ -381,8 +377,8 @@ func (r *InfisicalDynamicSecretReconciler) ReconcileInfisicalDynamicSecret(ctx c
// Calculate from creation to expiration // Calculate from creation to expiration
originalLeaseDuration := leaseExpiresAt.Sub(infisicalDynamicSecret.Status.Lease.CreationTimestamp.Time) originalLeaseDuration := leaseExpiresAt.Sub(infisicalDynamicSecret.Status.Lease.CreationTimestamp.Time)
// 30% of the original duration (if the TTL has 30% or less of its time left, renew) // 30% of the original duration (if the TTL has 50% or less of its time left, renew)
renewalThreshold := originalLeaseDuration * 30 / 100 renewalThreshold := originalLeaseDuration * 50 / 100
timeUntilExpiration := time.Until(leaseExpiresAt) timeUntilExpiration := time.Until(leaseExpiresAt)
nextReconcile = timeUntilExpiration / 2 nextReconcile = timeUntilExpiration / 2
@@ -407,8 +403,8 @@ func (r *InfisicalDynamicSecretReconciler) ReconcileInfisicalDynamicSecret(ctx c
timeUntilMaxTTL, timeUntilMaxTTL,
maxTTLThreshold)) maxTTLThreshold))
err := r.CreateDynamicSecretLease(ctx, logger, infisicalClient, &infisicalDynamicSecret, destination) err := r.CreateDynamicSecretLease(ctx, logger, infisicalClient, infisicalDynamicSecret, destination)
r.SetCreatedLeaseStatus(ctx, logger, &infisicalDynamicSecret, err) r.SetCreatedLeaseStatus(ctx, logger, infisicalDynamicSecret, err)
return defaultNextReconcile, err // Short requeue after creation return defaultNextReconcile, err // Short requeue after creation
} }
} }
@@ -416,8 +412,8 @@ func (r *InfisicalDynamicSecretReconciler) ReconcileInfisicalDynamicSecret(ctx c
// Fail-safe: If the lease has expired we create a new dynamic secret directly. // Fail-safe: If the lease has expired we create a new dynamic secret directly.
if now.After(leaseExpiresAt) { if now.After(leaseExpiresAt) {
logger.Info("Lease has expired, creating new lease...") logger.Info("Lease has expired, creating new lease...")
err = r.CreateDynamicSecretLease(ctx, logger, infisicalClient, &infisicalDynamicSecret, destination) err = r.CreateDynamicSecretLease(ctx, logger, infisicalClient, infisicalDynamicSecret, destination)
r.SetCreatedLeaseStatus(ctx, logger, &infisicalDynamicSecret, err) r.SetCreatedLeaseStatus(ctx, logger, infisicalDynamicSecret, err)
return defaultNextReconcile, err // Short requeue after creation return defaultNextReconcile, err // Short requeue after creation
} }
@@ -427,13 +423,13 @@ func (r *InfisicalDynamicSecretReconciler) ReconcileInfisicalDynamicSecret(ctx c
timeUntilExpiration, timeUntilExpiration,
renewalThreshold)) renewalThreshold))
err = r.RenewDynamicSecretLease(ctx, logger, infisicalClient, &infisicalDynamicSecret, destination) err = r.RenewDynamicSecretLease(ctx, logger, infisicalClient, infisicalDynamicSecret, destination)
r.SetLeaseRenewalStatus(ctx, logger, &infisicalDynamicSecret, err) r.SetLeaseRenewalStatus(ctx, logger, infisicalDynamicSecret, err)
if err == constants.ErrInvalidLease { if err == constants.ErrInvalidLease {
logger.Info("Failed to renew expired lease, creating new lease...") logger.Info("Failed to renew expired lease, creating new lease...")
err = r.CreateDynamicSecretLease(ctx, logger, infisicalClient, &infisicalDynamicSecret, destination) err = r.CreateDynamicSecretLease(ctx, logger, infisicalClient, infisicalDynamicSecret, destination)
r.SetCreatedLeaseStatus(ctx, logger, &infisicalDynamicSecret, err) r.SetCreatedLeaseStatus(ctx, logger, infisicalDynamicSecret, err)
} }
return defaultNextReconcile, err // Short requeue after renewal/creation return defaultNextReconcile, err // Short requeue after renewal/creation
@@ -451,5 +447,9 @@ func (r *InfisicalDynamicSecretReconciler) ReconcileInfisicalDynamicSecret(ctx c
nextReconcile = max(5*time.Second, min(nextReconcile, 5*time.Minute)) nextReconcile = max(5*time.Second, min(nextReconcile, 5*time.Minute))
} }
if err := r.Client.Status().Update(ctx, infisicalDynamicSecret); err != nil {
return nextReconcile, fmt.Errorf("unable to update InfisicalDynamicSecret status [err=%s]", err)
}
return nextReconcile, nil return nextReconcile, nil
} }