feat(k8-operator): push secrets

k8-operator/controllers/infisicalpushsecret/conditions.go

@@ -0,0 +1,155 @@
+package controllers
+
+import (
+	"context"
+
+	"github.com/Infisical/infisical/k8-operator/api/v1alpha1"
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func (r *InfisicalPushSecretReconciler) SetSuccessfullyReconciledConditions(ctx context.Context, infisicalPushSecret *v1alpha1.InfisicalPushSecret, err error) error {
+
+	if infisicalPushSecret.Status.Conditions == nil {
+		infisicalPushSecret.Status.Conditions = []metav1.Condition{}
+	}
+
+	if err != nil {
+		meta.SetStatusCondition(&infisicalPushSecret.Status.Conditions, metav1.Condition{
+			Type:    "secrets.infisical.com/SuccessfullyReconciled",
+			Status:  metav1.ConditionTrue,
+			Reason:  "Error",
+			Message: "Reconcile failed, secrets were not pushed to Infisical. Check operator logs for more info",
+		})
+	} else {
+		meta.SetStatusCondition(&infisicalPushSecret.Status.Conditions, metav1.Condition{
+			Type:    "secrets.infisical.com/SuccessfullyReconciled",
+			Status:  metav1.ConditionFalse,
+			Reason:  "OK",
+			Message: "Reconcile succeeded, secrets were pushed to Infisical",
+		})
+	}
+
+	return r.Client.Status().Update(ctx, infisicalPushSecret)
+
+}
+
+func (r *InfisicalPushSecretReconciler) SetFailedToReplaceSecretsConditions(ctx context.Context, infisicalPushSecret *v1alpha1.InfisicalPushSecret, failMessage string) error {
+	if infisicalPushSecret.Status.Conditions == nil {
+		infisicalPushSecret.Status.Conditions = []metav1.Condition{}
+	}
+
+	if failMessage != "" {
+		meta.SetStatusCondition(&infisicalPushSecret.Status.Conditions, metav1.Condition{
+			Type:    "secrets.infisical.com/FailedToReplaceSecrets",
+			Status:  metav1.ConditionTrue,
+			Reason:  "Error",
+			Message: failMessage,
+		})
+	} else {
+		meta.SetStatusCondition(&infisicalPushSecret.Status.Conditions, metav1.Condition{
+			Type:    "secrets.infisical.com/FailedToReplaceSecrets",
+			Status:  metav1.ConditionFalse,
+			Reason:  "OK",
+			Message: "No errors, no secrets failed to be replaced",
+		})
+	}
+
+	return r.Client.Status().Update(ctx, infisicalPushSecret)
+}
+
+func (r *InfisicalPushSecretReconciler) SetFailedToCreateSecretsConditions(ctx context.Context, infisicalPushSecret *v1alpha1.InfisicalPushSecret, failMessage string) error {
+	if infisicalPushSecret.Status.Conditions == nil {
+		infisicalPushSecret.Status.Conditions = []metav1.Condition{}
+	}
+
+	if failMessage != "" {
+		meta.SetStatusCondition(&infisicalPushSecret.Status.Conditions, metav1.Condition{
+			Type:    "secrets.infisical.com/FailedToCreateSecrets",
+			Status:  metav1.ConditionTrue,
+			Reason:  "Error",
+			Message: failMessage,
+		})
+	} else {
+		meta.SetStatusCondition(&infisicalPushSecret.Status.Conditions, metav1.Condition{
+			Type:    "secrets.infisical.com/FailedToCreateSecrets",
+			Status:  metav1.ConditionFalse,
+			Reason:  "OK",
+			Message: "No errors, no secrets failed to be created",
+		})
+	}
+
+	return r.Client.Status().Update(ctx, infisicalPushSecret)
+}
+
+func (r *InfisicalPushSecretReconciler) SetFailedToUpdateSecretsConditions(ctx context.Context, infisicalPushSecret *v1alpha1.InfisicalPushSecret, failMessage string) error {
+	if infisicalPushSecret.Status.Conditions == nil {
+		infisicalPushSecret.Status.Conditions = []metav1.Condition{}
+	}
+
+	if failMessage != "" {
+		meta.SetStatusCondition(&infisicalPushSecret.Status.Conditions, metav1.Condition{
+			Type:    "secrets.infisical.com/FailedToUpdateSecrets",
+			Status:  metav1.ConditionTrue,
+			Reason:  "Error",
+			Message: failMessage,
+		})
+	} else {
+		meta.SetStatusCondition(&infisicalPushSecret.Status.Conditions, metav1.Condition{
+			Type:    "secrets.infisical.com/FailedToUpdateSecrets",
+			Status:  metav1.ConditionFalse,
+			Reason:  "OK",
+			Message: "No errors, no secrets failed to be updated",
+		})
+	}
+
+	return r.Client.Status().Update(ctx, infisicalPushSecret)
+}
+
+func (r *InfisicalPushSecretReconciler) SetFailedToDeleteSecretsConditions(ctx context.Context, infisicalPushSecret *v1alpha1.InfisicalPushSecret, failMessage string) error {
+	if infisicalPushSecret.Status.Conditions == nil {
+		infisicalPushSecret.Status.Conditions = []metav1.Condition{}
+	}
+
+	if failMessage != "" {
+		meta.SetStatusCondition(&infisicalPushSecret.Status.Conditions, metav1.Condition{
+			Type:    "secrets.infisical.com/FailedToDeleteSecrets",
+			Status:  metav1.ConditionTrue,
+			Reason:  "Error",
+			Message: failMessage,
+		})
+	} else {
+		meta.SetStatusCondition(&infisicalPushSecret.Status.Conditions, metav1.Condition{
+			Type:    "secrets.infisical.com/FailedToDeleteSecrets",
+			Status:  metav1.ConditionFalse,
+			Reason:  "OK",
+			Message: "No errors, no secrets failed to be deleted",
+		})
+	}
+
+	return r.Client.Status().Update(ctx, infisicalPushSecret)
+}
+
+func (r *InfisicalPushSecretReconciler) SetAuthenticatedConditions(ctx context.Context, infisicalPushSecret *v1alpha1.InfisicalPushSecret, errorToConditionOn error) error {
+	if infisicalPushSecret.Status.Conditions == nil {
+		infisicalPushSecret.Status.Conditions = []metav1.Condition{}
+	}
+
+	if errorToConditionOn != nil {
+		meta.SetStatusCondition(&infisicalPushSecret.Status.Conditions, metav1.Condition{
+			Type:    "secrets.infisical.com/Authenticated",
+			Status:  metav1.ConditionFalse,
+			Reason:  "Error",
+			Message: "Failed to authenticate with Infisical API. This can be caused by invalid service token or an invalid API host that is set. Check operator logs for more info",
+		})
+	} else {
+		meta.SetStatusCondition(&infisicalPushSecret.Status.Conditions, metav1.Condition{
+			Type:    "secrets.infisical.com/Authenticated",
+			Status:  metav1.ConditionTrue,
+			Reason:  "OK",
+			Message: "Successfully authenticated with Infisical API",
+		})
+	}
+
+	return r.Client.Status().Update(ctx, infisicalPushSecret)
+}

k8-operator/controllers/infisicalpushsecret/infisicalpushsecret_controller.go

@@ -0,0 +1,233 @@
+package controllers
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/builder"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/event"
+	"sigs.k8s.io/controller-runtime/pkg/handler"
+	"sigs.k8s.io/controller-runtime/pkg/predicate"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+	"sigs.k8s.io/controller-runtime/pkg/source"
+
+	secretsv1alpha1 "github.com/Infisical/infisical/k8-operator/api/v1alpha1"
+	"github.com/Infisical/infisical/k8-operator/packages/api"
+	"github.com/Infisical/infisical/k8-operator/packages/constants"
+	controllerhelpers "github.com/Infisical/infisical/k8-operator/packages/controllerutil"
+	"github.com/Infisical/infisical/k8-operator/packages/util"
+	"github.com/go-logr/logr"
+)
+
+// InfisicalSecretReconciler reconciles a InfisicalSecret object
+type InfisicalPushSecretReconciler struct {
+	client.Client
+
+	BaseLogger logr.Logger
+	Scheme     *runtime.Scheme
+}
+
+var resourceVariablesMap map[string]util.ResourceVariables
+
+func (r *InfisicalPushSecretReconciler) GetLogger(req ctrl.Request) logr.Logger {
+	return r.BaseLogger.WithValues("infisicalpushsecret", req.NamespacedName)
+}
+
+//+kubebuilder:rbac:groups=secrets.infisical.com,resources=infisicalpushsecrets,verbs=get;list;watch;create;update;patch;delete
+//+kubebuilder:rbac:groups=secrets.infisical.com,resources=infisicalpushsecrets/status,verbs=get;update;patch
+//+kubebuilder:rbac:groups=secrets.infisical.com,resources=infisicalpushsecrets/finalizers,verbs=update
+//+kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch;create;update;delete
+//+kubebuilder:rbac:groups="",resources=configmaps,verbs=get;list;watch;create;update;delete
+//+kubebuilder:rbac:groups=apps,resources=deployments,verbs=list;watch;get;update
+//+kubebuilder:rbac:groups="",resources=serviceaccounts,verbs=get;list;watch
+
+// Reconcile is part of the main kubernetes reconciliation loop which aims to
+// move the current state of the cluster closer to the desired state.
+// For more details, check Reconcile and its Result here:
+// - https://pkg.go.dev/sigs.k8s.io/[email protected]/pkg/reconcile
+
+func (r *InfisicalPushSecretReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
+
+	logger := r.GetLogger(req)
+
+	var infisicalPushSecretCR secretsv1alpha1.InfisicalPushSecret
+	requeueTime := time.Minute // seconds
+
+	if resourceVariablesMap == nil {
+		resourceVariablesMap = make(map[string]util.ResourceVariables)
+	}
+
+	err := r.Get(ctx, req.NamespacedName, &infisicalPushSecretCR)
+	if err != nil {
+		if errors.IsNotFound(err) {
+			logger.Info("Infisical Push Secret CRD not found")
+			return ctrl.Result{
+				Requeue: false,
+			}, nil
+		} else {
+			logger.Error(err, "Unable to fetch Infisical Secret CRD from cluster")
+			return ctrl.Result{
+				RequeueAfter: requeueTime,
+			}, nil
+		}
+	}
+
+	// Add finalizer if it doesn't exist
+	if !controllerutil.ContainsFinalizer(&infisicalPushSecretCR, constants.INFISICAL_PUSH_SECRET_FINALIZER_NAME) {
+		controllerutil.AddFinalizer(&infisicalPushSecretCR, constants.INFISICAL_PUSH_SECRET_FINALIZER_NAME)
+		if err := r.Update(ctx, &infisicalPushSecretCR); err != nil {
+			return ctrl.Result{}, err
+		}
+	}
+
+	// Check if it's being deleted
+	if !infisicalPushSecretCR.DeletionTimestamp.IsZero() {
+		logger.Info("Handling deletion of InfisicalPushSecret")
+		if controllerutil.ContainsFinalizer(&infisicalPushSecretCR, constants.INFISICAL_PUSH_SECRET_FINALIZER_NAME) {
+			// We remove finalizers before running deletion logic to be completely safe from stuck resources
+			infisicalPushSecretCR.ObjectMeta.Finalizers = []string{}
+			if err := r.Update(ctx, &infisicalPushSecretCR); err != nil {
+				logger.Error(err, fmt.Sprintf("Error removing finalizers from InfisicalPushSecret %s", infisicalPushSecretCR.Name))
+				return ctrl.Result{}, err
+			}
+
+			if err := r.DeleteManagedSecrets(ctx, logger, infisicalPushSecretCR); err != nil {
+				return ctrl.Result{}, err // Even if this fails, we still want to delete the CRD
+			}
+
+		}
+		return ctrl.Result{}, nil
+	}
+
+	if infisicalPushSecretCR.Spec.ResyncInterval != "" {
+
+		duration, err := util.ConvertResyncIntervalToDuration(infisicalPushSecretCR.Spec.ResyncInterval)
+
+		if err != nil {
+			logger.Error(err, fmt.Sprintf("unable to convert resync interval to duration. Will requeue after [requeueTime=%v]", requeueTime))
+			return ctrl.Result{
+				RequeueAfter: requeueTime,
+			}, nil
+		}
+
+		requeueTime = duration
+
+		logger.Info(fmt.Sprintf("Manual re-sync interval set. Interval: %v", requeueTime))
+
+	} else {
+		logger.Info(fmt.Sprintf("Re-sync interval set. Interval: %v", requeueTime))
+	}
+
+	// Check if the resource is already marked for deletion
+	if infisicalPushSecretCR.GetDeletionTimestamp() != nil {
+		return ctrl.Result{
+			Requeue: false,
+		}, nil
+	}
+
+	// Get modified/default config
+	infisicalConfig, err := controllerhelpers.GetInfisicalConfigMap(ctx, r.Client)
+	if err != nil {
+		logger.Error(err, fmt.Sprintf("unable to fetch infisical-config. Will requeue after [requeueTime=%v]", requeueTime))
+		return ctrl.Result{
+			RequeueAfter: requeueTime,
+		}, nil
+	}
+
+	if infisicalPushSecretCR.Spec.HostAPI == "" {
+		api.API_HOST_URL = infisicalConfig["hostAPI"]
+	} else {
+		api.API_HOST_URL = infisicalPushSecretCR.Spec.HostAPI
+	}
+
+	if infisicalPushSecretCR.Spec.TLS.CaRef.SecretName != "" {
+		api.API_CA_CERTIFICATE, err = r.getInfisicalCaCertificateFromKubeSecret(ctx, infisicalPushSecretCR)
+		if err != nil {
+			logger.Error(err, fmt.Sprintf("unable to fetch CA certificate. Will requeue after [requeueTime=%v]", requeueTime))
+			return ctrl.Result{
+				RequeueAfter: requeueTime,
+			}, nil
+		}
+
+		fmt.Println("Using custom CA certificate...")
+	} else {
+		api.API_CA_CERTIFICATE = ""
+	}
+
+	err = r.ReconcileInfisicalPushSecret(ctx, logger, infisicalPushSecretCR)
+	r.SetSuccessfullyReconciledConditions(ctx, &infisicalPushSecretCR, err)
+
+	if err != nil {
+		logger.Error(err, fmt.Sprintf("unable to reconcile Infisical Push Secret. Will requeue after [requeueTime=%v]", requeueTime))
+		return ctrl.Result{
+			RequeueAfter: requeueTime,
+		}, nil
+	}
+
+	// Sync again after the specified time
+	logger.Info(fmt.Sprintf("Operator will requeue after [%v]", requeueTime))
+	return ctrl.Result{
+		RequeueAfter: requeueTime,
+	}, nil
+}
+
+func (r *InfisicalPushSecretReconciler) SetupWithManager(mgr ctrl.Manager) error {
+
+	// Custom predicate that allows both spec changes and deletions
+	specChangeOrDelete := predicate.Funcs{
+		UpdateFunc: func(e event.UpdateEvent) bool {
+			// Only reconcile if spec/generation changed
+			return e.ObjectOld.GetGeneration() != e.ObjectNew.GetGeneration()
+		},
+		DeleteFunc: func(e event.DeleteEvent) bool {
+			// Always reconcile on deletion
+			return true
+		},
+		CreateFunc: func(e event.CreateEvent) bool {
+			// Reconcile on creation
+			return true
+		},
+		GenericFunc: func(e event.GenericEvent) bool {
+			// Ignore generic events
+			return false
+		},
+	}
+
+	return ctrl.NewControllerManagedBy(mgr).
+		For(&secretsv1alpha1.InfisicalPushSecret{}, builder.WithPredicates(
+			specChangeOrDelete,
+		)).
+		Watches(
+			&source.Kind{Type: &corev1.Secret{}},
+			handler.EnqueueRequestsFromMapFunc(func(o client.Object) []reconcile.Request {
+				ctx := context.Background()
+				pushSecrets := &secretsv1alpha1.InfisicalPushSecretList{}
+				if err := r.List(ctx, pushSecrets); err != nil {
+					return []reconcile.Request{}
+				}
+
+				requests := []reconcile.Request{}
+				for _, pushSecret := range pushSecrets.Items {
+					if pushSecret.Spec.Push.Secret.SecretName == o.GetName() &&
+						pushSecret.Spec.Push.Secret.SecretNamespace == o.GetNamespace() {
+						requests = append(requests, reconcile.Request{
+							NamespacedName: types.NamespacedName{
+								Name:      pushSecret.GetName(),
+								Namespace: pushSecret.GetNamespace(),
+							},
+						})
+					}
+				}
+				return requests
+			}),
+		).
+		Complete(r)
+}

k8-operator/controllers/infisicalpushsecret/infisicalpushsecret_helper.go

@@ -0,0 +1,473 @@
+package controllers
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+
+	"github.com/Infisical/infisical/k8-operator/api/v1alpha1"
+	"github.com/Infisical/infisical/k8-operator/packages/api"
+	"github.com/Infisical/infisical/k8-operator/packages/constants"
+	"github.com/Infisical/infisical/k8-operator/packages/util"
+	"github.com/go-logr/logr"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	infisicalSdk "github.com/infisical/go-sdk"
+	k8Errors "k8s.io/apimachinery/pkg/api/errors"
+)
+
+func (r *InfisicalPushSecretReconciler) handleAuthentication(ctx context.Context, infisicalSecret v1alpha1.InfisicalPushSecret, infisicalClient infisicalSdk.InfisicalClientInterface) (util.AuthenticationDetails, error) {
+	authStrategies := map[util.AuthStrategyType]func(ctx context.Context, reconcilerClient client.Client, secretCrd util.SecretAuthInput, infisicalClient infisicalSdk.InfisicalClientInterface) (util.AuthenticationDetails, error){
+		util.AuthStrategy.UNIVERSAL_MACHINE_IDENTITY:    util.HandleUniversalAuth,
+		util.AuthStrategy.KUBERNETES_MACHINE_IDENTITY:   util.HandleKubernetesAuth,
+		util.AuthStrategy.AWS_IAM_MACHINE_IDENTITY:      util.HandleAwsIamAuth,
+		util.AuthStrategy.AZURE_MACHINE_IDENTITY:        util.HandleAzureAuth,
+		util.AuthStrategy.GCP_ID_TOKEN_MACHINE_IDENTITY: util.HandleGcpIdTokenAuth,
+		util.AuthStrategy.GCP_IAM_MACHINE_IDENTITY:      util.HandleGcpIamAuth,
+	}
+
+	for authStrategy, authHandler := range authStrategies {
+		authDetails, err := authHandler(ctx, r.Client, util.SecretAuthInput{
+			Secret: infisicalSecret,
+			Type:   util.SecretCrd.INFISICAL_PUSH_SECRET,
+		}, infisicalClient)
+
+		if err == nil {
+			return authDetails, nil
+		}
+
+		if !errors.Is(err, util.ErrAuthNotApplicable) {
+			return util.AuthenticationDetails{}, fmt.Errorf("authentication failed for strategy [%s] [err=%w]", authStrategy, err)
+		}
+	}
+
+	return util.AuthenticationDetails{}, fmt.Errorf("no authentication method provided")
+
+}
+
+func (r *InfisicalPushSecretReconciler) getInfisicalCaCertificateFromKubeSecret(ctx context.Context, infisicalSecret v1alpha1.InfisicalPushSecret) (caCertificate string, err error) {
+
+	caCertificateFromKubeSecret, err := util.GetKubeSecretByNamespacedName(ctx, r.Client, types.NamespacedName{
+		Namespace: infisicalSecret.Spec.TLS.CaRef.SecretNamespace,
+		Name:      infisicalSecret.Spec.TLS.CaRef.SecretName,
+	})
+
+	if k8Errors.IsNotFound(err) {
+		return "", fmt.Errorf("kubernetes secret containing custom CA certificate cannot be found. [err=%s]", err)
+	}
+
+	if err != nil {
+		return "", fmt.Errorf("something went wrong when fetching your CA certificate [err=%s]", err)
+	}
+
+	caCertificateFromSecret := string(caCertificateFromKubeSecret.Data[infisicalSecret.Spec.TLS.CaRef.SecretKey])
+
+	return caCertificateFromSecret, nil
+}
+
+func (r *InfisicalPushSecretReconciler) getResourceVariables(infisicalPushSecret v1alpha1.InfisicalPushSecret) util.ResourceVariables {
+
+	var resourceVariables util.ResourceVariables
+
+	if _, ok := resourceVariablesMap[string(infisicalPushSecret.UID)]; !ok {
+
+		ctx, cancel := context.WithCancel(context.Background())
+
+		client := infisicalSdk.NewInfisicalClient(ctx, infisicalSdk.Config{
+			SiteUrl:       api.API_HOST_URL,
+			CaCertificate: api.API_CA_CERTIFICATE,
+			UserAgent:     api.USER_AGENT_NAME,
+		})
+
+		resourceVariablesMap[string(infisicalPushSecret.UID)] = util.ResourceVariables{
+			InfisicalClient: client,
+			CancelCtx:       cancel,
+			AuthDetails:     util.AuthenticationDetails{},
+		}
+
+		resourceVariables = resourceVariablesMap[string(infisicalPushSecret.UID)]
+
+	} else {
+		resourceVariables = resourceVariablesMap[string(infisicalPushSecret.UID)]
+	}
+
+	return resourceVariables
+
+}
+
+func (r *InfisicalPushSecretReconciler) updateResourceVariables(infisicalPushSecret v1alpha1.InfisicalPushSecret, resourceVariables util.ResourceVariables) {
+	resourceVariablesMap[string(infisicalPushSecret.UID)] = resourceVariables
+}
+
+func (r *InfisicalPushSecretReconciler) ReconcileInfisicalPushSecret(ctx context.Context, logger logr.Logger, infisicalPushSecret v1alpha1.InfisicalPushSecret) error {
+
+	resourceVariables := r.getResourceVariables(infisicalPushSecret)
+	infisicalClient := resourceVariables.InfisicalClient
+	cancelCtx := resourceVariables.CancelCtx
+	authDetails := resourceVariables.AuthDetails
+	var err error
+
+	if authDetails.AuthStrategy == "" {
+		logger.Info("No authentication strategy found. Attempting to authenticate")
+		authDetails, err = r.handleAuthentication(ctx, infisicalPushSecret, infisicalClient)
+		r.SetAuthenticatedConditions(ctx, &infisicalPushSecret, err)
+
+		if err != nil {
+			return fmt.Errorf("unable to authenticate [err=%s]", err)
+		}
+
+		r.updateResourceVariables(infisicalPushSecret, util.ResourceVariables{
+			InfisicalClient: infisicalClient,
+			CancelCtx:       cancelCtx,
+			AuthDetails:     authDetails,
+		})
+	}
+
+	kubePushSecret, err := util.GetKubeSecretByNamespacedName(ctx, r.Client, types.NamespacedName{
+		Namespace: infisicalPushSecret.Spec.Push.Secret.SecretNamespace,
+		Name:      infisicalPushSecret.Spec.Push.Secret.SecretName,
+	})
+
+	if err != nil {
+		return fmt.Errorf("unable to fetch kube secret [err=%s]", err)
+	}
+
+	var kubeSecrets = make(map[string]string)
+
+	for key, value := range kubePushSecret.Data {
+		kubeSecrets[key] = string(value)
+	}
+
+	destination := infisicalPushSecret.Spec.Destination
+	existingSecrets, err := infisicalClient.Secrets().List(infisicalSdk.ListSecretsOptions{
+		ProjectID:      destination.ProjectID,
+		Environment:    destination.EnvSlug,
+		SecretPath:     destination.SecretsPath,
+		IncludeImports: false,
+	})
+
+	existingSecretsContainsKey := func(key string) bool {
+		for _, secret := range existingSecrets {
+			if secret.SecretKey == key {
+				return true
+			}
+		}
+		return false
+	}
+
+	getExistingSecretByKey := func(key string) *infisicalSdk.Secret {
+		for _, secret := range existingSecrets {
+			if secret.SecretKey == key {
+				return &secret
+			}
+		}
+		return nil
+	}
+
+	getExistingSecretById := func(id string) *infisicalSdk.Secret {
+		for _, secret := range existingSecrets {
+			if secret.ID == id {
+				return &secret
+			}
+		}
+		return nil
+	}
+
+	if err != nil {
+		return fmt.Errorf("unable to list secrets [err=%s]", err)
+	}
+
+	updatePolicy := infisicalPushSecret.Spec.UpdatePolicy
+
+	var secretsFailedToCreate []string
+	var secretsFailedToUpdate []string
+	var secretsFailedToDelete []string
+	var secretsFailedToReplaceById []string
+
+	// If the ManagedSecrets are nil, we know this is the first time the InfisicalPushSecret is being reconciled.
+	if infisicalPushSecret.Status.ManagedSecrets == nil {
+
+		infisicalPushSecret.Status.ManagedSecrets = make(map[string]string) // (string[id], string[key] )
+
+		for secretKey, secretValue := range kubeSecrets {
+			if existingSecretsContainsKey(secretKey) {
+				if updatePolicy == string(constants.PUSH_SECRET_REPLACE_POLICY_ENABLED) {
+					updatedSecret, err := infisicalClient.Secrets().Update(infisicalSdk.UpdateSecretOptions{
+						SecretKey:      secretKey,
+						ProjectID:      destination.ProjectID,
+						Environment:    destination.EnvSlug,
+						SecretPath:     destination.SecretsPath,
+						NewSecretValue: secretValue,
+					})
+
+					if err != nil {
+						secretsFailedToUpdate = append(secretsFailedToUpdate, secretKey)
+						logger.Info(fmt.Sprintf("unable to update secret [key=%s] [err=%s]", secretKey, err))
+						continue
+					}
+
+					infisicalPushSecret.Status.ManagedSecrets[updatedSecret.ID] = secretKey
+				}
+			} else {
+				createdSecret, err := infisicalClient.Secrets().Create(infisicalSdk.CreateSecretOptions{
+					SecretKey:   secretKey,
+					SecretValue: secretValue,
+					ProjectID:   destination.ProjectID,
+					Environment: destination.EnvSlug,
+					SecretPath:  destination.SecretsPath,
+				})
+
+				if err != nil {
+					secretsFailedToCreate = append(secretsFailedToCreate, secretKey)
+					logger.Info(fmt.Sprintf("unable to create secret [key=%s] [err=%s]", secretKey, err))
+					continue
+				}
+
+				infisicalPushSecret.Status.ManagedSecrets[createdSecret.ID] = secretKey
+			}
+		}
+	} else {
+
+		// Loop over all the managed secrets, and find the corresponding existingSecret that has the same ID. If the key doesn't match, delete the secret, and re-create it with the correct key/value
+		for managedSecretId, managedSecretKey := range infisicalPushSecret.Status.ManagedSecrets {
+
+			existingSecret := getExistingSecretById(managedSecretId)
+
+			if existingSecret != nil {
+
+				if existingSecret.SecretKey != managedSecretKey {
+					// Secret key has changed, lets delete the secret and re-create it with the correct key
+
+					logger.Info(fmt.Sprintf("Secret with ID [id=%s] has changed key from [%s] to [%s]. Deleting and re-creating secret", managedSecretId, managedSecretKey, existingSecret.SecretKey))
+
+					deletedSecret, err := infisicalClient.Secrets().Delete(infisicalSdk.DeleteSecretOptions{
+						SecretKey:   existingSecret.SecretKey,
+						ProjectID:   destination.ProjectID,
+						Environment: destination.EnvSlug,
+						SecretPath:  destination.SecretsPath,
+					})
+
+					if err != nil {
+						secretsFailedToReplaceById = append(secretsFailedToReplaceById, managedSecretKey)
+						logger.Info(fmt.Sprintf("unable to delete secret [key=%s] [err=%s]", managedSecretKey, err))
+						continue
+					}
+
+					createdSecret, err := infisicalClient.Secrets().Create(infisicalSdk.CreateSecretOptions{
+						SecretKey:   managedSecretKey,
+						SecretValue: existingSecret.SecretValue,
+						ProjectID:   destination.ProjectID,
+						Environment: destination.EnvSlug,
+						SecretPath:  destination.SecretsPath,
+					})
+
+					if err != nil {
+						secretsFailedToReplaceById = append(secretsFailedToReplaceById, managedSecretKey)
+						logger.Info(fmt.Sprintf("unable to create secret [key=%s] [err=%s]", managedSecretKey, err))
+						continue
+					}
+
+					delete(infisicalPushSecret.Status.ManagedSecrets, deletedSecret.ID)
+					infisicalPushSecret.Status.ManagedSecrets[createdSecret.ID] = managedSecretKey
+				}
+
+			}
+		}
+
+		// We need to check if any of the secrets have been removed in the new kube secret
+		for _, managedSecretKey := range infisicalPushSecret.Status.ManagedSecrets {
+
+			if _, ok := kubeSecrets[managedSecretKey]; !ok {
+
+				// Secret has been removed, verify that the secret is managed by the operator
+				if getExistingSecretByKey(managedSecretKey) != nil {
+					logger.Info(fmt.Sprintf("Secret with key [key=%s] has been removed from the kube secret. Deleting secret from Infisical", managedSecretKey))
+
+					deletedSecret, err := infisicalClient.Secrets().Delete(infisicalSdk.DeleteSecretOptions{
+						SecretKey:   managedSecretKey,
+						ProjectID:   destination.ProjectID,
+						Environment: destination.EnvSlug,
+						SecretPath:  destination.SecretsPath,
+					})
+
+					if err != nil {
+						secretsFailedToDelete = append(secretsFailedToDelete, managedSecretKey)
+						logger.Info(fmt.Sprintf("unable to delete secret [key=%s] [err=%s]", managedSecretKey, err))
+						continue
+					}
+
+					delete(infisicalPushSecret.Status.ManagedSecrets, deletedSecret.ID)
+				}
+			}
+		}
+
+		// We need to check if any new secrets have been added in the kube secret
+		for currentSecretKey := range kubeSecrets {
+
+			if !existingSecretsContainsKey(currentSecretKey) {
+
+				// Some secrets has been added, verify that the secret that has been added is not already managed by the operator
+				if _, ok := infisicalPushSecret.Status.ManagedSecrets[currentSecretKey]; !ok {
+
+					// Secret was not managed by the operator, lets add it
+					logger.Info(fmt.Sprintf("Secret with key [key=%s] has been added to the kube secret. Creating secret in Infisical", currentSecretKey))
+
+					createdSecret, err := infisicalClient.Secrets().Create(infisicalSdk.CreateSecretOptions{
+						SecretKey:   currentSecretKey,
+						SecretValue: kubeSecrets[currentSecretKey],
+						ProjectID:   destination.ProjectID,
+						Environment: destination.EnvSlug,
+						SecretPath:  destination.SecretsPath,
+					})
+
+					if err != nil {
+						secretsFailedToCreate = append(secretsFailedToCreate, currentSecretKey)
+						logger.Info(fmt.Sprintf("unable to create secret [key=%s] [err=%s]", currentSecretKey, err))
+						continue
+					}
+
+					infisicalPushSecret.Status.ManagedSecrets[createdSecret.ID] = currentSecretKey
+				}
+			} else {
+				if updatePolicy == string(constants.PUSH_SECRET_REPLACE_POLICY_ENABLED) {
+					updatedSecret, err := infisicalClient.Secrets().Update(infisicalSdk.UpdateSecretOptions{
+						SecretKey:      currentSecretKey,
+						NewSecretValue: kubeSecrets[currentSecretKey],
+						ProjectID:      destination.ProjectID,
+						Environment:    destination.EnvSlug,
+						SecretPath:     destination.SecretsPath,
+					})
+
+					if err != nil {
+						secretsFailedToUpdate = append(secretsFailedToUpdate, currentSecretKey)
+						logger.Info(fmt.Sprintf("unable to update secret [key=%s] [err=%s]", currentSecretKey, err))
+						continue
+					}
+
+					infisicalPushSecret.Status.ManagedSecrets[updatedSecret.ID] = currentSecretKey
+				}
+			}
+		}
+
+		// Check if any of the existing secrets values have changed
+		for secretKey, secretValue := range kubeSecrets {
+
+			existingSecret := getExistingSecretByKey(secretKey)
+
+			if existingSecret != nil {
+
+				_, managedByOperator := infisicalPushSecret.Status.ManagedSecrets[existingSecret.ID]
+
+				if secretValue != existingSecret.SecretValue {
+
+					if managedByOperator || updatePolicy == string(constants.PUSH_SECRET_REPLACE_POLICY_ENABLED) {
+						logger.Info(fmt.Sprintf("Secret with key [key=%s] has changed value. Updating secret in Infisical", secretKey))
+
+						updatedSecret, err := infisicalClient.Secrets().Update(infisicalSdk.UpdateSecretOptions{
+							SecretKey:      secretKey,
+							NewSecretValue: secretValue,
+							ProjectID:      destination.ProjectID,
+							Environment:    destination.EnvSlug,
+							SecretPath:     destination.SecretsPath,
+						})
+
+						if err != nil {
+							secretsFailedToUpdate = append(secretsFailedToUpdate, secretKey)
+							logger.Info(fmt.Sprintf("unable to update secret [key=%s] [err=%s]", secretKey, err))
+							continue
+						}
+
+						infisicalPushSecret.Status.ManagedSecrets[updatedSecret.ID] = secretKey
+					}
+				}
+			}
+		}
+	}
+
+	var errorMessage string
+	if len(secretsFailedToCreate) > 0 {
+		errorMessage = fmt.Sprintf("Failed to create secrets: [%s]", strings.Join(secretsFailedToCreate, ", "))
+	} else {
+		errorMessage = ""
+	}
+	r.SetFailedToCreateSecretsConditions(ctx, &infisicalPushSecret, fmt.Sprintf("Failed to create secrets: [%s]", errorMessage))
+
+	if len(secretsFailedToUpdate) > 0 {
+		errorMessage = fmt.Sprintf("Failed to update secrets: [%s]", strings.Join(secretsFailedToUpdate, ", "))
+	} else {
+		errorMessage = ""
+	}
+	r.SetFailedToUpdateSecretsConditions(ctx, &infisicalPushSecret, fmt.Sprintf("Failed to update secrets: [%s]", errorMessage))
+
+	if len(secretsFailedToDelete) > 0 {
+		errorMessage = fmt.Sprintf("Failed to delete secrets: [%s]", strings.Join(secretsFailedToDelete, ", "))
+	} else {
+		errorMessage = ""
+	}
+	r.SetFailedToDeleteSecretsConditions(ctx, &infisicalPushSecret, errorMessage)
+
+	if len(secretsFailedToReplaceById) > 0 {
+		errorMessage = fmt.Sprintf("Failed to replace secrets: [%s]", strings.Join(secretsFailedToReplaceById, ", "))
+	} else {
+		errorMessage = ""
+	}
+	r.SetFailedToReplaceSecretsConditions(ctx, &infisicalPushSecret, errorMessage)
+
+	// Update the status of the InfisicalPushSecret
+	if err := r.Client.Status().Update(ctx, &infisicalPushSecret); err != nil {
+		return fmt.Errorf("unable to update status of InfisicalPushSecret [err=%s]", err)
+	}
+
+	return nil
+
+}
+
+func (r *InfisicalPushSecretReconciler) DeleteManagedSecrets(ctx context.Context, logger logr.Logger, infisicalPushSecret v1alpha1.InfisicalPushSecret) error {
+	if infisicalPushSecret.Spec.DeletionPolicy != string(constants.PUSH_SECRET_DELETE_POLICY_ENABLED) {
+		return nil
+	}
+
+	resourceVariables := r.getResourceVariables(infisicalPushSecret)
+	infisicalClient := resourceVariables.InfisicalClient
+
+	destination := infisicalPushSecret.Spec.Destination
+	existingSecrets, err := infisicalClient.Secrets().List(infisicalSdk.ListSecretsOptions{
+		ProjectID:      destination.ProjectID,
+		Environment:    destination.EnvSlug,
+		SecretPath:     destination.SecretsPath,
+		IncludeImports: false,
+	})
+
+	if err != nil {
+		return fmt.Errorf("unable to list secrets [err=%s]", err)
+	}
+
+	existingSecretsMappedById := make(map[string]infisicalSdk.Secret)
+	for _, secret := range existingSecrets {
+		existingSecretsMappedById[secret.ID] = secret
+	}
+
+	for managedSecretId, managedSecretKey := range infisicalPushSecret.Status.ManagedSecrets {
+
+		if _, ok := existingSecretsMappedById[managedSecretId]; ok {
+			logger.Info(fmt.Sprintf("Deleting secret with key [key=%s]", managedSecretKey))
+
+			_, err := infisicalClient.Secrets().Delete(infisicalSdk.DeleteSecretOptions{
+				SecretKey:   managedSecretKey,
+				ProjectID:   destination.ProjectID,
+				Environment: destination.EnvSlug,
+				SecretPath:  destination.SecretsPath,
+			})
+
+			if err != nil {
+				logger.Info(fmt.Sprintf("unable to delete secret [key=%s] [err=%s]", managedSecretKey, err))
+				continue
+			}
+		}
+
+	}
+
+	return nil
+}

k8-operator/controllers/infisicalsecret/auto_redeployment.go

@@ -6,6 +6,8 @@ import (
 	"sync"
 
 	"github.com/Infisical/infisical/k8-operator/api/v1alpha1"
+	"github.com/Infisical/infisical/k8-operator/packages/constants"
+	"github.com/go-logr/logr"
 	v1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/types"
@@ -15,7 +17,7 @@ import (
 const DEPLOYMENT_SECRET_NAME_ANNOTATION_PREFIX = "secrets.infisical.com/managed-secret"
 const AUTO_RELOAD_DEPLOYMENT_ANNOTATION = "secrets.infisical.com/auto-reload" // needs to be set to true for a deployment to start auto redeploying
 
-func (r *InfisicalSecretReconciler) ReconcileDeploymentsWithManagedSecrets(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (int, error) {
+func (r *InfisicalSecretReconciler) ReconcileDeploymentsWithManagedSecrets(ctx context.Context, logger logr.Logger, infisicalSecret v1alpha1.InfisicalSecret) (int, error) {
 	listOfDeployments := &v1.DeploymentList{}
 	err := r.Client.List(ctx, listOfDeployments, &client.ListOptions{Namespace: infisicalSecret.Spec.ManagedSecretReference.SecretNamespace})
 	if err != nil {
@@ -42,8 +44,8 @@ func (r *InfisicalSecretReconciler) ReconcileDeploymentsWithManagedSecrets(ctx c
 			wg.Add(1)
 			go func(d v1.Deployment, s corev1.Secret) {
 				defer wg.Done()
-				if err := r.ReconcileDeployment(ctx, d, s); err != nil {
-					fmt.Printf("unable to reconcile deployment with [name=%v]. Will try next requeue", deployment.ObjectMeta.Name)
+				if err := r.ReconcileDeployment(ctx, logger, d, s); err != nil {
+					logger.Error(err, fmt.Sprintf("unable to reconcile deployment with [name=%v]. Will try next requeue", deployment.ObjectMeta.Name))
 				}
 			}(deployment, *managedKubeSecret)
 		}
@@ -80,17 +82,17 @@ func (r *InfisicalSecretReconciler) IsDeploymentUsingManagedSecret(deployment v1
 
 // This function ensures that a deployment is in sync with a Kubernetes secret by comparing their versions.
 // If the version of the secret is different from the version annotation on the deployment, the annotation is updated to trigger a restart of the deployment.
-func (r *InfisicalSecretReconciler) ReconcileDeployment(ctx context.Context, deployment v1.Deployment, secret corev1.Secret) error {
+func (r *InfisicalSecretReconciler) ReconcileDeployment(ctx context.Context, logger logr.Logger, deployment v1.Deployment, secret corev1.Secret) error {
 	annotationKey := fmt.Sprintf("%s.%s", DEPLOYMENT_SECRET_NAME_ANNOTATION_PREFIX, secret.Name)
-	annotationValue := secret.Annotations[SECRET_VERSION_ANNOTATION]
+	annotationValue := secret.Annotations[constants.SECRET_VERSION_ANNOTATION]
 
 	if deployment.Annotations[annotationKey] == annotationValue &&
 		deployment.Spec.Template.Annotations[annotationKey] == annotationValue {
-		fmt.Printf("The [deploymentName=%v] is already using the most up to date managed secrets. No action required.\n", deployment.ObjectMeta.Name)
+		logger.Info(fmt.Sprintf("The [deploymentName=%v] is already using the most up to date managed secrets. No action required.", deployment.ObjectMeta.Name))
 		return nil
 	}
 
-	fmt.Printf("deployment is using outdated managed secret. Starting re-deployment [deploymentName=%v]\n", deployment.ObjectMeta.Name)
+	logger.Info(fmt.Sprintf("Deployment is using outdated managed secret. Starting re-deployment [deploymentName=%v]", deployment.ObjectMeta.Name))
 
 	if deployment.Spec.Template.Annotations == nil {
 		deployment.Spec.Template.Annotations = make(map[string]string)

k8-operator/controllers/infisicalsecret/conditions.go

@@ -5,6 +5,8 @@ import (
 	"fmt"
 
 	"github.com/Infisical/infisical/k8-operator/api/v1alpha1"
+	"github.com/Infisical/infisical/k8-operator/packages/util"
+	"github.com/go-logr/logr"
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
@@ -40,7 +42,7 @@ func (r *InfisicalSecretReconciler) SetReadyToSyncSecretsConditions(ctx context.
 	return r.Client.Status().Update(ctx, infisicalSecret)
 }
 
-func (r *InfisicalSecretReconciler) SetInfisicalTokenLoadCondition(ctx context.Context, infisicalSecret *v1alpha1.InfisicalSecret, authStrategy AuthStrategyType, errorToConditionOn error) {
+func (r *InfisicalSecretReconciler) SetInfisicalTokenLoadCondition(ctx context.Context, logger logr.Logger, infisicalSecret *v1alpha1.InfisicalSecret, authStrategy util.AuthStrategyType, errorToConditionOn error) {
 	if infisicalSecret.Status.Conditions == nil {
 		infisicalSecret.Status.Conditions = []metav1.Condition{}
 	}
@@ -63,11 +65,11 @@ func (r *InfisicalSecretReconciler) SetInfisicalTokenLoadCondition(ctx context.C
 
 	err := r.Client.Status().Update(ctx, infisicalSecret)
 	if err != nil {
-		fmt.Println("Could not set condition for LoadedInfisicalToken")
+		logger.Error(err, "Could not set condition for LoadedInfisicalToken")
 	}
 }
 
-func (r *InfisicalSecretReconciler) SetInfisicalAutoRedeploymentReady(ctx context.Context, infisicalSecret *v1alpha1.InfisicalSecret, numDeployments int, errorToConditionOn error) {
+func (r *InfisicalSecretReconciler) SetInfisicalAutoRedeploymentReady(ctx context.Context, logger logr.Logger, infisicalSecret *v1alpha1.InfisicalSecret, numDeployments int, errorToConditionOn error) {
 	if infisicalSecret.Status.Conditions == nil {
 		infisicalSecret.Status.Conditions = []metav1.Condition{}
 	}
@@ -90,6 +92,6 @@ func (r *InfisicalSecretReconciler) SetInfisicalAutoRedeploymentReady(ctx contex
 
 	err := r.Client.Status().Update(ctx, infisicalSecret)
 	if err != nil {
-		fmt.Println("Could not set condition for AutoRedeployReady")
+		logger.Error(err, "Could not set condition for AutoRedeployReady")
 	}
 }

k8-operator/controllers/infisicalsecret/infisicalsecret_controller.go

@@ -15,15 +15,20 @@ import (
 
 	secretsv1alpha1 "github.com/Infisical/infisical/k8-operator/api/v1alpha1"
 	"github.com/Infisical/infisical/k8-operator/packages/api"
-	infisicalSdk "github.com/infisical/go-sdk"
+	controllerhelpers "github.com/Infisical/infisical/k8-operator/packages/controllerutil"
+	"github.com/Infisical/infisical/k8-operator/packages/util"
+	"github.com/go-logr/logr"
 )
 
 // InfisicalSecretReconciler reconciles a InfisicalSecret object
 type InfisicalSecretReconciler struct {
 	client.Client
-	Scheme *runtime.Scheme
+	BaseLogger logr.Logger
+	Scheme     *runtime.Scheme
 }
 
+var resourceVariablesMap map[string]util.ResourceVariables = make(map[string]util.ResourceVariables)
+
 //+kubebuilder:rbac:groups=secrets.infisical.com,resources=infisicalsecrets,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:rbac:groups=secrets.infisical.com,resources=infisicalsecrets/status,verbs=get;update;patch
 //+kubebuilder:rbac:groups=secrets.infisical.com,resources=infisicalsecrets/finalizers,verbs=update
@@ -37,21 +42,26 @@ type InfisicalSecretReconciler struct {
 // For more details, check Reconcile and its Result here:
 // - https://pkg.go.dev/sigs.k8s.io/[email protected]/pkg/reconcile
 
-type ResourceVariables struct {
-	infisicalClient infisicalSdk.InfisicalClientInterface
-	cancelCtx       context.CancelFunc
-	authDetails     AuthenticationDetails
-}
-
 const FINALIZER_NAME = "secrets.finalizers.infisical.com"
 
 // Maps the infisicalSecretCR.UID to a infisicalSdk.InfisicalClientInterface and AuthenticationDetails.
-var resourceVariablesMap = make(map[string]ResourceVariables)
+// var resourceVariablesMap = make(map[string]ResourceVariables)
+
+func (r *InfisicalSecretReconciler) GetLogger(req ctrl.Request) logr.Logger {
+	return r.BaseLogger.WithValues("infisicalsecret", req.NamespacedName)
+}
 
 func (r *InfisicalSecretReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
+
+	logger := r.GetLogger(req)
+
 	var infisicalSecretCR secretsv1alpha1.InfisicalSecret
 	requeueTime := time.Minute // seconds
 
+	if resourceVariablesMap == nil {
+		resourceVariablesMap = make(map[string]util.ResourceVariables)
+	}
+
 	err := r.Get(ctx, req.NamespacedName, &infisicalSecretCR)
 	if err != nil {
 		if errors.IsNotFound(err) {
@@ -59,7 +69,7 @@ func (r *InfisicalSecretReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 				Requeue: false,
 			}, nil
 		} else {
-			fmt.Printf("\nUnable to fetch Infisical Secret CRD from cluster because [err=%v]", err)
+			logger.Error(err, "unable to fetch Infisical Secret CRD from cluster")
 			return ctrl.Result{
 				RequeueAfter: requeueTime,
 			}, nil
@@ -71,7 +81,7 @@ func (r *InfisicalSecretReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 	if !infisicalSecretCR.ObjectMeta.DeletionTimestamp.IsZero() && len(infisicalSecretCR.ObjectMeta.Finalizers) > 0 {
 		infisicalSecretCR.ObjectMeta.Finalizers = []string{}
 		if err := r.Update(ctx, &infisicalSecretCR); err != nil {
-			fmt.Printf("Error removing finalizers from Infisical Secret %s: %v\n", infisicalSecretCR.Name, err)
+			logger.Error(err, fmt.Sprintf("Error removing finalizers from Infisical Secret %s", infisicalSecretCR.Name))
 			return ctrl.Result{}, err
 		}
 		// Our finalizers have been removed, so the reconciler can do nothing.
@@ -80,9 +90,10 @@ func (r *InfisicalSecretReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 
 	if infisicalSecretCR.Spec.ResyncInterval != 0 {
 		requeueTime = time.Second * time.Duration(infisicalSecretCR.Spec.ResyncInterval)
-		fmt.Printf("\nManual re-sync interval set. Interval: %v\n", requeueTime)
+		logger.Info(fmt.Sprintf("Manual re-sync interval set. Interval: %v", requeueTime))
+
 	} else {
-		fmt.Printf("\nRe-sync interval set. Interval: %v\n", requeueTime)
+		logger.Info(fmt.Sprintf("Re-sync interval set. Interval: %v", requeueTime))
 	}
 
 	// Check if the resource is already marked for deletion
@@ -93,9 +104,9 @@ func (r *InfisicalSecretReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 	}
 
 	// Get modified/default config
-	infisicalConfig, err := r.GetInfisicalConfigMap(ctx)
+	infisicalConfig, err := controllerhelpers.GetInfisicalConfigMap(ctx, r.Client)
 	if err != nil {
-		fmt.Printf("unable to fetch infisical-config [err=%s]. Will requeue after [requeueTime=%v]\n", err, requeueTime)
+		logger.Error(err, fmt.Sprintf("unable to fetch infisical-config. Will requeue after [requeueTime=%v]", requeueTime))
 		return ctrl.Result{
 			RequeueAfter: requeueTime,
 		}, nil
@@ -108,40 +119,41 @@ func (r *InfisicalSecretReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 	}
 
 	if infisicalSecretCR.Spec.TLS.CaRef.SecretName != "" {
-		api.API_CA_CERTIFICATE, err = r.GetInfisicalCaCertificateFromKubeSecret(ctx, infisicalSecretCR)
+		api.API_CA_CERTIFICATE, err = r.getInfisicalCaCertificateFromKubeSecret(ctx, infisicalSecretCR)
 		if err != nil {
-			fmt.Printf("unable to fetch CA certificate [err=%s]. Will requeue after [requeueTime=%v]\n", err, requeueTime)
+			logger.Error(err, fmt.Sprintf("unable to fetch CA certificate. Will requeue after [requeueTime=%v]", requeueTime))
 			return ctrl.Result{
 				RequeueAfter: requeueTime,
 			}, nil
 		}
 
-		fmt.Println("Using custom CA certificate...")
+		logger.Info("Using custom CA certificate...")
 	} else {
 		api.API_CA_CERTIFICATE = ""
 	}
 
-	err = r.ReconcileInfisicalSecret(ctx, infisicalSecretCR)
+	err = r.ReconcileInfisicalSecret(ctx, logger, infisicalSecretCR)
 	r.SetReadyToSyncSecretsConditions(ctx, &infisicalSecretCR, err)
 
 	if err != nil {
-		fmt.Printf("unable to reconcile Infisical Secret because [err=%v]. Will requeue after [requeueTime=%v]\n", err, requeueTime)
+
+		logger.Error(err, fmt.Sprintf("unable to reconcile InfisicalSecret. Will requeue after [requeueTime=%v]", requeueTime))
 		return ctrl.Result{
 			RequeueAfter: requeueTime,
 		}, nil
 	}
 
-	numDeployments, err := r.ReconcileDeploymentsWithManagedSecrets(ctx, infisicalSecretCR)
-	r.SetInfisicalAutoRedeploymentReady(ctx, &infisicalSecretCR, numDeployments, err)
+	numDeployments, err := r.ReconcileDeploymentsWithManagedSecrets(ctx, logger, infisicalSecretCR)
+	r.SetInfisicalAutoRedeploymentReady(ctx, logger, &infisicalSecretCR, numDeployments, err)
 	if err != nil {
-		fmt.Printf("unable to reconcile auto redeployment because [err=%v]", err)
+		logger.Error(err, fmt.Sprintf("unable to reconcile auto redeployment. Will requeue after [requeueTime=%v]", requeueTime))
 		return ctrl.Result{
 			RequeueAfter: requeueTime,
 		}, nil
 	}
 
 	// Sync again after the specified time
-	fmt.Printf("Operator will requeue after [%v] \n", requeueTime)
+	logger.Info(fmt.Sprintf("Operator will requeue after [%v]", requeueTime))
 	return ctrl.Result{
 		RequeueAfter: requeueTime,
 	}, nil
@@ -151,16 +163,20 @@ func (r *InfisicalSecretReconciler) SetupWithManager(mgr ctrl.Manager) error {
 	return ctrl.NewControllerManagedBy(mgr).
 		For(&secretsv1alpha1.InfisicalSecret{}, builder.WithPredicates(predicate.Funcs{
 			UpdateFunc: func(e event.UpdateEvent) bool {
-				if rv, ok := resourceVariablesMap[string(e.ObjectNew.GetUID())]; ok {
-					rv.cancelCtx()
-					delete(resourceVariablesMap, string(e.ObjectNew.GetUID()))
+				if resourceVariablesMap != nil {
+					if rv, ok := resourceVariablesMap[string(e.ObjectNew.GetUID())]; ok {
+						rv.CancelCtx()
+						delete(resourceVariablesMap, string(e.ObjectNew.GetUID()))
+					}
 				}
 				return true
 			},
 			DeleteFunc: func(e event.DeleteEvent) bool {
-				if rv, ok := resourceVariablesMap[string(e.Object.GetUID())]; ok {
-					rv.cancelCtx()
-					delete(resourceVariablesMap, string(e.Object.GetUID()))
+				if resourceVariablesMap != nil {
+					if rv, ok := resourceVariablesMap[string(e.Object.GetUID())]; ok {
+						rv.CancelCtx()
+						delete(resourceVariablesMap, string(e.Object.GetUID()))
+					}
 				}
 				return true
 			},

k8-operator/controllers/infisicalsecret/infisicalsecret_helper.go

@@ -10,8 +10,10 @@ import (
 
 	"github.com/Infisical/infisical/k8-operator/api/v1alpha1"
 	"github.com/Infisical/infisical/k8-operator/packages/api"
+	"github.com/Infisical/infisical/k8-operator/packages/constants"
 	"github.com/Infisical/infisical/k8-operator/packages/model"
 	"github.com/Infisical/infisical/k8-operator/packages/util"
+	"github.com/go-logr/logr"
 
 	"k8s.io/apimachinery/pkg/types"
 
@@ -20,113 +22,61 @@ import (
 	k8Errors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
-const SERVICE_ACCOUNT_ACCESS_KEY = "serviceAccountAccessKey"
-const SERVICE_ACCOUNT_PUBLIC_KEY = "serviceAccountPublicKey"
-const SERVICE_ACCOUNT_PRIVATE_KEY = "serviceAccountPrivateKey"
-
-const INFISICAL_MACHINE_IDENTITY_CLIENT_ID = "clientId"
-const INFISICAL_MACHINE_IDENTITY_CLIENT_SECRET = "clientSecret"
-
-const INFISICAL_TOKEN_SECRET_KEY_NAME = "infisicalToken"
-const SECRET_VERSION_ANNOTATION = "secrets.infisical.com/version" // used to set the version of secrets via Etag
-const OPERATOR_SETTINGS_CONFIGMAP_NAME = "infisical-config"
-const OPERATOR_SETTINGS_CONFIGMAP_NAMESPACE = "infisical-operator-system"
-const INFISICAL_DOMAIN = "https://app.infisical.com/api"
-
-func (r *InfisicalSecretReconciler) HandleAuthentication(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) (AuthenticationDetails, error) {
+func (r *InfisicalSecretReconciler) handleAuthentication(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) (util.AuthenticationDetails, error) {
 
 	// ? Legacy support, service token auth
-	infisicalToken, err := r.GetInfisicalTokenFromKubeSecret(ctx, infisicalSecret)
+	infisicalToken, err := r.getInfisicalTokenFromKubeSecret(ctx, infisicalSecret)
 	if err != nil {
-		return AuthenticationDetails{}, fmt.Errorf("ReconcileInfisicalSecret: unable to get service token from kube secret [err=%s]", err)
+		return util.AuthenticationDetails{}, fmt.Errorf("ReconcileInfisicalSecret: unable to get service token from kube secret [err=%s]", err)
 	}
 	if infisicalToken != "" {
 		infisicalClient.Auth().SetAccessToken(infisicalToken)
-		return AuthenticationDetails{authStrategy: AuthStrategy.SERVICE_TOKEN}, nil
+		return util.AuthenticationDetails{AuthStrategy: util.AuthStrategy.SERVICE_TOKEN}, nil
 	}
 
 	// ? Legacy support, service account auth
-	serviceAccountCreds, err := r.GetInfisicalServiceAccountCredentialsFromKubeSecret(ctx, infisicalSecret)
+	serviceAccountCreds, err := r.getInfisicalServiceAccountCredentialsFromKubeSecret(ctx, infisicalSecret)
 	if err != nil {
-		return AuthenticationDetails{}, fmt.Errorf("ReconcileInfisicalSecret: unable to get service account creds from kube secret [err=%s]", err)
+		return util.AuthenticationDetails{}, fmt.Errorf("ReconcileInfisicalSecret: unable to get service account creds from kube secret [err=%s]", err)
 	}
 
 	if serviceAccountCreds.AccessKey != "" || serviceAccountCreds.PrivateKey != "" || serviceAccountCreds.PublicKey != "" {
 		infisicalClient.Auth().SetAccessToken(serviceAccountCreds.AccessKey)
-		return AuthenticationDetails{authStrategy: AuthStrategy.SERVICE_ACCOUNT}, nil
+		return util.AuthenticationDetails{AuthStrategy: util.AuthStrategy.SERVICE_ACCOUNT}, nil
 	}
 
-	authStrategies := map[AuthStrategyType]func(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) (AuthenticationDetails, error){
-		AuthStrategy.UNIVERSAL_MACHINE_IDENTITY:    r.handleUniversalAuth,
-		AuthStrategy.KUBERNETES_MACHINE_IDENTITY:   r.handleKubernetesAuth,
-		AuthStrategy.AWS_IAM_MACHINE_IDENTITY:      r.handleAwsIamAuth,
-		AuthStrategy.AZURE_MACHINE_IDENTITY:        r.handleAzureAuth,
-		AuthStrategy.GCP_ID_TOKEN_MACHINE_IDENTITY: r.handleGcpIdTokenAuth,
-		AuthStrategy.GCP_IAM_MACHINE_IDENTITY:      r.handleGcpIamAuth,
+	authStrategies := map[util.AuthStrategyType]func(ctx context.Context, reconcilerClient client.Client, secretCrd util.SecretAuthInput, infisicalClient infisicalSdk.InfisicalClientInterface) (util.AuthenticationDetails, error){
+		util.AuthStrategy.UNIVERSAL_MACHINE_IDENTITY:    util.HandleUniversalAuth,
+		util.AuthStrategy.KUBERNETES_MACHINE_IDENTITY:   util.HandleKubernetesAuth,
+		util.AuthStrategy.AWS_IAM_MACHINE_IDENTITY:      util.HandleAwsIamAuth,
+		util.AuthStrategy.AZURE_MACHINE_IDENTITY:        util.HandleAzureAuth,
+		util.AuthStrategy.GCP_ID_TOKEN_MACHINE_IDENTITY: util.HandleGcpIdTokenAuth,
+		util.AuthStrategy.GCP_IAM_MACHINE_IDENTITY:      util.HandleGcpIamAuth,
 	}
 
 	for authStrategy, authHandler := range authStrategies {
-		authDetails, err := authHandler(ctx, infisicalSecret, infisicalClient)
+		authDetails, err := authHandler(ctx, r.Client, util.SecretAuthInput{
+			Secret: infisicalSecret,
+			Type:   util.SecretCrd.INFISICAL_SECRET,
+		}, infisicalClient)
 
 		if err == nil {
 			return authDetails, nil
 		}
 
-		if !errors.Is(err, ErrAuthNotApplicable) {
-			return AuthenticationDetails{}, fmt.Errorf("authentication failed for strategy [%s] [err=%w]", authStrategy, err)
+		if !errors.Is(err, util.ErrAuthNotApplicable) {
+			return util.AuthenticationDetails{}, fmt.Errorf("authentication failed for strategy [%s] [err=%w]", authStrategy, err)
 		}
 	}
 
-	return AuthenticationDetails{}, fmt.Errorf("no authentication method provided")
+	return util.AuthenticationDetails{}, fmt.Errorf("no authentication method provided")
 
 }
 
-func (r *InfisicalSecretReconciler) GetInfisicalConfigMap(ctx context.Context) (configMap map[string]string, errToReturn error) {
-	// default key values
-	defaultConfigMapData := make(map[string]string)
-	defaultConfigMapData["hostAPI"] = INFISICAL_DOMAIN
-
-	kubeConfigMap := &corev1.ConfigMap{}
-	err := r.Client.Get(ctx, types.NamespacedName{
-		Namespace: OPERATOR_SETTINGS_CONFIGMAP_NAMESPACE,
-		Name:      OPERATOR_SETTINGS_CONFIGMAP_NAME,
-	}, kubeConfigMap)
-
-	if err != nil {
-		if k8Errors.IsNotFound(err) {
-			kubeConfigMap = nil
-		} else {
-			return nil, fmt.Errorf("GetConfigMapByNamespacedName: unable to fetch config map in [namespacedName=%s] [err=%s]", OPERATOR_SETTINGS_CONFIGMAP_NAMESPACE, err)
-		}
-	}
-
-	if kubeConfigMap == nil {
-		return defaultConfigMapData, nil
-	} else {
-		for key, value := range defaultConfigMapData {
-			_, exists := kubeConfigMap.Data[key]
-			if !exists {
-				kubeConfigMap.Data[key] = value
-			}
-		}
-
-		return kubeConfigMap.Data, nil
-	}
-}
-
-func (r *InfisicalSecretReconciler) GetKubeSecretByNamespacedName(ctx context.Context, namespacedName types.NamespacedName) (*corev1.Secret, error) {
-	kubeSecret := &corev1.Secret{}
-	err := r.Client.Get(ctx, namespacedName, kubeSecret)
-	if err != nil {
-		kubeSecret = nil
-	}
-
-	return kubeSecret, err
-}
-
-func (r *InfisicalSecretReconciler) GetInfisicalTokenFromKubeSecret(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (string, error) {
+func (r *InfisicalSecretReconciler) getInfisicalTokenFromKubeSecret(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (string, error) {
 	// default to new secret ref structure
 	secretName := infisicalSecret.Spec.Authentication.ServiceToken.ServiceTokenSecretReference.SecretName
 	secretNamespace := infisicalSecret.Spec.Authentication.ServiceToken.ServiceTokenSecretReference.SecretNamespace
@@ -139,7 +89,7 @@ func (r *InfisicalSecretReconciler) GetInfisicalTokenFromKubeSecret(ctx context.
 		secretNamespace = infisicalSecret.Spec.TokenSecretReference.SecretNamespace
 	}
 
-	tokenSecret, err := r.GetKubeSecretByNamespacedName(ctx, types.NamespacedName{
+	tokenSecret, err := util.GetKubeSecretByNamespacedName(ctx, r.Client, types.NamespacedName{
 		Namespace: secretNamespace,
 		Name:      secretName,
 	})
@@ -152,36 +102,14 @@ func (r *InfisicalSecretReconciler) GetInfisicalTokenFromKubeSecret(ctx context.
 		return "", fmt.Errorf("failed to read Infisical token secret from secret named [%s] in namespace [%s]: with error [%w]", infisicalSecret.Spec.TokenSecretReference.SecretName, infisicalSecret.Spec.TokenSecretReference.SecretNamespace, err)
 	}
 
-	infisicalServiceToken := tokenSecret.Data[INFISICAL_TOKEN_SECRET_KEY_NAME]
+	infisicalServiceToken := tokenSecret.Data[constants.INFISICAL_TOKEN_SECRET_KEY_NAME]
 
 	return strings.Replace(string(infisicalServiceToken), " ", "", -1), nil
 }
 
-func (r *InfisicalSecretReconciler) GetInfisicalUniversalAuthFromKubeSecret(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (machineIdentityDetails model.MachineIdentityDetails, err error) {
+func (r *InfisicalSecretReconciler) getInfisicalCaCertificateFromKubeSecret(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (caCertificate string, err error) {
 
-	universalAuthCredsFromKubeSecret, err := r.GetKubeSecretByNamespacedName(ctx, types.NamespacedName{
-		Namespace: infisicalSecret.Spec.Authentication.UniversalAuth.CredentialsRef.SecretNamespace,
-		Name:      infisicalSecret.Spec.Authentication.UniversalAuth.CredentialsRef.SecretName,
-	})
-
-	if k8Errors.IsNotFound(err) {
-		return model.MachineIdentityDetails{}, nil
-	}
-
-	if err != nil {
-		return model.MachineIdentityDetails{}, fmt.Errorf("something went wrong when fetching your machine identity credentials [err=%s]", err)
-	}
-
-	clientIdFromSecret := universalAuthCredsFromKubeSecret.Data[INFISICAL_MACHINE_IDENTITY_CLIENT_ID]
-	clientSecretFromSecret := universalAuthCredsFromKubeSecret.Data[INFISICAL_MACHINE_IDENTITY_CLIENT_SECRET]
-
-	return model.MachineIdentityDetails{ClientId: string(clientIdFromSecret), ClientSecret: string(clientSecretFromSecret)}, nil
-
-}
-
-func (r *InfisicalSecretReconciler) GetInfisicalCaCertificateFromKubeSecret(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (caCertificate string, err error) {
-
-	caCertificateFromKubeSecret, err := r.GetKubeSecretByNamespacedName(ctx, types.NamespacedName{
+	caCertificateFromKubeSecret, err := util.GetKubeSecretByNamespacedName(ctx, r.Client, types.NamespacedName{
 		Namespace: infisicalSecret.Spec.TLS.CaRef.SecretNamespace,
 		Name:      infisicalSecret.Spec.TLS.CaRef.SecretName,
 	})
@@ -197,13 +125,12 @@ func (r *InfisicalSecretReconciler) GetInfisicalCaCertificateFromKubeSecret(ctx
 	caCertificateFromSecret := string(caCertificateFromKubeSecret.Data[infisicalSecret.Spec.TLS.CaRef.SecretKey])
 
 	return caCertificateFromSecret, nil
-
 }
 
 // Fetches service account credentials from a Kubernetes secret specified in the infisicalSecret object, extracts the access key, public key, and private key from the secret, and returns them as a ServiceAccountCredentials object.
 // If any keys are missing or an error occurs, returns an empty object or an error object, respectively.
-func (r *InfisicalSecretReconciler) GetInfisicalServiceAccountCredentialsFromKubeSecret(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (serviceAccountDetails model.ServiceAccountDetails, err error) {
-	serviceAccountCredsFromKubeSecret, err := r.GetKubeSecretByNamespacedName(ctx, types.NamespacedName{
+func (r *InfisicalSecretReconciler) getInfisicalServiceAccountCredentialsFromKubeSecret(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (serviceAccountDetails model.ServiceAccountDetails, err error) {
+	serviceAccountCredsFromKubeSecret, err := util.GetKubeSecretByNamespacedName(ctx, r.Client, types.NamespacedName{
 		Namespace: infisicalSecret.Spec.Authentication.ServiceAccount.ServiceAccountSecretReference.SecretNamespace,
 		Name:      infisicalSecret.Spec.Authentication.ServiceAccount.ServiceAccountSecretReference.SecretName,
 	})
@@ -216,9 +143,9 @@ func (r *InfisicalSecretReconciler) GetInfisicalServiceAccountCredentialsFromKub
 		return model.ServiceAccountDetails{}, fmt.Errorf("something went wrong when fetching your service account credentials [err=%s]", err)
 	}
 
-	accessKeyFromSecret := serviceAccountCredsFromKubeSecret.Data[SERVICE_ACCOUNT_ACCESS_KEY]
-	publicKeyFromSecret := serviceAccountCredsFromKubeSecret.Data[SERVICE_ACCOUNT_PUBLIC_KEY]
-	privateKeyFromSecret := serviceAccountCredsFromKubeSecret.Data[SERVICE_ACCOUNT_PRIVATE_KEY]
+	accessKeyFromSecret := serviceAccountCredsFromKubeSecret.Data[constants.SERVICE_ACCOUNT_ACCESS_KEY]
+	publicKeyFromSecret := serviceAccountCredsFromKubeSecret.Data[constants.SERVICE_ACCOUNT_PUBLIC_KEY]
+	privateKeyFromSecret := serviceAccountCredsFromKubeSecret.Data[constants.SERVICE_ACCOUNT_PRIVATE_KEY]
 
 	if accessKeyFromSecret == nil || publicKeyFromSecret == nil || privateKeyFromSecret == nil {
 		return model.ServiceAccountDetails{}, nil
@@ -227,7 +154,7 @@ func (r *InfisicalSecretReconciler) GetInfisicalServiceAccountCredentialsFromKub
 	return model.ServiceAccountDetails{AccessKey: string(accessKeyFromSecret), PrivateKey: string(privateKeyFromSecret), PublicKey: string(publicKeyFromSecret)}, nil
 }
 
-func (r *InfisicalSecretReconciler) CreateInfisicalManagedKubeSecret(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, secretsFromAPI []model.SingleEnvironmentVariable, ETag string) error {
+func (r *InfisicalSecretReconciler) createInfisicalManagedKubeSecret(ctx context.Context, logger logr.Logger, infisicalSecret v1alpha1.InfisicalSecret, secretsFromAPI []model.SingleEnvironmentVariable, ETag string) error {
 	plainProcessedSecrets := make(map[string][]byte)
 	secretType := infisicalSecret.Spec.ManagedSecretReference.SecretType
 	managedTemplateData := infisicalSecret.Spec.ManagedSecretReference.Template
@@ -283,7 +210,7 @@ func (r *InfisicalSecretReconciler) CreateInfisicalManagedKubeSecret(ctx context
 		}
 	}
 
-	annotations[SECRET_VERSION_ANNOTATION] = ETag
+	annotations[constants.SECRET_VERSION_ANNOTATION] = ETag
 
 	// create a new secret as specified by the managed secret spec of CRD
 	newKubeSecretInstance := &corev1.Secret{
@@ -310,11 +237,11 @@ func (r *InfisicalSecretReconciler) CreateInfisicalManagedKubeSecret(ctx context
 		return fmt.Errorf("unable to create the managed Kubernetes secret : %w", err)
 	}
 
-	fmt.Printf("Successfully created a managed Kubernetes secret with your Infisical secrets. Type: %s\n", secretType)
+	logger.Info(fmt.Sprintf("Successfully created a managed Kubernetes secret with your Infisical secrets. Type: %s", secretType))
 	return nil
 }
 
-func (r *InfisicalSecretReconciler) UpdateInfisicalManagedKubeSecret(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, managedKubeSecret corev1.Secret, secretsFromAPI []model.SingleEnvironmentVariable, ETag string) error {
+func (r *InfisicalSecretReconciler) updateInfisicalManagedKubeSecret(ctx context.Context, logger logr.Logger, infisicalSecret v1alpha1.InfisicalSecret, managedKubeSecret corev1.Secret, secretsFromAPI []model.SingleEnvironmentVariable, ETag string) error {
 	managedTemplateData := infisicalSecret.Spec.ManagedSecretReference.Template
 
 	plainProcessedSecrets := make(map[string][]byte)
@@ -354,20 +281,20 @@ func (r *InfisicalSecretReconciler) UpdateInfisicalManagedKubeSecret(ctx context
 	}
 
 	managedKubeSecret.Data = plainProcessedSecrets
-	managedKubeSecret.ObjectMeta.Annotations[SECRET_VERSION_ANNOTATION] = ETag
+	managedKubeSecret.ObjectMeta.Annotations[constants.SECRET_VERSION_ANNOTATION] = ETag
 
 	err := r.Client.Update(ctx, &managedKubeSecret)
 	if err != nil {
 		return fmt.Errorf("unable to update Kubernetes secret because [%w]", err)
 	}
 
-	fmt.Println("successfully updated managed Kubernetes secret")
+	logger.Info("successfully updated managed Kubernetes secret")
 	return nil
 }
 
-func (r *InfisicalSecretReconciler) GetResourceVariables(infisicalSecret v1alpha1.InfisicalSecret) ResourceVariables {
+func (r *InfisicalSecretReconciler) getResourceVariables(infisicalSecret v1alpha1.InfisicalSecret) util.ResourceVariables {
 
-	var resourceVariables ResourceVariables
+	var resourceVariables util.ResourceVariables
 
 	if _, ok := resourceVariablesMap[string(infisicalSecret.UID)]; !ok {
 
@@ -379,10 +306,10 @@ func (r *InfisicalSecretReconciler) GetResourceVariables(infisicalSecret v1alpha
 			UserAgent:     api.USER_AGENT_NAME,
 		})
 
-		resourceVariablesMap[string(infisicalSecret.UID)] = ResourceVariables{
-			infisicalClient: client,
-			cancelCtx:       cancel,
-			authDetails:     AuthenticationDetails{},
+		resourceVariablesMap[string(infisicalSecret.UID)] = util.ResourceVariables{
+			InfisicalClient: client,
+			CancelCtx:       cancel,
+			AuthDetails:     util.AuthenticationDetails{},
 		}
 
 		resourceVariables = resourceVariablesMap[string(infisicalSecret.UID)]
@@ -395,36 +322,36 @@ func (r *InfisicalSecretReconciler) GetResourceVariables(infisicalSecret v1alpha
 
 }
 
-func (r *InfisicalSecretReconciler) UpdateResourceVariables(infisicalSecret v1alpha1.InfisicalSecret, resourceVariables ResourceVariables) {
+func (r *InfisicalSecretReconciler) updateResourceVariables(infisicalSecret v1alpha1.InfisicalSecret, resourceVariables util.ResourceVariables) {
 	resourceVariablesMap[string(infisicalSecret.UID)] = resourceVariables
 }
 
-func (r *InfisicalSecretReconciler) ReconcileInfisicalSecret(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) error {
+func (r *InfisicalSecretReconciler) ReconcileInfisicalSecret(ctx context.Context, logger logr.Logger, infisicalSecret v1alpha1.InfisicalSecret) error {
 
-	resourceVariables := r.GetResourceVariables(infisicalSecret)
-	infisicalClient := resourceVariables.infisicalClient
-	cancelCtx := resourceVariables.cancelCtx
-	authDetails := resourceVariables.authDetails
+	resourceVariables := r.getResourceVariables(infisicalSecret)
+	infisicalClient := resourceVariables.InfisicalClient
+	cancelCtx := resourceVariables.CancelCtx
+	authDetails := resourceVariables.AuthDetails
 	var err error
 
-	if authDetails.authStrategy == "" {
-		fmt.Println("ReconcileInfisicalSecret: No authentication strategy found. Attempting to authenticate")
-		authDetails, err = r.HandleAuthentication(ctx, infisicalSecret, infisicalClient)
-		r.SetInfisicalTokenLoadCondition(ctx, &infisicalSecret, authDetails.authStrategy, err)
+	if authDetails.AuthStrategy == "" {
+		logger.Info("No authentication strategy found. Attempting to authenticate")
+		authDetails, err = r.handleAuthentication(ctx, infisicalSecret, infisicalClient)
+		r.SetInfisicalTokenLoadCondition(ctx, logger, &infisicalSecret, authDetails.AuthStrategy, err)
 
 		if err != nil {
 			return fmt.Errorf("unable to authenticate [err=%s]", err)
 		}
 
-		r.UpdateResourceVariables(infisicalSecret, ResourceVariables{
-			infisicalClient: infisicalClient,
-			cancelCtx:       cancelCtx,
-			authDetails:     authDetails,
+		r.updateResourceVariables(infisicalSecret, util.ResourceVariables{
+			InfisicalClient: infisicalClient,
+			CancelCtx:       cancelCtx,
+			AuthDetails:     authDetails,
 		})
 	}
 
 	// Look for managed secret by name and namespace
-	managedKubeSecret, err := r.GetKubeSecretByNamespacedName(ctx, types.NamespacedName{
+	managedKubeSecret, err := util.GetKubeSecretByNamespacedName(ctx, r.Client, types.NamespacedName{
 		Name:      infisicalSecret.Spec.ManagedSecretReference.SecretName,
 		Namespace: infisicalSecret.Spec.ManagedSecretReference.SecretNamespace,
 	})
@@ -436,14 +363,14 @@ func (r *InfisicalSecretReconciler) ReconcileInfisicalSecret(ctx context.Context
 	// Get exiting Etag if exists
 	secretVersionBasedOnETag := ""
 	if managedKubeSecret != nil {
-		secretVersionBasedOnETag = managedKubeSecret.Annotations[SECRET_VERSION_ANNOTATION]
+		secretVersionBasedOnETag = managedKubeSecret.Annotations[constants.SECRET_VERSION_ANNOTATION]
 	}
 
 	var plainTextSecretsFromApi []model.SingleEnvironmentVariable
 	var updateDetails model.RequestUpdateUpdateDetails
 
-	if authDetails.authStrategy == AuthStrategy.SERVICE_ACCOUNT { // Service Account // ! Legacy auth method
-		serviceAccountCreds, err := r.GetInfisicalServiceAccountCredentialsFromKubeSecret(ctx, infisicalSecret)
+	if authDetails.AuthStrategy == util.AuthStrategy.SERVICE_ACCOUNT { // Service Account // ! Legacy auth method
+		serviceAccountCreds, err := r.getInfisicalServiceAccountCredentialsFromKubeSecret(ctx, infisicalSecret)
 		if err != nil {
 			return fmt.Errorf("ReconcileInfisicalSecret: unable to get service account creds from kube secret [err=%s]", err)
 		}
@@ -453,10 +380,10 @@ func (r *InfisicalSecretReconciler) ReconcileInfisicalSecret(ctx context.Context
 			return fmt.Errorf("\nfailed to get secrets because [err=%v]", err)
 		}
 
-		fmt.Println("ReconcileInfisicalSecret: Fetched secrets via service account")
+		logger.Info("ReconcileInfisicalSecret: Fetched secrets via service account")
 
-	} else if authDetails.authStrategy == AuthStrategy.SERVICE_TOKEN { // Service Tokens // ! Legacy / Deprecated auth method
-		infisicalToken, err := r.GetInfisicalTokenFromKubeSecret(ctx, infisicalSecret)
+	} else if authDetails.AuthStrategy == util.AuthStrategy.SERVICE_TOKEN { // Service Tokens // ! Legacy / Deprecated auth method
+		infisicalToken, err := r.getInfisicalTokenFromKubeSecret(ctx, infisicalSecret)
 		if err != nil {
 			return fmt.Errorf("ReconcileInfisicalSecret: unable to get service token from kube secret [err=%s]", err)
 		}
@@ -470,28 +397,30 @@ func (r *InfisicalSecretReconciler) ReconcileInfisicalSecret(ctx context.Context
 			return fmt.Errorf("\nfailed to get secrets because [err=%v]", err)
 		}
 
-		fmt.Println("ReconcileInfisicalSecret: Fetched secrets via [type=SERVICE_TOKEN]")
-	} else if authDetails.isMachineIdentityAuth { // * Machine Identity authentication, the SDK will be authenticated at this point
-		plainTextSecretsFromApi, updateDetails, err = util.GetPlainTextSecretsViaMachineIdentity(infisicalClient, secretVersionBasedOnETag, authDetails.machineIdentityScope)
+		logger.Info("ReconcileInfisicalSecret: Fetched secrets via [type=SERVICE_TOKEN]")
+
+	} else if authDetails.IsMachineIdentityAuth { // * Machine Identity authentication, the SDK will be authenticated at this point
+		plainTextSecretsFromApi, updateDetails, err = util.GetPlainTextSecretsViaMachineIdentity(infisicalClient, secretVersionBasedOnETag, authDetails.MachineIdentityScope)
 
 		if err != nil {
 			return fmt.Errorf("\nfailed to get secrets because [err=%v]", err)
 		}
-		fmt.Printf("ReconcileInfisicalSecret: Fetched secrets via machine identity [type=%v]\n", authDetails.authStrategy)
+
+		logger.Info(fmt.Sprintf("ReconcileInfisicalSecret: Fetched secrets via machine identity [type=%v]", authDetails.AuthStrategy))
 
 	} else {
 		return errors.New("no authentication method provided yet. Please configure a authentication method then try again")
 	}
 
 	if !updateDetails.Modified {
-		fmt.Println("No secrets modified so reconcile not needed")
+		logger.Info("ReconcileInfisicalSecret: No secrets modified so reconcile not needed")
 		return nil
 	}
 
 	if managedKubeSecret == nil {
-		return r.CreateInfisicalManagedKubeSecret(ctx, infisicalSecret, plainTextSecretsFromApi, updateDetails.ETag)
+		return r.createInfisicalManagedKubeSecret(ctx, logger, infisicalSecret, plainTextSecretsFromApi, updateDetails.ETag)
 	} else {
-		return r.UpdateInfisicalManagedKubeSecret(ctx, infisicalSecret, *managedKubeSecret, plainTextSecretsFromApi, updateDetails.ETag)
+		return r.updateInfisicalManagedKubeSecret(ctx, logger, infisicalSecret, *managedKubeSecret, plainTextSecretsFromApi, updateDetails.ETag)
 	}
 
 }

k8-operator/controllers/infisicalsecret_auth.go

@@ -1,150 +0,0 @@
-package controllers
-
-import (
-	"context"
-	"errors"
-	"fmt"
-
-	"github.com/Infisical/infisical/k8-operator/api/v1alpha1"
-	"github.com/Infisical/infisical/k8-operator/packages/util"
-	infisicalSdk "github.com/infisical/go-sdk"
-)
-
-type AuthStrategyType string
-
-var AuthStrategy = struct {
-	SERVICE_TOKEN                 AuthStrategyType
-	SERVICE_ACCOUNT               AuthStrategyType
-	UNIVERSAL_MACHINE_IDENTITY    AuthStrategyType
-	KUBERNETES_MACHINE_IDENTITY   AuthStrategyType
-	AWS_IAM_MACHINE_IDENTITY      AuthStrategyType
-	AZURE_MACHINE_IDENTITY        AuthStrategyType
-	GCP_ID_TOKEN_MACHINE_IDENTITY AuthStrategyType
-	GCP_IAM_MACHINE_IDENTITY      AuthStrategyType
-}{
-	SERVICE_TOKEN:                 "SERVICE_TOKEN",
-	SERVICE_ACCOUNT:               "SERVICE_ACCOUNT",
-	UNIVERSAL_MACHINE_IDENTITY:    "UNIVERSAL_MACHINE_IDENTITY",
-	KUBERNETES_MACHINE_IDENTITY:   "KUBERNETES_AUTH_MACHINE_IDENTITY",
-	AWS_IAM_MACHINE_IDENTITY:      "AWS_IAM_MACHINE_IDENTITY",
-	AZURE_MACHINE_IDENTITY:        "AZURE_MACHINE_IDENTITY",
-	GCP_ID_TOKEN_MACHINE_IDENTITY: "GCP_ID_TOKEN_MACHINE_IDENTITY",
-	GCP_IAM_MACHINE_IDENTITY:      "GCP_IAM_MACHINE_IDENTITY",
-}
-
-type AuthenticationDetails struct {
-	authStrategy          AuthStrategyType
-	machineIdentityScope  v1alpha1.MachineIdentityScopeInWorkspace // This will only be set if a machine identity auth method is used (e.g. UniversalAuth or KubernetesAuth, etc.)
-	isMachineIdentityAuth bool
-}
-
-var ErrAuthNotApplicable = errors.New("authentication not applicable")
-
-func (r *InfisicalSecretReconciler) handleUniversalAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) (AuthenticationDetails, error) {
-
-	// Machine Identities:
-	universalAuthKubeSecret, err := r.GetInfisicalUniversalAuthFromKubeSecret(ctx, infisicalSecret)
-	universalAuthSpec := infisicalSecret.Spec.Authentication.UniversalAuth
-
-	if err != nil {
-		return AuthenticationDetails{}, fmt.Errorf("ReconcileInfisicalSecret: unable to get machine identity creds from kube secret [err=%s]", err)
-	}
-
-	if universalAuthKubeSecret.ClientId == "" && universalAuthKubeSecret.ClientSecret == "" {
-		return AuthenticationDetails{}, ErrAuthNotApplicable
-	}
-
-	_, err = infisicalClient.Auth().UniversalAuthLogin(universalAuthKubeSecret.ClientId, universalAuthKubeSecret.ClientSecret)
-	if err != nil {
-		return AuthenticationDetails{}, fmt.Errorf("unable to login with machine identity credentials [err=%s]", err)
-	}
-
-	fmt.Println("Successfully authenticated with machine identity credentials")
-
-	return AuthenticationDetails{authStrategy: AuthStrategy.UNIVERSAL_MACHINE_IDENTITY, machineIdentityScope: universalAuthSpec.SecretsScope, isMachineIdentityAuth: true}, nil
-
-}
-
-func (r *InfisicalSecretReconciler) handleKubernetesAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) (AuthenticationDetails, error) {
-	kubernetesAuthSpec := infisicalSecret.Spec.Authentication.KubernetesAuth
-
-	if kubernetesAuthSpec.IdentityID == "" {
-		return AuthenticationDetails{}, ErrAuthNotApplicable
-	}
-
-	serviceAccountToken, err := util.GetServiceAccountToken(r.Client, kubernetesAuthSpec.ServiceAccountRef.Namespace, kubernetesAuthSpec.ServiceAccountRef.Name)
-	if err != nil {
-		return AuthenticationDetails{}, fmt.Errorf("unable to get service account token [err=%s]", err)
-	}
-
-	_, err = infisicalClient.Auth().KubernetesRawServiceAccountTokenLogin(kubernetesAuthSpec.IdentityID, serviceAccountToken)
-	if err != nil {
-		return AuthenticationDetails{}, fmt.Errorf("unable to login with Kubernetes native auth [err=%s]", err)
-	}
-
-	return AuthenticationDetails{authStrategy: AuthStrategy.KUBERNETES_MACHINE_IDENTITY, machineIdentityScope: kubernetesAuthSpec.SecretsScope, isMachineIdentityAuth: true}, nil
-
-}
-
-func (r *InfisicalSecretReconciler) handleAwsIamAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) (AuthenticationDetails, error) {
-	awsIamAuthSpec := infisicalSecret.Spec.Authentication.AwsIamAuth
-
-	if awsIamAuthSpec.IdentityID == "" {
-		return AuthenticationDetails{}, ErrAuthNotApplicable
-	}
-
-	_, err := infisicalClient.Auth().AwsIamAuthLogin(awsIamAuthSpec.IdentityID)
-	if err != nil {
-		return AuthenticationDetails{}, fmt.Errorf("unable to login with AWS IAM auth [err=%s]", err)
-	}
-
-	return AuthenticationDetails{authStrategy: AuthStrategy.AWS_IAM_MACHINE_IDENTITY, machineIdentityScope: awsIamAuthSpec.SecretsScope, isMachineIdentityAuth: true}, nil
-
-}
-
-func (r *InfisicalSecretReconciler) handleAzureAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) (AuthenticationDetails, error) {
-	azureAuthSpec := infisicalSecret.Spec.Authentication.AzureAuth
-
-	if azureAuthSpec.IdentityID == "" {
-		return AuthenticationDetails{}, ErrAuthNotApplicable
-	}
-
-	_, err := infisicalClient.Auth().AzureAuthLogin(azureAuthSpec.IdentityID, azureAuthSpec.Resource) // If resource is empty(""), it will default to "https://management.azure.com/" in the SDK.
-	if err != nil {
-		return AuthenticationDetails{}, fmt.Errorf("unable to login with Azure auth [err=%s]", err)
-	}
-
-	return AuthenticationDetails{authStrategy: AuthStrategy.AZURE_MACHINE_IDENTITY, machineIdentityScope: azureAuthSpec.SecretsScope, isMachineIdentityAuth: true}, nil
-
-}
-
-func (r *InfisicalSecretReconciler) handleGcpIdTokenAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) (AuthenticationDetails, error) {
-	gcpIdTokenSpec := infisicalSecret.Spec.Authentication.GcpIdTokenAuth
-
-	if gcpIdTokenSpec.IdentityID == "" {
-		return AuthenticationDetails{}, ErrAuthNotApplicable
-	}
-
-	_, err := infisicalClient.Auth().GcpIdTokenAuthLogin(gcpIdTokenSpec.IdentityID)
-	if err != nil {
-		return AuthenticationDetails{}, fmt.Errorf("unable to login with GCP Id Token auth [err=%s]", err)
-	}
-
-	return AuthenticationDetails{authStrategy: AuthStrategy.GCP_ID_TOKEN_MACHINE_IDENTITY, machineIdentityScope: gcpIdTokenSpec.SecretsScope, isMachineIdentityAuth: true}, nil
-
-}
-
-func (r *InfisicalSecretReconciler) handleGcpIamAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) (AuthenticationDetails, error) {
-	gcpIamSpec := infisicalSecret.Spec.Authentication.GcpIamAuth
-
-	if gcpIamSpec.IdentityID == "" && gcpIamSpec.ServiceAccountKeyFilePath == "" {
-		return AuthenticationDetails{}, ErrAuthNotApplicable
-	}
-
-	_, err := infisicalClient.Auth().GcpIamAuthLogin(gcpIamSpec.IdentityID, gcpIamSpec.ServiceAccountKeyFilePath)
-	if err != nil {
-		return AuthenticationDetails{}, fmt.Errorf("unable to login with GCP IAM auth [err=%s]", err)
-	}
-
-	return AuthenticationDetails{authStrategy: AuthStrategy.GCP_IAM_MACHINE_IDENTITY, machineIdentityScope: gcpIamSpec.SecretsScope, isMachineIdentityAuth: true}, nil
-}