Merge branch 'main' of github.com:Infisical/infisical into sid/k8s-operator

k8-operator/internal/controller/infisicaldynamicsecret_controller.go

@@ -1,5 +1,5 @@
 /*
-Copyright 2022.
+Copyright 2025.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -18,46 +18,221 @@ package controller
 
 import (
 	"context"
+	"fmt"
+	"math/rand"
+	"time"
 
+	infisicaldynamicsecret "github.com/Infisical/infisical/k8-operator/internal/services/infisicaldynamicsecret"
+	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/runtime"
 	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/builder"
 	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/log"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/event"
+	"sigs.k8s.io/controller-runtime/pkg/predicate"
 
 	secretsv1alpha1 "github.com/Infisical/infisical/k8-operator/api/v1alpha1"
+	"github.com/Infisical/infisical/k8-operator/internal/constants"
+	"github.com/Infisical/infisical/k8-operator/internal/controllerhelpers"
+	"github.com/Infisical/infisical/k8-operator/internal/util"
+	"github.com/go-logr/logr"
 )
 
 // InfisicalDynamicSecretReconciler reconciles a InfisicalDynamicSecret object
 type InfisicalDynamicSecretReconciler struct {
 	client.Client
-	Scheme *runtime.Scheme
+	BaseLogger        logr.Logger
+	Scheme            *runtime.Scheme
+	Random            *rand.Rand
+	Namespace         string
+	IsNamespaceScoped bool
+}
+
+var infisicalDynamicSecretsResourceVariablesMap map[string]util.ResourceVariables = make(map[string]util.ResourceVariables)
+
+func (r *InfisicalDynamicSecretReconciler) GetLogger(req ctrl.Request) logr.Logger {
+	return r.BaseLogger.WithValues("infisicaldynamicsecret", req.NamespacedName)
 }
 
 // +kubebuilder:rbac:groups=secrets.infisical.com,resources=infisicaldynamicsecrets,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=secrets.infisical.com,resources=infisicaldynamicsecrets/status,verbs=get;update;patch
 // +kubebuilder:rbac:groups=secrets.infisical.com,resources=infisicaldynamicsecrets/finalizers,verbs=update
+// +kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch;create;update;delete
+// +kubebuilder:rbac:groups="",resources=configmaps,verbs=get;list;watch;create;update;delete
+// +kubebuilder:rbac:groups=apps,resources=deployments,verbs=list;watch;get;update
+// +kubebuilder:rbac:groups="",resources=serviceaccounts,verbs=get;list;watch
+//+kubebuilder:rbac:groups="",resources=pods,verbs=get;list
+//+kubebuilder:rbac:groups="authentication.k8s.io",resources=tokenreviews,verbs=create
+//+kubebuilder:rbac:groups="",resources=serviceaccounts/token,verbs=create
 
-// Reconcile is part of the main kubernetes reconciliation loop which aims to
-// move the current state of the cluster closer to the desired state.
-// TODO(user): Modify the Reconcile function to compare the state specified by
-// the InfisicalDynamicSecret object against the actual cluster state, and then
-// perform operations to make the cluster state reflect the state specified by
-// the user.
-//
-// For more details, check Reconcile and its Result here:
-// - https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.19.1/pkg/reconcile
 func (r *InfisicalDynamicSecretReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
-	_ = log.FromContext(ctx)
 
-	// TODO(user): your logic here
+	logger := r.GetLogger(req)
 
-	return ctrl.Result{}, nil
+	var infisicalDynamicSecretCRD secretsv1alpha1.InfisicalDynamicSecret
+	requeueTime := time.Second * 5
+
+	err := r.Get(ctx, req.NamespacedName, &infisicalDynamicSecretCRD)
+	if err != nil {
+		if errors.IsNotFound(err) {
+			logger.Info("Infisical Dynamic Secret CRD not found")
+			return ctrl.Result{
+				Requeue: false,
+			}, nil
+		} else {
+			logger.Error(err, "Unable to fetch Infisical Dynamic Secret CRD from cluster")
+			return ctrl.Result{
+				RequeueAfter: requeueTime,
+			}, nil
+		}
+	}
+
+	// Add finalizer if it doesn't exist
+	if !controllerutil.ContainsFinalizer(&infisicalDynamicSecretCRD, constants.INFISICAL_DYNAMIC_SECRET_FINALIZER_NAME) {
+		controllerutil.AddFinalizer(&infisicalDynamicSecretCRD, constants.INFISICAL_DYNAMIC_SECRET_FINALIZER_NAME)
+		if err := r.Update(ctx, &infisicalDynamicSecretCRD); err != nil {
+			return ctrl.Result{}, err
+		}
+	}
+
+	// Check if it's being deleted
+	if !infisicalDynamicSecretCRD.DeletionTimestamp.IsZero() {
+		logger.Info("Handling deletion of InfisicalDynamicSecret")
+		if controllerutil.ContainsFinalizer(&infisicalDynamicSecretCRD, constants.INFISICAL_DYNAMIC_SECRET_FINALIZER_NAME) {
+			// We remove finalizers before running deletion logic to be completely safe from stuck resources
+			infisicalDynamicSecretCRD.ObjectMeta.Finalizers = []string{}
+			if err := r.Update(ctx, &infisicalDynamicSecretCRD); err != nil {
+				logger.Error(err, fmt.Sprintf("Error removing finalizers from InfisicalDynamicSecret %s", infisicalDynamicSecretCRD.Name))
+				return ctrl.Result{}, err
+			}
+
+			// Initialize the business logic handler
+			handler := infisicaldynamicsecret.NewInfisicalDynamicSecretHandler(r.Client, r.Scheme, r.IsNamespaceScoped)
+
+			err := handler.HandleLeaseRevocation(ctx, logger, &infisicalDynamicSecretCRD, infisicalDynamicSecretsResourceVariablesMap)
+
+			if infisicalDynamicSecretsResourceVariablesMap != nil {
+				if rv, ok := infisicalDynamicSecretsResourceVariablesMap[string(infisicalDynamicSecretCRD.GetUID())]; ok {
+					rv.CancelCtx()
+					delete(infisicalDynamicSecretsResourceVariablesMap, string(infisicalDynamicSecretCRD.GetUID()))
+				}
+			}
+
+			if err != nil {
+				return ctrl.Result{}, err // Even if this fails, we still want to delete the CRD
+			}
+
+		}
+		return ctrl.Result{}, nil
+	}
+
+	// Get modified/default config
+	infisicalConfig, err := controllerhelpers.GetInfisicalConfigMap(ctx, r.Client, r.IsNamespaceScoped)
+	if err != nil {
+		logger.Error(err, fmt.Sprintf("unable to fetch infisical-config. Will requeue after [requeueTime=%v]", requeueTime))
+		return ctrl.Result{
+			RequeueAfter: requeueTime,
+		}, nil
+	}
+
+	// Initialize the business logic handler
+	handler := infisicaldynamicsecret.NewInfisicalDynamicSecretHandler(r.Client, r.Scheme, r.IsNamespaceScoped)
+
+	// Setup API configuration through business logic
+	err = handler.SetupAPIConfig(infisicalDynamicSecretCRD, infisicalConfig)
+	if err != nil {
+		logger.Error(err, fmt.Sprintf("unable to setup API configuration. Will requeue after [requeueTime=%v]", requeueTime))
+		return ctrl.Result{
+			RequeueAfter: requeueTime,
+		}, nil
+	}
+
+	// Handle CA certificate through business logic
+	err = handler.HandleCACertificate(ctx, infisicalDynamicSecretCRD)
+	if err != nil {
+		logger.Error(err, fmt.Sprintf("unable to handle CA certificate. Will requeue after [requeueTime=%v]", requeueTime))
+		return ctrl.Result{
+			RequeueAfter: requeueTime,
+		}, nil
+	}
+
+	nextReconcile, err := handler.ReconcileInfisicalDynamicSecret(ctx, logger, &infisicalDynamicSecretCRD, infisicalDynamicSecretsResourceVariablesMap)
+	handler.SetReconcileConditionStatus(ctx, logger, &infisicalDynamicSecretCRD, err)
+
+	if err == nil && nextReconcile.Seconds() >= 5 {
+		requeueTime = nextReconcile
+	}
+
+	if err != nil {
+		logger.Error(err, fmt.Sprintf("unable to reconcile Infisical Dynamic Secret. Will requeue after [requeueTime=%v]", requeueTime))
+		return ctrl.Result{
+			RequeueAfter: requeueTime,
+		}, nil
+	}
+
+	numDeployments, err := controllerhelpers.ReconcileDeploymentsWithManagedSecrets(ctx, r.Client, logger, infisicalDynamicSecretCRD.Spec.ManagedSecretReference, r.IsNamespaceScoped)
+	handler.SetReconcileAutoRedeploymentConditionStatus(ctx, logger, &infisicalDynamicSecretCRD, numDeployments, err)
+
+	if err != nil {
+		logger.Error(err, fmt.Sprintf("unable to reconcile auto redeployment. Will requeue after [requeueTime=%v]", requeueTime))
+		return ctrl.Result{
+			RequeueAfter: requeueTime,
+		}, nil
+	}
+
+	// Sync again after the specified time
+	logger.Info(fmt.Sprintf("Next reconciliation in [requeueTime=%v]", requeueTime))
+	return ctrl.Result{
+		RequeueAfter: requeueTime,
+	}, nil
 }
 
-// SetupWithManager sets up the controller with the Manager.
 func (r *InfisicalDynamicSecretReconciler) SetupWithManager(mgr ctrl.Manager) error {
+
+	// Custom predicate that allows both spec changes and deletions
+	specChangeOrDelete := predicate.Funcs{
+		UpdateFunc: func(e event.UpdateEvent) bool {
+			// Only reconcile if spec/generation changed
+
+			isSpecOrGenerationChange := e.ObjectOld.GetGeneration() != e.ObjectNew.GetGeneration()
+
+			if isSpecOrGenerationChange {
+				if infisicalDynamicSecretsResourceVariablesMap != nil {
+					if rv, ok := infisicalDynamicSecretsResourceVariablesMap[string(e.ObjectNew.GetUID())]; ok {
+						rv.CancelCtx()
+						delete(infisicalDynamicSecretsResourceVariablesMap, string(e.ObjectNew.GetUID()))
+					}
+				}
+			}
+
+			return isSpecOrGenerationChange
+		},
+		DeleteFunc: func(e event.DeleteEvent) bool {
+			// Always reconcile on deletion
+
+			if infisicalDynamicSecretsResourceVariablesMap != nil {
+				if rv, ok := infisicalDynamicSecretsResourceVariablesMap[string(e.Object.GetUID())]; ok {
+					rv.CancelCtx()
+					delete(infisicalDynamicSecretsResourceVariablesMap, string(e.Object.GetUID()))
+				}
+			}
+
+			return true
+		},
+		CreateFunc: func(e event.CreateEvent) bool {
+			// Reconcile on creation
+			return true
+		},
+		GenericFunc: func(e event.GenericEvent) bool {
+			// Ignore generic events
+			return false
+		},
+	}
+
 	return ctrl.NewControllerManagedBy(mgr).
-		For(&secretsv1alpha1.InfisicalDynamicSecret{}).
-		Named("infisicaldynamicsecret").
+		For(&secretsv1alpha1.InfisicalDynamicSecret{}, builder.WithPredicates(
+			specChangeOrDelete,
+		)).
 		Complete(r)
 }

k8-operator/internal/controller/infisicaldynamicsecret_controller_test.go

@@ -0,0 +1,84 @@
+/*
+Copyright 2025.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package controller
+
+import (
+	"context"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	secretsv1alpha1 "github.com/Infisical/infisical/k8-operator/api/v1alpha1"
+)
+
+var _ = Describe("InfisicalDynamicSecret Controller", func() {
+	Context("When reconciling a resource", func() {
+		const resourceName = "test-resource"
+
+		ctx := context.Background()
+
+		typeNamespacedName := types.NamespacedName{
+			Name:      resourceName,
+			Namespace: "default", // TODO(user):Modify as needed
+		}
+		infisicaldynamicsecret := &secretsv1alpha1.InfisicalDynamicSecret{}
+
+		BeforeEach(func() {
+			By("creating the custom resource for the Kind InfisicalDynamicSecret")
+			err := k8sClient.Get(ctx, typeNamespacedName, infisicaldynamicsecret)
+			if err != nil && errors.IsNotFound(err) {
+				resource := &secretsv1alpha1.InfisicalDynamicSecret{
+					ObjectMeta: metav1.ObjectMeta{
+						Name:      resourceName,
+						Namespace: "default",
+					},
+					// TODO(user): Specify other spec details if needed.
+				}
+				Expect(k8sClient.Create(ctx, resource)).To(Succeed())
+			}
+		})
+
+		AfterEach(func() {
+			// TODO(user): Cleanup logic after each test, like removing the resource instance.
+			resource := &secretsv1alpha1.InfisicalDynamicSecret{}
+			err := k8sClient.Get(ctx, typeNamespacedName, resource)
+			Expect(err).NotTo(HaveOccurred())
+
+			By("Cleanup the specific resource instance InfisicalDynamicSecret")
+			Expect(k8sClient.Delete(ctx, resource)).To(Succeed())
+		})
+		It("should successfully reconcile the resource", func() {
+			By("Reconciling the created resource")
+			controllerReconciler := &InfisicalDynamicSecretReconciler{
+				Client: k8sClient,
+				Scheme: k8sClient.Scheme(),
+			}
+
+			_, err := controllerReconciler.Reconcile(ctx, reconcile.Request{
+				NamespacedName: typeNamespacedName,
+			})
+			Expect(err).NotTo(HaveOccurred())
+			// TODO(user): Add more specific assertions depending on your controller's reconciliation logic.
+			// Example: If you expect a certain status condition after reconciliation, verify it here.
+		})
+	})
+})

k8-operator/internal/controller/infisicalpushsecret_controller.go

@@ -0,0 +1,349 @@
+/*
+Copyright 2025.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package controller
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	infisicalpushsecret "github.com/Infisical/infisical/k8-operator/internal/services/infisicalpushsecret"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/builder"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/event"
+	"sigs.k8s.io/controller-runtime/pkg/handler"
+	"sigs.k8s.io/controller-runtime/pkg/predicate"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+
+	secretsv1alpha1 "github.com/Infisical/infisical/k8-operator/api/v1alpha1"
+	"github.com/Infisical/infisical/k8-operator/internal/constants"
+	"github.com/Infisical/infisical/k8-operator/internal/controllerhelpers"
+	"github.com/Infisical/infisical/k8-operator/internal/util"
+	"github.com/go-logr/logr"
+)
+
+// InfisicalPushSecretReconciler reconciles a InfisicalPushSecretSecret object
+type InfisicalPushSecretReconciler struct {
+	client.Client
+	BaseLogger        logr.Logger
+	Scheme            *runtime.Scheme
+	IsNamespaceScoped bool
+	Namespace         string
+}
+
+var infisicalPushSecretResourceVariablesMap map[string]util.ResourceVariables = make(map[string]util.ResourceVariables)
+
+func (r *InfisicalPushSecretReconciler) GetLogger(req ctrl.Request) logr.Logger {
+	return r.BaseLogger.WithValues("infisicalpushsecret", req.NamespacedName)
+}
+
+//+kubebuilder:rbac:groups=secrets.infisical.com,resources=infisicalpushsecrets,verbs=get;list;watch;create;update;patch;delete
+//+kubebuilder:rbac:groups=secrets.infisical.com,resources=infisicalpushsecrets/status,verbs=get;update;patch
+//+kubebuilder:rbac:groups=secrets.infisical.com,resources=infisicalpushsecrets/finalizers,verbs=update
+//+kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch;create;update;delete
+//+kubebuilder:rbac:groups="",resources=configmaps,verbs=get;list;watch;create;update;delete
+//+kubebuilder:rbac:groups=apps,resources=deployments,verbs=list;watch;get;update
+//+kubebuilder:rbac:groups="",resources=serviceaccounts,verbs=get;list;watch
+//+kubebuilder:rbac:groups="",resources=pods,verbs=get;list
+//+kubebuilder:rbac:groups="authentication.k8s.io",resources=tokenreviews,verbs=create
+//+kubebuilder:rbac:groups="",resources=serviceaccounts/token,verbs=create
+//+kubebuilder:rbac:groups=secrets.infisical.com,resources=clustergenerators,verbs=get;list;watch;create;update;patch;delete
+
+func (r *InfisicalPushSecretReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
+
+	logger := r.GetLogger(req)
+
+	var infisicalPushSecretCRD secretsv1alpha1.InfisicalPushSecret
+	requeueTime := time.Minute // seconds
+
+	err := r.Get(ctx, req.NamespacedName, &infisicalPushSecretCRD)
+	if err != nil {
+		if errors.IsNotFound(err) {
+			logger.Info("Infisical Push Secret CRD not found")
+			// Initialize the business logic handler
+			handler := infisicalpushsecret.NewInfisicalPushSecretHandler(r.Client, r.Scheme, r.IsNamespaceScoped)
+			handler.DeleteManagedSecrets(ctx, logger, &infisicalPushSecretCRD, infisicalPushSecretResourceVariablesMap)
+
+			return ctrl.Result{
+				Requeue: false,
+			}, nil
+		} else {
+			logger.Error(err, "Unable to fetch Infisical Secret CRD from cluster")
+			return ctrl.Result{
+				RequeueAfter: requeueTime,
+			}, nil
+		}
+	}
+
+	// Add finalizer if it doesn't exist
+	if !controllerutil.ContainsFinalizer(&infisicalPushSecretCRD, constants.INFISICAL_PUSH_SECRET_FINALIZER_NAME) {
+		controllerutil.AddFinalizer(&infisicalPushSecretCRD, constants.INFISICAL_PUSH_SECRET_FINALIZER_NAME)
+		if err := r.Update(ctx, &infisicalPushSecretCRD); err != nil {
+			return ctrl.Result{}, err
+		}
+	}
+
+	// Check if it's being deleted
+	if !infisicalPushSecretCRD.DeletionTimestamp.IsZero() {
+		logger.Info("Handling deletion of InfisicalPushSecret")
+		if controllerutil.ContainsFinalizer(&infisicalPushSecretCRD, constants.INFISICAL_PUSH_SECRET_FINALIZER_NAME) {
+			// We remove finalizers before running deletion logic to be completely safe from stuck resources
+			infisicalPushSecretCRD.ObjectMeta.Finalizers = []string{}
+			if err := r.Update(ctx, &infisicalPushSecretCRD); err != nil {
+				logger.Error(err, fmt.Sprintf("Error removing finalizers from InfisicalPushSecret %s", infisicalPushSecretCRD.Name))
+				return ctrl.Result{}, err
+			}
+
+			// Initialize the business logic handler
+			handler := infisicalpushsecret.NewInfisicalPushSecretHandler(r.Client, r.Scheme, r.IsNamespaceScoped)
+
+			if err := handler.DeleteManagedSecrets(ctx, logger, &infisicalPushSecretCRD, infisicalPushSecretResourceVariablesMap); err != nil {
+				return ctrl.Result{}, err // Even if this fails, we still want to delete the CRD
+			}
+
+		}
+		return ctrl.Result{}, nil
+	}
+
+	if infisicalPushSecretCRD.Spec.Push.Secret == nil && infisicalPushSecretCRD.Spec.Push.Generators == nil {
+		logger.Info("No secret or generators found, skipping reconciliation. Please define ")
+		return ctrl.Result{}, nil
+	}
+
+	duration, err := util.ConvertIntervalToDuration(infisicalPushSecretCRD.Spec.ResyncInterval)
+
+	if err != nil {
+		// if resyncInterval is nil, we don't want to reconcile automatically
+		if infisicalPushSecretCRD.Spec.ResyncInterval != nil {
+			logger.Error(err, fmt.Sprintf("unable to convert resync interval to duration. Will requeue after [requeueTime=%v]", requeueTime))
+			return ctrl.Result{
+				RequeueAfter: requeueTime,
+			}, nil
+		} else {
+			logger.Error(err, "unable to convert resync interval to duration")
+			return ctrl.Result{}, err
+		}
+	}
+
+	requeueTime = duration
+
+	if requeueTime != 0 {
+		logger.Info(fmt.Sprintf("Manual re-sync interval set. Interval: %v", requeueTime))
+	}
+
+	// Check if the resource is already marked for deletion
+	if infisicalPushSecretCRD.GetDeletionTimestamp() != nil {
+		return ctrl.Result{
+			Requeue: false,
+		}, nil
+	}
+
+	// Get modified/default config
+	infisicalConfig, err := controllerhelpers.GetInfisicalConfigMap(ctx, r.Client, r.IsNamespaceScoped)
+	if err != nil {
+		if requeueTime != 0 {
+			logger.Error(err, fmt.Sprintf("unable to fetch infisical-config. Will requeue after [requeueTime=%v]", requeueTime))
+			return ctrl.Result{
+				RequeueAfter: requeueTime,
+			}, nil
+		} else {
+			logger.Error(err, "unable to fetch infisical-config")
+			return ctrl.Result{}, err
+		}
+	}
+
+	// Initialize the business logic handler
+	handler := infisicalpushsecret.NewInfisicalPushSecretHandler(r.Client, r.Scheme, r.IsNamespaceScoped)
+
+	// Setup API configuration through business logic
+	err = handler.SetupAPIConfig(infisicalPushSecretCRD, infisicalConfig)
+	if err != nil {
+		if requeueTime != 0 {
+			logger.Error(err, fmt.Sprintf("unable to setup API configuration. Will requeue after [requeueTime=%v]", requeueTime))
+			return ctrl.Result{
+				RequeueAfter: requeueTime,
+			}, nil
+		} else {
+			logger.Error(err, "unable to setup API configuration")
+			return ctrl.Result{}, err
+		}
+	}
+
+	// Handle CA certificate through business logic
+	err = handler.HandleCACertificate(ctx, infisicalPushSecretCRD)
+	if err != nil {
+		if requeueTime != 0 {
+			logger.Error(err, fmt.Sprintf("unable to fetch CA certificate. Will requeue after [requeueTime=%v]", requeueTime))
+			return ctrl.Result{
+				RequeueAfter: requeueTime,
+			}, nil
+		} else {
+			logger.Error(err, "unable to fetch CA certificate")
+			return ctrl.Result{}, err
+		}
+	}
+
+	err = handler.ReconcileInfisicalPushSecret(ctx, logger, &infisicalPushSecretCRD, infisicalPushSecretResourceVariablesMap)
+	handler.SetReconcileStatusCondition(ctx, &infisicalPushSecretCRD, err)
+
+	if err != nil {
+		if requeueTime != 0 {
+			logger.Error(err, fmt.Sprintf("unable to reconcile Infisical Push Secret. Will requeue after [requeueTime=%v]", requeueTime))
+			return ctrl.Result{
+				RequeueAfter: requeueTime,
+			}, nil
+		} else {
+			logger.Error(err, "unable to reconcile Infisical Push Secret")
+			return ctrl.Result{}, err
+		}
+	}
+
+	// Sync again after the specified time
+	if requeueTime != 0 {
+		logger.Info(fmt.Sprintf("Operator will requeue after [%v]", requeueTime))
+		return ctrl.Result{
+			RequeueAfter: requeueTime,
+		}, nil
+	} else {
+		logger.Info("Operator will reconcile on next spec change")
+		return ctrl.Result{}, nil
+	}
+}
+
+func (r *InfisicalPushSecretReconciler) SetupWithManager(mgr ctrl.Manager) error {
+	// Custom predicate that allows both spec changes and deletions
+	specChangeOrDelete := predicate.Funcs{
+		UpdateFunc: func(e event.UpdateEvent) bool {
+			// Only reconcile if spec/generation changed
+
+			isSpecOrGenerationChange := e.ObjectOld.GetGeneration() != e.ObjectNew.GetGeneration()
+
+			if isSpecOrGenerationChange {
+				if infisicalPushSecretResourceVariablesMap != nil {
+					if rv, ok := infisicalPushSecretResourceVariablesMap[string(e.ObjectNew.GetUID())]; ok {
+						rv.CancelCtx()
+						delete(infisicalPushSecretResourceVariablesMap, string(e.ObjectNew.GetUID()))
+					}
+				}
+			}
+
+			return isSpecOrGenerationChange
+		},
+		DeleteFunc: func(e event.DeleteEvent) bool {
+			// Always reconcile on deletion
+
+			if infisicalPushSecretResourceVariablesMap != nil {
+				if rv, ok := infisicalPushSecretResourceVariablesMap[string(e.Object.GetUID())]; ok {
+					rv.CancelCtx()
+					delete(infisicalPushSecretResourceVariablesMap, string(e.Object.GetUID()))
+				}
+			}
+
+			return true
+		},
+		CreateFunc: func(e event.CreateEvent) bool {
+			// Reconcile on creation
+			return true
+		},
+		GenericFunc: func(e event.GenericEvent) bool {
+			// Ignore generic events
+			return false
+		},
+	}
+
+	controllerManager := ctrl.NewControllerManagedBy(mgr).
+		For(&secretsv1alpha1.InfisicalPushSecret{}, builder.WithPredicates(
+			specChangeOrDelete,
+		)).
+		Watches(
+			&corev1.Secret{},
+			handler.EnqueueRequestsFromMapFunc(r.findPushSecretsForSecret),
+		)
+
+	if !r.IsNamespaceScoped {
+		r.BaseLogger.Info("Watching ClusterGenerators for non-namespace scoped operator")
+		controllerManager.Watches(
+			&secretsv1alpha1.ClusterGenerator{},
+			handler.EnqueueRequestsFromMapFunc(r.findPushSecretsForClusterGenerator),
+		)
+	} else {
+		r.BaseLogger.Info("Not watching ClusterGenerators for namespace scoped operator")
+	}
+
+	return controllerManager.Complete(r)
+}
+
+func (r *InfisicalPushSecretReconciler) findPushSecretsForClusterGenerator(ctx context.Context, o client.Object) []reconcile.Request {
+	pushSecrets := &secretsv1alpha1.InfisicalPushSecretList{}
+	if err := r.List(ctx, pushSecrets); err != nil {
+		return []reconcile.Request{}
+	}
+
+	clusterGenerator, ok := o.(*secretsv1alpha1.ClusterGenerator)
+	if !ok {
+		return []reconcile.Request{}
+	}
+
+	requests := []reconcile.Request{}
+
+	for _, pushSecret := range pushSecrets.Items {
+		if pushSecret.Spec.Push.Generators != nil {
+			for _, generator := range pushSecret.Spec.Push.Generators {
+				if generator.GeneratorRef.Name == clusterGenerator.GetName() {
+					requests = append(requests, reconcile.Request{
+						NamespacedName: types.NamespacedName{
+							Name:      pushSecret.GetName(),
+							Namespace: pushSecret.GetNamespace(),
+						},
+					})
+					break
+				}
+			}
+		}
+	}
+	return requests
+}
+
+func (r *InfisicalPushSecretReconciler) findPushSecretsForSecret(ctx context.Context, o client.Object) []reconcile.Request {
+	pushSecrets := &secretsv1alpha1.InfisicalPushSecretList{}
+	if err := r.List(ctx, pushSecrets); err != nil {
+		return []reconcile.Request{}
+	}
+
+	requests := []reconcile.Request{}
+	for _, pushSecret := range pushSecrets.Items {
+		if pushSecret.Spec.Push.Secret != nil &&
+			pushSecret.Spec.Push.Secret.SecretName == o.GetName() &&
+			pushSecret.Spec.Push.Secret.SecretNamespace == o.GetNamespace() {
+			requests = append(requests, reconcile.Request{
+				NamespacedName: types.NamespacedName{
+					Name:      pushSecret.GetName(),
+					Namespace: pushSecret.GetNamespace(),
+				},
+			})
+		}
+
+	}
+
+	return requests
+}

k8-operator/internal/controller/infisicalpushsecret_controller_test.go

@@ -0,0 +1,84 @@
+/*
+Copyright 2025.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package controller
+
+import (
+	"context"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	secretsv1alpha1 "github.com/Infisical/infisical/k8-operator/api/v1alpha1"
+)
+
+var _ = Describe("InfisicalPushSecretSecret Controller", func() {
+	Context("When reconciling a resource", func() {
+		const resourceName = "test-resource"
+
+		ctx := context.Background()
+
+		typeNamespacedName := types.NamespacedName{
+			Name:      resourceName,
+			Namespace: "default", // TODO(user):Modify as needed
+		}
+		infisicalpushsecretsecret := &secretsv1alpha1.InfisicalPushSecret{}
+
+		BeforeEach(func() {
+			By("creating the custom resource for the Kind InfisicalPushSecretSecret")
+			err := k8sClient.Get(ctx, typeNamespacedName, infisicalpushsecretsecret)
+			if err != nil && errors.IsNotFound(err) {
+				resource := &secretsv1alpha1.InfisicalPushSecret{
+					ObjectMeta: metav1.ObjectMeta{
+						Name:      resourceName,
+						Namespace: "default",
+					},
+					// TODO(user): Specify other spec details if needed.
+				}
+				Expect(k8sClient.Create(ctx, resource)).To(Succeed())
+			}
+		})
+
+		AfterEach(func() {
+			// TODO(user): Cleanup logic after each test, like removing the resource instance.
+			resource := &secretsv1alpha1.InfisicalPushSecret{}
+			err := k8sClient.Get(ctx, typeNamespacedName, resource)
+			Expect(err).NotTo(HaveOccurred())
+
+			By("Cleanup the specific resource instance InfisicalPushSecretSecret")
+			Expect(k8sClient.Delete(ctx, resource)).To(Succeed())
+		})
+		It("should successfully reconcile the resource", func() {
+			By("Reconciling the created resource")
+			controllerReconciler := &InfisicalPushSecretReconciler{
+				Client: k8sClient,
+				Scheme: k8sClient.Scheme(),
+			}
+
+			_, err := controllerReconciler.Reconcile(ctx, reconcile.Request{
+				NamespacedName: typeNamespacedName,
+			})
+			Expect(err).NotTo(HaveOccurred())
+			// TODO(user): Add more specific assertions depending on your controller's reconciliation logic.
+			// Example: If you expect a certain status condition after reconciliation, verify it here.
+		})
+	})
+})

k8-operator/internal/controller/infisicalsecret_controller.go

@@ -0,0 +1,256 @@
+/*
+Copyright 2025.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package controller
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	defaultErrors "errors"
+
+	infisicalsecret "github.com/Infisical/infisical/k8-operator/internal/services/infisicalsecret"
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/runtime"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/builder"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/event"
+	"sigs.k8s.io/controller-runtime/pkg/predicate"
+	"sigs.k8s.io/controller-runtime/pkg/source"
+
+	secretsv1alpha1 "github.com/Infisical/infisical/k8-operator/api/v1alpha1"
+	"github.com/Infisical/infisical/k8-operator/internal/controllerhelpers"
+	"github.com/Infisical/infisical/k8-operator/internal/util"
+	"github.com/go-logr/logr"
+)
+
+// InfisicalSecretReconciler reconciles a InfisicalSecret object
+type InfisicalSecretReconciler struct {
+	client.Client
+	BaseLogger logr.Logger
+	Scheme     *runtime.Scheme
+
+	SourceCh          chan event.TypedGenericEvent[client.Object]
+	Namespace         string
+	IsNamespaceScoped bool
+}
+
+var infisicalSecretResourceVariablesMap map[string]util.ResourceVariables = make(map[string]util.ResourceVariables)
+
+func (r *InfisicalSecretReconciler) GetLogger(req ctrl.Request) logr.Logger {
+	return r.BaseLogger.WithValues("infisicalsecret", req.NamespacedName)
+}
+
+//+kubebuilder:rbac:groups=secrets.infisical.com,resources=infisicalsecrets,verbs=get;list;watch;create;update;patch;delete
+//+kubebuilder:rbac:groups=secrets.infisical.com,resources=infisicalsecrets/status,verbs=get;update;patch
+//+kubebuilder:rbac:groups=secrets.infisical.com,resources=infisicalsecrets/finalizers,verbs=update
+//+kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch;create;update;delete
+//+kubebuilder:rbac:groups="",resources=configmaps,verbs=get;list;watch;create;update;delete
+//+kubebuilder:rbac:groups=apps,resources=deployments;daemonsets;statefulsets,verbs=list;watch;get;update
+//+kubebuilder:rbac:groups="",resources=serviceaccounts,verbs=get;list;watch
+//+kubebuilder:rbac:groups="",resources=pods,verbs=get;list
+//+kubebuilder:rbac:groups="authentication.k8s.io",resources=tokenreviews,verbs=create
+//+kubebuilder:rbac:groups="",resources=serviceaccounts/token,verbs=create
+
+// Reconcile is part of the main kubernetes reconciliation loop which aims to
+// move the current state of the cluster closer to the desired state.
+// TODO(user): Modify the Reconcile function to compare the state specified by
+// the InfisicalSecret object against the actual cluster state, and then
+// perform operations to make the cluster state reflect the state specified by
+// the user.
+//
+// For more details, check Reconcile and its Result here:
+// - https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.21.0/pkg/reconcile
+func (r *InfisicalSecretReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
+	logger := r.GetLogger(req)
+
+	logger.Info("Reconcile called")
+
+	var infisicalSecretCRD secretsv1alpha1.InfisicalSecret
+	requeueTime := time.Minute // seconds
+
+	err := r.Get(ctx, req.NamespacedName, &infisicalSecretCRD)
+	if err != nil {
+		if errors.IsNotFound(err) {
+			return ctrl.Result{
+				Requeue: false,
+			}, nil
+		} else {
+			logger.Error(err, "unable to fetch Infisical Secret CRD from cluster")
+			return ctrl.Result{
+				RequeueAfter: requeueTime,
+			}, nil
+		}
+	}
+
+	// It's important we don't directly modify the CRD object, so we create a copy of it and move existing data into it.
+	managedKubeSecretReferences := infisicalSecretCRD.Spec.ManagedKubeSecretReferences
+	managedKubeConfigMapReferences := infisicalSecretCRD.Spec.ManagedKubeConfigMapReferences
+
+	if infisicalSecretCRD.Spec.ManagedSecretReference.SecretName != "" && managedKubeSecretReferences != nil && len(managedKubeSecretReferences) > 0 {
+		errMessage := "InfisicalSecret CRD cannot have both managedSecretReference and managedKubeSecretReferences"
+		logger.Error(defaultErrors.New(errMessage), errMessage)
+		return ctrl.Result{}, defaultErrors.New(errMessage)
+	}
+
+	if infisicalSecretCRD.Spec.ManagedSecretReference.SecretName != "" {
+		logger.Info("\n\n\nThe field `managedSecretReference` will be deprecated in the near future, please use `managedKubeSecretReferences` instead.\n\nRefer to the documentation for more information: https://infisical.com/docs/integrations/platforms/kubernetes/infisical-secret-crd\n\n\n")
+
+		if managedKubeSecretReferences == nil {
+			managedKubeSecretReferences = []secretsv1alpha1.ManagedKubeSecretConfig{}
+		}
+		managedKubeSecretReferences = append(managedKubeSecretReferences, infisicalSecretCRD.Spec.ManagedSecretReference)
+	}
+
+	if len(managedKubeSecretReferences) == 0 && len(managedKubeConfigMapReferences) == 0 {
+		errMessage := "InfisicalSecret CRD must have at least one managed secret reference set in the `managedKubeSecretReferences` or `managedKubeConfigMapReferences` field"
+		logger.Error(defaultErrors.New(errMessage), errMessage)
+		return ctrl.Result{}, defaultErrors.New(errMessage)
+	}
+
+	// Remove finalizers if they exist. This is to support previous InfisicalSecret CRD's that have finalizers on them.
+	// In order to delete secrets with finalizers, we first remove the finalizers so we can use the simplified and improved deletion process
+	if !infisicalSecretCRD.ObjectMeta.DeletionTimestamp.IsZero() && len(infisicalSecretCRD.ObjectMeta.Finalizers) > 0 {
+		infisicalSecretCRD.ObjectMeta.Finalizers = []string{}
+		if err := r.Update(ctx, &infisicalSecretCRD); err != nil {
+			logger.Error(err, fmt.Sprintf("Error removing finalizers from Infisical Secret %s", infisicalSecretCRD.Name))
+			return ctrl.Result{}, err
+		}
+		// Our finalizers have been removed, so the reconciler can do nothing.
+		return ctrl.Result{}, nil
+	}
+
+	if infisicalSecretCRD.Spec.ResyncInterval != 0 {
+		requeueTime = time.Second * time.Duration(infisicalSecretCRD.Spec.ResyncInterval)
+		logger.Info(fmt.Sprintf("Manual re-sync interval set. Interval: %v", requeueTime))
+
+	} else {
+		logger.Info(fmt.Sprintf("Re-sync interval set. Interval: %v", requeueTime))
+	}
+
+	// Check if the resource is already marked for deletion
+	if infisicalSecretCRD.GetDeletionTimestamp() != nil {
+		return ctrl.Result{
+			Requeue: false,
+		}, nil
+	}
+
+	// Get modified/default config
+	infisicalConfig, err := controllerhelpers.GetInfisicalConfigMap(ctx, r.Client, r.IsNamespaceScoped)
+	if err != nil {
+		logger.Error(err, fmt.Sprintf("unable to fetch infisical-config. Will requeue after [requeueTime=%v]", requeueTime))
+		return ctrl.Result{
+			RequeueAfter: requeueTime,
+		}, nil
+	}
+
+	// Initialize the business logic handler
+	handler := infisicalsecret.NewInfisicalSecretHandler(r.Client, r.Scheme, r.IsNamespaceScoped)
+
+	// Setup API configuration through business logic
+	err = handler.SetupAPIConfig(infisicalSecretCRD, infisicalConfig)
+	if err != nil {
+		logger.Error(err, fmt.Sprintf("unable to setup API configuration. Will requeue after [requeueTime=%v]", requeueTime))
+		return ctrl.Result{
+			RequeueAfter: requeueTime,
+		}, nil
+	}
+
+	// Handle CA certificate through business logic
+	err = handler.HandleCACertificate(ctx, infisicalSecretCRD)
+	if err != nil {
+		logger.Error(err, fmt.Sprintf("unable to handle CA certificate. Will requeue after [requeueTime=%v]", requeueTime))
+		return ctrl.Result{
+			RequeueAfter: requeueTime,
+		}, nil
+	}
+
+	secretsCount, err := handler.ReconcileInfisicalSecret(ctx, logger, &infisicalSecretCRD, managedKubeSecretReferences, managedKubeConfigMapReferences, infisicalSecretResourceVariablesMap)
+	handler.SetReadyToSyncSecretsConditions(ctx, logger, &infisicalSecretCRD, secretsCount, err)
+
+	if err != nil {
+		logger.Error(err, fmt.Sprintf("unable to reconcile InfisicalSecret. Will requeue after [requeueTime=%v]", requeueTime))
+		return ctrl.Result{
+			RequeueAfter: requeueTime,
+		}, nil
+	}
+
+	numDeployments, err := controllerhelpers.ReconcileDeploymentsWithMultipleManagedSecrets(ctx, r.Client, logger, managedKubeSecretReferences, r.IsNamespaceScoped)
+	handler.SetInfisicalAutoRedeploymentReady(ctx, logger, &infisicalSecretCRD, numDeployments, err)
+
+	if err != nil {
+		logger.Error(err, fmt.Sprintf("unable to reconcile auto redeployment. Will requeue after [requeueTime=%v]", requeueTime))
+		return ctrl.Result{
+			RequeueAfter: requeueTime,
+		}, nil
+	}
+
+	if infisicalSecretCRD.Spec.InstantUpdates {
+		logger.Info("Instant updates are enabled")
+
+		if err := r.EnsureEventStream(ctx, logger, &infisicalSecretCRD); err != nil {
+			logger.Error(err, fmt.Sprintf("unable to ensure event stream. Will requeue after [requeueTime=%v]", requeueTime))
+			return ctrl.Result{
+				RequeueAfter: requeueTime,
+			}, nil
+		}
+	} else {
+		r.CloseEventStream(ctx, logger, &infisicalSecretCRD)
+	}
+
+	// Sync again after the specified time
+	logger.Info(fmt.Sprintf("Successfully synced %d secrets. Operator will requeue after [%v]", secretsCount, requeueTime))
+	return ctrl.Result{
+		RequeueAfter: requeueTime,
+	}, nil
+}
+
+func (r *InfisicalSecretReconciler) SetupWithManager(mgr ctrl.Manager) error {
+	r.SourceCh = make(chan event.TypedGenericEvent[client.Object])
+
+	return ctrl.NewControllerManagedBy(mgr).
+		WatchesRawSource(
+			source.Channel[client.Object](r.SourceCh, &util.EnqueueDelayedEventHandler{Delay: time.Second * 3}),
+		).
+		For(&secretsv1alpha1.InfisicalSecret{}, builder.WithPredicates(predicate.Funcs{
+			UpdateFunc: func(e event.UpdateEvent) bool {
+				if e.ObjectOld.GetGeneration() == e.ObjectNew.GetGeneration() {
+					return false // Skip reconciliation for status-only changes
+				}
+
+				if infisicalSecretResourceVariablesMap != nil {
+					if rv, ok := infisicalSecretResourceVariablesMap[string(e.ObjectNew.GetUID())]; ok {
+						rv.CancelCtx()
+						delete(infisicalSecretResourceVariablesMap, string(e.ObjectNew.GetUID()))
+					}
+				}
+				return true
+			},
+			DeleteFunc: func(e event.DeleteEvent) bool {
+				if infisicalSecretResourceVariablesMap != nil {
+					if rv, ok := infisicalSecretResourceVariablesMap[string(e.Object.GetUID())]; ok {
+						rv.CancelCtx()
+						delete(infisicalSecretResourceVariablesMap, string(e.Object.GetUID()))
+					}
+				}
+				return true
+			},
+		})).
+		Complete(r)
+
+}

k8-operator/internal/controller/infisicalsecret_controller_test.go

@@ -0,0 +1,84 @@
+/*
+Copyright 2025.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package controller
+
+import (
+	"context"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	secretsv1alpha1 "github.com/Infisical/infisical/k8-operator/api/v1alpha1"
+)
+
+var _ = Describe("InfisicalSecret Controller", func() {
+	Context("When reconciling a resource", func() {
+		const resourceName = "test-resource"
+
+		ctx := context.Background()
+
+		typeNamespacedName := types.NamespacedName{
+			Name:      resourceName,
+			Namespace: "default", // TODO(user):Modify as needed
+		}
+		infisicalsecret := &secretsv1alpha1.InfisicalSecret{}
+
+		BeforeEach(func() {
+			By("creating the custom resource for the Kind InfisicalSecret")
+			err := k8sClient.Get(ctx, typeNamespacedName, infisicalsecret)
+			if err != nil && errors.IsNotFound(err) {
+				resource := &secretsv1alpha1.InfisicalSecret{
+					ObjectMeta: metav1.ObjectMeta{
+						Name:      resourceName,
+						Namespace: "default",
+					},
+					// TODO(user): Specify other spec details if needed.
+				}
+				Expect(k8sClient.Create(ctx, resource)).To(Succeed())
+			}
+		})
+
+		AfterEach(func() {
+			// TODO(user): Cleanup logic after each test, like removing the resource instance.
+			resource := &secretsv1alpha1.InfisicalSecret{}
+			err := k8sClient.Get(ctx, typeNamespacedName, resource)
+			Expect(err).NotTo(HaveOccurred())
+
+			By("Cleanup the specific resource instance InfisicalSecret")
+			Expect(k8sClient.Delete(ctx, resource)).To(Succeed())
+		})
+		It("should successfully reconcile the resource", func() {
+			By("Reconciling the created resource")
+			controllerReconciler := &InfisicalSecretReconciler{
+				Client: k8sClient,
+				Scheme: k8sClient.Scheme(),
+			}
+
+			_, err := controllerReconciler.Reconcile(ctx, reconcile.Request{
+				NamespacedName: typeNamespacedName,
+			})
+			Expect(err).NotTo(HaveOccurred())
+			// TODO(user): Add more specific assertions depending on your controller's reconciliation logic.
+			// Example: If you expect a certain status condition after reconciliation, verify it here.
+		})
+	})
+})

k8-operator/internal/controller/suite_test.go

@@ -0,0 +1,116 @@
+/*
+Copyright 2025.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package controller
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+
+	"k8s.io/client-go/kubernetes/scheme"
+	"k8s.io/client-go/rest"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/envtest"
+	logf "sigs.k8s.io/controller-runtime/pkg/log"
+	"sigs.k8s.io/controller-runtime/pkg/log/zap"
+
+	secretsv1alpha1 "github.com/Infisical/infisical/k8-operator/api/v1alpha1"
+	// +kubebuilder:scaffold:imports
+)
+
+// These tests use Ginkgo (BDD-style Go testing framework). Refer to
+// http://onsi.github.io/ginkgo/ to learn more about Ginkgo.
+
+var (
+	ctx       context.Context
+	cancel    context.CancelFunc
+	testEnv   *envtest.Environment
+	cfg       *rest.Config
+	k8sClient client.Client
+)
+
+func TestControllers(t *testing.T) {
+	RegisterFailHandler(Fail)
+
+	RunSpecs(t, "Controller Suite")
+}
+
+var _ = BeforeSuite(func() {
+	logf.SetLogger(zap.New(zap.WriteTo(GinkgoWriter), zap.UseDevMode(true)))
+
+	ctx, cancel = context.WithCancel(context.TODO())
+
+	var err error
+	err = secretsv1alpha1.AddToScheme(scheme.Scheme)
+	Expect(err).NotTo(HaveOccurred())
+
+	// +kubebuilder:scaffold:scheme
+
+	By("bootstrapping test environment")
+	testEnv = &envtest.Environment{
+		CRDDirectoryPaths:     []string{filepath.Join("..", "..", "config", "crd", "bases")},
+		ErrorIfCRDPathMissing: true,
+	}
+
+	// Retrieve the first found binary directory to allow running tests from IDEs
+	if getFirstFoundEnvTestBinaryDir() != "" {
+		testEnv.BinaryAssetsDirectory = getFirstFoundEnvTestBinaryDir()
+	}
+
+	// cfg is defined in this file globally.
+	cfg, err = testEnv.Start()
+	Expect(err).NotTo(HaveOccurred())
+	Expect(cfg).NotTo(BeNil())
+
+	k8sClient, err = client.New(cfg, client.Options{Scheme: scheme.Scheme})
+	Expect(err).NotTo(HaveOccurred())
+	Expect(k8sClient).NotTo(BeNil())
+})
+
+var _ = AfterSuite(func() {
+	By("tearing down the test environment")
+	cancel()
+	err := testEnv.Stop()
+	Expect(err).NotTo(HaveOccurred())
+})
+
+// getFirstFoundEnvTestBinaryDir locates the first binary in the specified path.
+// ENVTEST-based tests depend on specific binaries, usually located in paths set by
+// controller-runtime. When running tests directly (e.g., via an IDE) without using
+// Makefile targets, the 'BinaryAssetsDirectory' must be explicitly configured.
+//
+// This function streamlines the process by finding the required binaries, similar to
+// setting the 'KUBEBUILDER_ASSETS' environment variable. To ensure the binaries are
+// properly set up, run 'make setup-envtest' beforehand.
+func getFirstFoundEnvTestBinaryDir() string {
+	basePath := filepath.Join("..", "..", "bin", "k8s")
+	entries, err := os.ReadDir(basePath)
+	if err != nil {
+		logf.Log.Error(err, "Failed to read directory", "path", basePath)
+		return ""
+	}
+	for _, entry := range entries {
+		if entry.IsDir() {
+			return filepath.Join(basePath, entry.Name())
+		}
+	}
+	return ""
+}