Add the capability to read existing secret for an S3User

Author: graindcafe

cmd/main.go

@@ -80,6 +80,7 @@ func main() {
 
 	//K8S related variable
 	var overrideExistingSecret bool
+	var readExistingSecret bool
 
 	flag.StringVar(
 		&metricsAddr,
@@ -106,6 +107,12 @@ func main() {
 		false,
 		"Override existing secret associated to user in case of the secret already exist",
 	)
+	flag.BoolVar(
+		&readExistingSecret,
+		"read-existing-secret",
+		false,
+		"Read existing secret associated to user in case of the secret already exist",
+	)
 
 	opts := zap.Options{
 		Development: true,
@@ -203,6 +210,7 @@ func main() {
 		Client:                  mgr.GetClient(),
 		Scheme:                  mgr.GetScheme(),
 		OverrideExistingSecret:  overrideExistingSecret,
+		ReadExistingSecret:  	 readExistingSecret,
 		ReconcilePeriod:         reconcilePeriod,
 		S3factory:               s3Factory,
 		ControllerHelper:        controllerHelper,

deploy/charts/s3-operator/README.md

@@ -24,6 +24,6 @@ A Helm chart for deploying an operator to manage S3 resources (eg buckets, polic
 | crds.install | bool | `true` | Install and upgrade CRDs |
 | crds.keep | bool | `true` | Keep CRDs on chart uninstall |
 | kubernetes.clusterDomain | string | `"cluster.local"` |  |
-| kubernetes.overrideExistingSecret | bool | `false` |  |
+| kubernetes.overrideExistingSecret | bool | `false` | When creating an S3User, update existing secret with the generated secret key |
+| kubernetes.readExistingSecret | bool | `false` | When creating an S3User, read existing secret to retrieve the secret key |
 | s3 | object | `{"default":{"accessKey":"accessKey","createNamespace":true,"deletion":{"bucket":true,"path":false,"policy":false,"s3user":false},"enabled":false,"namespace":"s3-operator","region":"us-east-1","s3Provider":"minio","secretKey":"secretKey","url":"https://localhost:9000"}}` | Default S3 Instance |
-

deploy/charts/s3-operator/templates/deployment.yaml

@@ -38,6 +38,7 @@ spec:
         - --metrics-bind-address=127.0.0.1:8080
         - --leader-elect
         - --override-existing-secret={{ .Values.kubernetes.overrideExistingSecret }}
+        - --read-existing-secret={{ .Values.kubernetes.readExistingSecret }}
         {{- if .Values.controllerManager.manager.extraArgs }}
         {{- toYaml .Values.controllerManager.manager.extraArgs | nindent 8 }}
         {{- end }}

deploy/charts/s3-operator/values.yaml

@@ -48,6 +48,7 @@ controllerManager:
 kubernetes:
   clusterDomain: cluster.local
   overrideExistingSecret: false
+  readExistingSecret: false
 
 # -- Default S3 Instance
 s3:

internal/controller/user/controller.go

@@ -44,6 +44,7 @@ type S3UserReconciler struct {
 	client.Client
 	Scheme                  *runtime.Scheme
 	OverrideExistingSecret  bool
+	ReadExistingSecret      bool
 	ReconcilePeriod         time.Duration
 	S3factory               s3factory.S3Factory
 	ControllerHelper        *helpers.ControllerHelper

internal/controller/user/reconcile.go

@@ -247,7 +247,7 @@ func (r *S3UserReconciler) handleUpdate(
 			err,
 		)
 	}
-
+	ownedSecret := true
 	userOwnedlinkedSecrets, err := r.getUserLinkedSecrets(ctx, userResource)
 	if err != nil {
 		logger.Error(
@@ -267,8 +267,27 @@ func (r *S3UserReconciler) handleUpdate(
 			err,
 		)
 	}
+	userUnlinkedSecret, err := r.getUserUnlinkedSecret(ctx, userResource.Namespace, userResource.Spec.SecretName, userResource.Name)
+	if err != nil {
+		logger.Error(
+			err,
+			"An error occurred while listing the user's secret",
+			"userResourceName",
+			userResource.Name,
+			"NamespacedName",
+			req.NamespacedName.String(),
+		)
+		return r.SetReconciledCondition(
+			ctx,
+			req,
+			userResource,
+			s3v1alpha1.Unreachable,
+			"Impossible to list the user's secret",
+			err,
+		)
+	}
 	currentUserSecret := corev1.Secret{}
-	if len(userOwnedlinkedSecrets) == 0 {
+	if len(userOwnedlinkedSecrets) == 0  && userUnlinkedSecret == nil {
 		logger.Info(
 			"No Secret associated to user found, user will be deleted from the S3 backend, then recreated with a secret",
 			"userResourceName",
@@ -298,6 +317,9 @@ func (r *S3UserReconciler) handleUpdate(
 			)
 		}
 		return r.handleCreate(ctx, req, userResource)
+	} else if userUnlinkedSecret != nil {
+		currentUserSecret = *userUnlinkedSecret
+		ownedSecret = false
 	} else {
 		foundSecret := false
 		for _, linkedsecret := range userOwnedlinkedSecrets {
@@ -473,31 +495,42 @@ func (r *S3UserReconciler) handleUpdate(
 	}
 
 	if !credentialsValid {
-		logger.Info(
-			"The secret containing the credentials will be deleted, and the user will be deleted from the S3 backend, then recreated (through another reconcile)",
-			"userResource",
-			userResource.Name,
-			"NamespacedName",
-			req.NamespacedName.String(),
-		)
-		err = r.deleteSecret(ctx, &currentUserSecret)
-		if err != nil {
-			logger.Error(err, "Deletion of secret associated to user have failed", "userResource",
-				userResource.Name,
-				"userResourceName",
+		if ownedSecret {
+			logger.Info(
+				"The secret containing the credentials will be deleted, and the user will be deleted from the S3 backend, then recreated (through another reconcile)",
+				"userResource",
 				userResource.Name,
 				"NamespacedName",
-				req.NamespacedName.String())
-			return r.SetReconciledCondition(
-				ctx,
-				req,
-				userResource,
-				s3v1alpha1.Unreachable,
-				"Deletion of secret associated to user have failed",
-				err,
+				req.NamespacedName.String(),
 			)
+			err = r.deleteSecret(ctx, &currentUserSecret)
+			if err != nil {
+				logger.Error(err, "Deletion of secret associated to user have failed", "userResource",
+					userResource.Name,
+					"userResourceName",
+					userResource.Name,
+					"NamespacedName",
+					req.NamespacedName.String())
+				return r.SetReconciledCondition(
+					ctx,
+					req,
+					userResource,
+					s3v1alpha1.Unreachable,
+					"Deletion of secret associated to user have failed",
+					err,
+				)
 
+			}
+		} else {
+			logger.Info(
+				"The user will be deleted from the S3 backend, then recreated (through another reconcile), the secret will be kept.",
+				"userResource",
+				userResource.Name,
+				"NamespacedName",
+				req.NamespacedName.String(),
+			)
 		}
+
 		err = s3Client.DeleteUser(userResource.Spec.AccessKey)
 		if err != nil {
 			logger.Error(err, "Could not delete user on S3 server", "userResource",
@@ -751,15 +784,30 @@ func (r *S3UserReconciler) handleCreate(
 			}
 		}
 
-		if r.OverrideExistingSecret {
-			// Case 3.2 : they are not valid, but the operator is configured to overwrite it
-			logger.Info(fmt.Sprintf("A secret with the name %s already exists ; it will be overwritten because of operator configuration", secret.Name), "secretName",
-				secret.Name,
-				"userResource",
-				userResource.Name,
-				"NamespacedName",
+		if r.OverrideExistingSecret || r.ReadExistingSecret {
+			if r.ReadExistingSecret {
+				// Case 3.2a : read existing secret instead of updating it
+				logger.Info(fmt.Sprintf("The secret key will be retrieved from the secret named %s.", secret.Name), "secretName",
+					secret.Name,
+					"userResource",
+					userResource.Name,
+					"NamespacedName",
 				req.NamespacedName.String())
-
+				var cpData = *&existingK8sSecret.Data
+				for k, v := range cpData {
+					if k == userResource.Spec.SecretFieldNameSecretKey {
+						secretKey = string(v)
+					}
+				}
+			} else {
+				// Case 3.2b : they are not valid, but the operator is configured to overwrite it
+				logger.Info(fmt.Sprintf("A secret with the name %s already exists ; it will be overwritten because of operator configuration", secret.Name), "secretName",
+					secret.Name,
+					"userResource",
+					userResource.Name,
+					"NamespacedName",
+					req.NamespacedName.String())
+			}
 			// Creating the user
 			err = s3Client.CreateUser(userResource.Spec.AccessKey, secretKey)
 			if err != nil {
@@ -780,32 +828,33 @@ func (r *S3UserReconciler) handleCreate(
 					err,
 				)
 			}
-
-			// Updating the secret
-			logger.Info("Updating the pre-existing secret with new credentials",
-				"secretName",
-				secret.Name,
-				"userResource",
-				userResource.Name,
-				"NamespacedName",
-				req.NamespacedName.String(),
-			)
-			err = r.Update(ctx, secret)
-			if err != nil {
-				logger.Error(err, "Could not update secret", "secretName",
+			if r.OverrideExistingSecret {
+				// Updating the secret
+				logger.Info("Updating the pre-existing secret with new credentials",
+					"secretName",
 					secret.Name,
 					"userResource",
 					userResource.Name,
 					"NamespacedName",
-					req.NamespacedName.String())
-				return r.SetReconciledCondition(
-					ctx,
-					req,
-					userResource,
-					s3v1alpha1.Unreachable,
-					"Update of secret have failed",
-					err,
+					req.NamespacedName.String(),
 				)
+				err = r.Update(ctx, secret)
+				if err != nil {
+					logger.Error(err, "Could not update secret", "secretName",
+						secret.Name,
+						"userResource",
+						userResource.Name,
+						"NamespacedName",
+						req.NamespacedName.String())
+					return r.SetReconciledCondition(
+						ctx,
+						req,
+						userResource,
+						s3v1alpha1.Unreachable,
+						"Update of secret have failed",
+						err,
+					)
+				}
 			}
 
 			// Add policies

internal/controller/user/utils.go

@@ -104,6 +104,39 @@ func (r *S3UserReconciler) getUserLinkedSecrets(
 	return userSecretList, nil
 }
 
+
+func (r *S3UserReconciler) getUserUnlinkedSecret(
+	ctx context.Context,
+	namespace string,
+	secretNameA string,
+	secretNameB string,
+) (*corev1.Secret, error) {
+	logger := log.FromContext(ctx)
+	// Listing every secrets in the S3User's namespace, as a first step
+	// to get the actual secret matching the S3User proper.
+	// TODO : proper label matching ?
+	secretsList := &corev1.SecretList{}
+	err := r.List(ctx, secretsList, client.InNamespace(namespace))
+	if err != nil {
+		logger.Error(err, "An error occurred while listing the secrets in user's namespace")
+		return nil, fmt.Errorf("SecretListingFailed")
+	}
+	if len(secretsList.Items) == 0 {
+		logger.Info("The user's namespace doesn't appear to contain any secret")
+		return nil, nil
+	}
+
+	var secretB *corev1.Secret
+	for _, secret := range secretsList.Items {
+		if secret.Name == secretNameA {
+			return &secret, nil
+		} else if secret.Name == secretNameB {
+			secretB = &secret
+		}
+	}
+	return secretB, nil
+}
+
 func (r *S3UserReconciler) deleteSecret(ctx context.Context, secret *corev1.Secret) error {
 	logger := log.FromContext(ctx)
 	logger.Info("the secret named " + secret.Name + " will be deleted")