Skip to content

Commit 481bdb1

Browse files
leon-infapecloud-bot
leon-inf
authored and
apecloud-bot
committed
chore: optional secret-ref namespace for system account (#9971)
(cherry picked from commit 693d482)
1 parent f810d61 commit 481bdb1

File tree

7 files changed

+63
-39
lines changed

7 files changed

+63
-39
lines changed

‎apis/apps/v1/types.go‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -494,8 +494,10 @@ type ProvisionSecretRef struct {
494494

495495
// The namespace where the secret is located.
496496
//
497-
// +kubebuilder:validation:Required
498-
Namespace string `json:"namespace"`
497+
// If not specified, the secret is assumed to be in the same namespace as the cluster.
498+
//
499+
// +optional
500+
Namespace string `json:"namespace,omitempty"`
499501

500502
// The key in the secret data that contains the password.
501503
//

‎config/crd/bases/apps.kubeblocks.io_clusters.yaml‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4170,7 +4170,11 @@ spec:
41704170
description: The unique identifier of the secret.
41714171
type: string
41724172
namespace:
4173-
description: The namespace where the secret is located.
4173+
description: |-
4174+
The namespace where the secret is located.
4175+
4176+
4177+
If not specified, the secret is assumed to be in the same namespace as the cluster.
41744178
type: string
41754179
password:
41764180
default: password
@@ -4179,7 +4183,6 @@ spec:
41794183
type: string
41804184
required:
41814185
- name
4182-
- namespace
41834186
type: object
41844187
required:
41854188
- name
@@ -11697,8 +11700,11 @@ spec:
1169711700
description: The unique identifier of the secret.
1169811701
type: string
1169911702
namespace:
11700-
description: The namespace where the secret is
11701-
located.
11703+
description: |-
11704+
The namespace where the secret is located.
11705+
11706+
11707+
If not specified, the secret is assumed to be in the same namespace as the cluster.
1170211708
type: string
1170311709
password:
1170411710
default: password
@@ -11707,7 +11713,6 @@ spec:
1170711713
type: string
1170811714
required:
1170911715
- name
11710-
- namespace
1171111716
type: object
1171211717
required:
1171311718
- name

‎config/crd/bases/apps.kubeblocks.io_components.yaml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4368,7 +4368,11 @@ spec:
43684368
description: The unique identifier of the secret.
43694369
type: string
43704370
namespace:
4371-
description: The namespace where the secret is located.
4371+
description: |-
4372+
The namespace where the secret is located.
4373+
4374+
4375+
If not specified, the secret is assumed to be in the same namespace as the cluster.
43724376
type: string
43734377
password:
43744378
default: password
@@ -4377,7 +4381,6 @@ spec:
43774381
type: string
43784382
required:
43794383
- name
4380-
- namespace
43814384
type: object
43824385
required:
43834386
- name

‎controllers/apps/component/transformer_component_account.go‎

Lines changed: 27 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,7 @@ func (t *componentAccountTransformer) Transform(ctx graph.TransformContext, dag
108108

109109
func (t *componentAccountTransformer) createAccount(transCtx *componentTransformContext,
110110
dag *graph.DAG, graphCli model.GraphClient, account synthesizedSystemAccount) error {
111-
secret, err := t.buildAccountSecret(transCtx, transCtx.SynthesizeComponent, account)
111+
secret, err := t.buildAccountSecret(transCtx, account)
112112
if err != nil {
113113
return err
114114
}
@@ -126,7 +126,7 @@ func (t *componentAccountTransformer) deleteAccount(transCtx *componentTransform
126126

127127
func (t *componentAccountTransformer) updateAccount(transCtx *componentTransformContext,
128128
dag *graph.DAG, graphCli model.GraphClient, account synthesizedSystemAccount, running *corev1.Secret) error {
129-
secret, err := t.buildAccountSecret(transCtx, transCtx.SynthesizeComponent, account)
129+
secret, err := t.buildAccountSecret(transCtx, account)
130130
if err != nil {
131131
return err
132132
}
@@ -164,34 +164,36 @@ func (t *componentAccountTransformer) buildAccountHash(account synthesizedSystem
164164
return signatureSystemAccountPassword(secret)
165165
}
166166

167-
func (t *componentAccountTransformer) buildAccountSecret(ctx *componentTransformContext,
168-
synthesizeComp *component.SynthesizedComponent, account synthesizedSystemAccount) (*corev1.Secret, error) {
167+
func (t *componentAccountTransformer) buildAccountSecret(transCtx *componentTransformContext, account synthesizedSystemAccount) (*corev1.Secret, error) {
169168
var password []byte
170169
var err error
171170
switch {
172171
case account.SecretRef != nil:
173-
if password, err = t.getPasswordFromSecret(ctx, account); err != nil {
172+
if password, err = t.getPasswordFromSecret(transCtx, account); err != nil {
174173
return nil, err
175174
}
176175
default:
177-
password, err = t.buildPassword(ctx, account)
176+
password, err = t.buildPassword(transCtx, account)
178177
if err != nil {
179178
return nil, err
180179
}
181180
}
182181
if len(password) > maximumPasswordLength {
183182
return nil, errPasswordTooLong
184183
}
185-
return t.buildAccountSecretWithPassword(ctx, synthesizeComp, account, password)
184+
return t.buildAccountSecretWithPassword(transCtx, account, password)
186185
}
187186

188-
func (t *componentAccountTransformer) getPasswordFromSecret(ctx graph.TransformContext, account synthesizedSystemAccount) ([]byte, error) {
187+
func (t *componentAccountTransformer) getPasswordFromSecret(transCtx *componentTransformContext, account synthesizedSystemAccount) ([]byte, error) {
189188
secretKey := types.NamespacedName{
190189
Namespace: account.SecretRef.Namespace,
191190
Name: account.SecretRef.Name,
192191
}
192+
if len(secretKey.Namespace) == 0 {
193+
secretKey.Namespace = transCtx.SynthesizeComponent.Namespace
194+
}
193195
secret := &corev1.Secret{}
194-
if err := ctx.GetClient().Get(ctx.GetContext(), secretKey, secret); err != nil {
196+
if err := transCtx.GetClient().Get(transCtx.GetContext(), secretKey, secret); err != nil {
195197
return nil, err
196198
}
197199

@@ -205,17 +207,18 @@ func (t *componentAccountTransformer) getPasswordFromSecret(ctx graph.TransformC
205207
return secret.Data[passwordKey], nil
206208
}
207209

208-
func (t *componentAccountTransformer) buildPassword(ctx *componentTransformContext, account synthesizedSystemAccount) ([]byte, error) {
210+
func (t *componentAccountTransformer) buildPassword(transCtx *componentTransformContext, account synthesizedSystemAccount) ([]byte, error) {
211+
synthesizedComp := transCtx.SynthesizeComponent
209212
// get restore password if exists during recovery.
210-
password, err := appsutil.GetRestoreSystemAccountPassword(ctx.Context, ctx.Client,
211-
ctx.SynthesizeComponent.Annotations, ctx.SynthesizeComponent.Name, account.Name)
213+
password, err := appsutil.GetRestoreSystemAccountPassword(transCtx.Context, transCtx.Client,
214+
synthesizedComp.Annotations, synthesizedComp.Name, account.Name)
212215
if err != nil {
213-
return nil, fmt.Errorf("failed to restore password for system account %s of component %s from annotation, err: %w", account.Name, ctx.SynthesizeComponent.Name, err)
216+
return nil, fmt.Errorf("failed to restore password for system account %s of component %s from annotation, err: %w", account.Name, synthesizedComp.Name, err)
214217
}
215218
if account.InitAccount && len(password) == 0 {
216-
// initAccount can also restore from factory.GetRestoreSystemAccountPassword(ctx.SynthesizeComponent, account).
219+
// initAccount can also restore from factory.GetRestoreSystemAccountPassword(synthesizedComp, account).
217220
// This is compatibility processing.
218-
password = []byte(factory.GetRestorePassword(ctx.SynthesizeComponent))
221+
password = []byte(factory.GetRestorePassword(synthesizedComp))
219222
}
220223
if len(password) == 0 {
221224
password, err := common.GeneratePasswordByConfig(account.PasswordGenerationPolicy)
@@ -225,16 +228,17 @@ func (t *componentAccountTransformer) buildPassword(ctx *componentTransformConte
225228
}
226229

227230
func (t *componentAccountTransformer) buildAccountSecretWithPassword(ctx *componentTransformContext,
228-
synthesizeComp *component.SynthesizedComponent, account synthesizedSystemAccount, password []byte) (*corev1.Secret, error) {
229-
secretName := constant.GenerateAccountSecretName(synthesizeComp.ClusterName, synthesizeComp.Name, account.Name)
230-
secret := builder.NewSecretBuilder(synthesizeComp.Namespace, secretName).
231+
account synthesizedSystemAccount, password []byte) (*corev1.Secret, error) {
232+
synthesizedComp := ctx.SynthesizeComponent
233+
secretName := constant.GenerateAccountSecretName(synthesizedComp.ClusterName, synthesizedComp.Name, account.Name)
234+
secret := builder.NewSecretBuilder(synthesizedComp.Namespace, secretName).
231235
// Priority: static < dynamic < built-in
232-
AddLabelsInMap(synthesizeComp.StaticLabels).
233-
AddLabelsInMap(synthesizeComp.DynamicLabels).
234-
AddLabelsInMap(constant.GetCompLabels(synthesizeComp.ClusterName, synthesizeComp.Name)).
236+
AddLabelsInMap(synthesizedComp.StaticLabels).
237+
AddLabelsInMap(synthesizedComp.DynamicLabels).
238+
AddLabelsInMap(constant.GetCompLabels(synthesizedComp.ClusterName, synthesizedComp.Name)).
235239
AddLabels(systemAccountLabel, account.Name).
236-
AddAnnotationsInMap(synthesizeComp.StaticAnnotations).
237-
AddAnnotationsInMap(synthesizeComp.DynamicAnnotations).
240+
AddAnnotationsInMap(synthesizedComp.StaticAnnotations).
241+
AddAnnotationsInMap(synthesizedComp.DynamicAnnotations).
238242
PutData(constant.AccountNameForSecret, []byte(account.Name)).
239243
PutData(constant.AccountPasswdForSecret, password).
240244
// SetImmutable(true).

‎deploy/helm/crds/apps.kubeblocks.io_clusters.yaml‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4170,7 +4170,11 @@ spec:
41704170
description: The unique identifier of the secret.
41714171
type: string
41724172
namespace:
4173-
description: The namespace where the secret is located.
4173+
description: |-
4174+
The namespace where the secret is located.
4175+
4176+
4177+
If not specified, the secret is assumed to be in the same namespace as the cluster.
41744178
type: string
41754179
password:
41764180
default: password
@@ -4179,7 +4183,6 @@ spec:
41794183
type: string
41804184
required:
41814185
- name
4182-
- namespace
41834186
type: object
41844187
required:
41854188
- name
@@ -11697,8 +11700,11 @@ spec:
1169711700
description: The unique identifier of the secret.
1169811701
type: string
1169911702
namespace:
11700-
description: The namespace where the secret is
11701-
located.
11703+
description: |-
11704+
The namespace where the secret is located.
11705+
11706+
11707+
If not specified, the secret is assumed to be in the same namespace as the cluster.
1170211708
type: string
1170311709
password:
1170411710
default: password
@@ -11707,7 +11713,6 @@ spec:
1170711713
type: string
1170811714
required:
1170911715
- name
11710-
- namespace
1171111716
type: object
1171211717
required:
1171311718
- name

‎deploy/helm/crds/apps.kubeblocks.io_components.yaml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4368,7 +4368,11 @@ spec:
43684368
description: The unique identifier of the secret.
43694369
type: string
43704370
namespace:
4371-
description: The namespace where the secret is located.
4371+
description: |-
4372+
The namespace where the secret is located.
4373+
4374+
4375+
If not specified, the secret is assumed to be in the same namespace as the cluster.
43724376
type: string
43734377
password:
43744378
default: password
@@ -4377,7 +4381,6 @@ spec:
43774381
type: string
43784382
required:
43794383
- name
4380-
- namespace
43814384
type: object
43824385
required:
43834386
- name

‎docs/developer_docs/api-reference/cluster.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9511,7 +9511,9 @@ string
95119511
</em>
95129512
</td>
95139513
<td>
9514+
<em>(Optional)</em>
95149515
<p>The namespace where the secret is located.</p>
9516+
<p>If not specified, the secret is assumed to be in the same namespace as the cluster.</p>
95159517
</td>
95169518
</tr>
95179519
<tr>

0 commit comments

Comments
 (0)