ACK SecretsManager doesn't adopt secret

[Amir-Ahmad]

Describe the bug

I'm trying to use ACK SecretsManager to adopt an existing secret via annotations and "adopt-or-create", but it doesn't work.

Steps to reproduce

1. aws secretsmanager create-secret --name adopt-test

2. Create this resource

apiVersion: secretsmanager.services.k8s.aws/v1alpha1
kind: Secret
metadata:
  name: "adopt-test"
  namespace: "default"
  annotations:
    services.k8s.aws/adoption-policy: adopt-or-create
    services.k8s.aws/adoption-fields: | 
      {
      "name": "adopt-test"
      }
spec:
  name: "adopt-test"

3. Error on Secret resource when it tried to create it

    - message: 'ResourceExistsException: The operation failed because the secret adopt-test
        already exists.'
      status: "True"
      type: ACK.Recoverable
    - lastTransitionTime: "2025-05-19T06:07:45Z"

logs:

{"level":"debug","ts":"2025-05-19T06:08:35.990Z","logger":"ackrt","msg":"patched resource status","kind":"Secret","namespace":"default","name":"adopt-test","account":"123","role":"","region":"eu-central-1","is_adopted":false,"generation":1,"json":"{\"metadata\":{\"resourceVersion\":\"15728\"},\"spec\":{\"tags\":null},\"status\":{\"conditions\":[{\"message\":\"ResourceExistsException: The operation failed because the secret adopt-test already exists.\",\"status\":\"True\",\"type\":\"ACK.Recoverable\"},{\"lastTransitionTime\":\"2025-05-19T06:08:35Z\",\"message\":\"Unable to determine if desired resource state matches latest observed state\",\"reason\":\"operation error Secrets Manager: CreateSecret, https response error StatusCode: 400, RequestID: 59c8a6f1-89ce-4106-baab-63620f277239, ResourceExistsException: The operation failed because the secret adopt-test already exists.\",\"status\":\"Unknown\",\"type\":\"ACK.ResourceSynced\"}]}}"}
{"level":"debug","ts":"2025-05-19T06:08:35.990Z","logger":"ackrt","msg":"<< kc.Patch (status)","kind":"Secret","namespace":"default","name":"adopt-test","account":"123","role":"","region":"eu-central-1","is_adopted":false,"generation":1}
{"level":"debug","ts":"2025-05-19T06:08:35.990Z","logger":"ackrt","msg":"< r.patchResourceStatus","kind":"Secret","namespace":"default","name":"adopt-test","account":"123","role":"","region":"eu-central-1","is_adopted":false,"generation":1}
{"level":"error","ts":"2025-05-19T06:08:35.990Z","msg":"Reconciler error","controller":"secret","controllerGroup":"secretsmanager.services.k8s.aws","controllerKind":"Secret","Secret":{"name":"adopt-test","namespace":"default"},"namespace":"default","name":"adopt-test","reconcileID":"8bf7b0e7-4732-4265-8c1a-d1af28476844","error":"operation error Secrets Manager: CreateSecret, https response error StatusCode: 400, RequestID: 59c8a6f1-89ce-4106-baab-63620f277239, ResourceExistsException: The operation failed because the secret adopt-test already exists.","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/internal/controller/controller.go:347\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/internal/controller/controller.go:294\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.2\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/internal/controller/controller.go:255"}

Expected outcome

I expected the existing secret to be adopted.

It looks like this may be occurring because when populating the resource from an annotation, the status.id is not set. https://github.com/aws-controllers-k8s/secretsmanager-controller/blob/main/pkg/resource/secret/resource.go#L112-L115 . I've tested by including the "id" in adoption-fields with the ARN, and it works. However, it's not feasible for me to know all the ARNs, ideally the controller would do it for me.

Environment

• kind v1.32.2
• SecretsManager controller version v1.0.7

[github-actions]

Hello @Amir-Ahmad 👋 Thank you for opening an issue in ACK! A maintainer will triage this issue soon.

We encourage community contributions, so if you're interested in tackling this yourself or suggesting a solution, please check out our Contribution and Code of Conduct guidelines.

You can find more information about ACK on our website.

[michaelhtm]

Hello @Amir-Ahmad
Thank you for bringing up this issue.
SecretsManager's Secret resource does not have a conventional way of recreating the ARN from the resource name
(sample secret ARN: arn:aws:secretsmanager:us-west-2:1234568279432433:secret:my-secret-4z40OU, Name: my-secret)

This has been an issue when adopting several other resources (Queue, Policy, etc.)

One thing i suggest we can do is call List first and filter by name? From there we can retrieve the ID/ARN/URL.
This can just be a one time operation, only when the Status.ID/ARN is empty..
Any thoughts?
cc: @a-hilaly @rushmash91 @knottnt

[Amir-Ahmad]

@michaelhtm That approach makes sense to me, it would be great if the controller can handle the ARN lookup where the annotation for name is set.

[a-hilaly]

One thing i suggest we can do is call List first and filter by name?

I worry about having to make a bazillion API requests just to adopt one resource, especially when dealing with pagination and accounts that have many resources. If one tries to adopt N resources, the controller will scan the accounts N times. Add into that the size of the API responses... Feels like we're making some trade offs here..

[michaelhtm]

I worry about having to make a bazillion API requests just to adopt one resource, especially when dealing with pagination and accounts that have many resources. If one tries to adopt N resources, the controller will scan the accounts N times. Add into that the size of the API responses... Feels like we're making some trade offs here..

That makes sense...maybe this could be a solution for SecretsManager as a hash is added to the ARN that makes it unpredictable. Resources like IAM Policies, and SQS Queues, we can already predict the ARN and QueueURL respectively.

The ListSecrets would be a one time operation that would be used if, and only if, ARN is not defined.
Looks like we can filter them by name, so we can avoid pagination.
https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_ListSecrets.html

aws secretsmanager list-secrets \
    --filter Key="name",Values="Test"

We can use this API to retrieve the ARN, and future reconciliation would no longer need it.

[nerdfacerory]

I also managed to reproduce this issue with the adopt annotation on a secret managed by secretsmanager and indeed the Secrets Manager ACK controller is not able to adopt resources.

[michaelhtm]

Hello @Amir-Ahmad @nerdfacerory,
This fix should now be available in https://github.com/aws-controllers-k8s/secretsmanager-controller/releases/tag/v1.0.13
Feel free to reopen issue if it's not yet resolved for you!
/close

[ack-prow]

@michaelhtm: Closing this issue.

In response to this:

Hello @Amir-Ahmad @nerdfacerory,
This fix should now be available in https://github.com/aws-controllers-k8s/secretsmanager-controller/releases/tag/v1.0.13
Feel free to reopen issue if it's not yet resolved for you!
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.