Skip to content

Refactor special secret input and validation #6808

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Nov 14, 2024
Merged

Refactor special secret input and validation #6808

Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
85a1db4
refactor special secret input and validation
pdabelf5 Nov 14, 2024
90a69c6
use list of secrets to update
pdabelf5 Nov 14, 2024
cf76ab8
Merge branch 'main' into special-secrets
pdabelf5 Nov 14, 2024
831bf34
use list of secrets to update
pdabelf5 Nov 14, 2024
eb14d5c
change switch case
pdabelf5 Nov 14, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 32 additions & 14 deletions internal/k8s/controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,6 +103,11 @@
configs.MeshPodOwner
}

type specialSecrets struct {
defaultServerSecret string
wildcardTLSSecret string
}

// LoadBalancerController watches Kubernetes API and
// reconfigures NGINX via NginxController when needed
type LoadBalancerController struct {
Expand Down Expand Up @@ -131,7 +136,7 @@
appProtectEnabled bool
appProtectDosEnabled bool
recorder record.EventRecorder
defaultServerSecret string
specialSecrets specialSecrets
ingressClass string
statusUpdater *statusUpdater
leaderElector *leaderelection.LeaderElector
Expand All @@ -142,7 +147,6 @@
namespaceList []string
secretNamespaceList []string
controllerNamespace string
wildcardTLSSecret string
areCustomResourcesEnabled bool
enableOIDC bool
metricsCollector collectors.ControllerCollector
Expand Down Expand Up @@ -226,14 +230,18 @@

// NewLoadBalancerController creates a controller
func NewLoadBalancerController(input NewLoadBalancerControllerInput) *LoadBalancerController {
specialSecrets := specialSecrets{
defaultServerSecret: input.DefaultServerSecret,
wildcardTLSSecret: input.WildcardTLSSecret,
}
lbc := &LoadBalancerController{
client: input.KubeClient,
confClient: input.ConfClient,
dynClient: input.DynClient,
restConfig: input.RestConfig,
Logger: nl.LoggerFromContext(input.LoggerContext),
configurator: input.NginxConfigurator,
defaultServerSecret: input.DefaultServerSecret,
specialSecrets: specialSecrets,
appProtectEnabled: input.AppProtectEnabled,
appProtectDosEnabled: input.AppProtectDosEnabled,
isNginxPlus: input.IsNginxPlus,
Expand All @@ -245,7 +253,6 @@
namespaceList: input.Namespace,
secretNamespaceList: input.SecretNamespace,
controllerNamespace: input.ControllerNamespace,
wildcardTLSSecret: input.WildcardTLSSecret,
areCustomResourcesEnabled: input.AreCustomResourcesEnabled,
enableOIDC: input.EnableOIDC,
metricsCollector: input.MetricsCollector,
Expand Down Expand Up @@ -1726,7 +1733,14 @@
}

func (lbc *LoadBalancerController) isSpecialSecret(secretName string) bool {
return secretName == lbc.defaultServerSecret || secretName == lbc.wildcardTLSSecret
switch secretName {
case lbc.specialSecrets.defaultServerSecret:
return true
case lbc.specialSecrets.wildcardTLSSecret:
return true
default:
return false

Check warning on line 1742 in internal/k8s/controller.go

View check run for this annotation

Codecov / codecov/patch

internal/k8s/controller.go#L1736-L1742 

Added lines #L1736 - L1742 were not covered by tests
}
}

func (lbc *LoadBalancerController) handleRegularSecretDeletion(resources []Resource) {
Expand Down Expand Up @@ -1754,31 +1768,35 @@
lbc.updateResourcesStatusAndEvents(resources, warnings, addOrUpdateErr)
}

func (lbc *LoadBalancerController) handleSpecialSecretUpdate(secret *api_v1.Secret) {
func (lbc *LoadBalancerController) validationTLSSpecialSecret(secret *api_v1.Secret, secretName string) {

Check warning on line 1771 in internal/k8s/controller.go

View check run for this annotation

Codecov / codecov/patch

internal/k8s/controller.go#L1771 

Added line #L1771 was not covered by tests
var specialSecretsToUpdate []string
secretNsName := secret.Namespace + "/" + secret.Name

Check warning on line 1774 in internal/k8s/controller.go

View check run for this annotation

Codecov / codecov/patch

internal/k8s/controller.go#L1774 

Added line #L1774 was not covered by tests
err := secrets.ValidateTLSSecret(secret)
if err != nil {
nl.Errorf(lbc.Logger, "Couldn't validate the special Secret %v: %v", secretNsName, err)
lbc.recorder.Eventf(secret, api_v1.EventTypeWarning, "Rejected", "the special Secret %v was rejected, using the previous version: %v", secretNsName, err)
return
}

if secretNsName == lbc.defaultServerSecret {
specialSecretsToUpdate = append(specialSecretsToUpdate, configs.DefaultServerSecretName)
}
if secretNsName == lbc.wildcardTLSSecret {
specialSecretsToUpdate = append(specialSecretsToUpdate, configs.WildcardSecretName)
}
specialSecretsToUpdate = append(specialSecretsToUpdate, secretName)

Check warning on line 1781 in internal/k8s/controller.go

View check run for this annotation

Codecov / codecov/patch

internal/k8s/controller.go#L1781 

Added line #L1781 was not covered by tests

err = lbc.configurator.AddOrUpdateSpecialTLSSecrets(secret, specialSecretsToUpdate)
if err != nil {
nl.Errorf(lbc.Logger, "Error when updating the special Secret %v: %v", secretNsName, err)
lbc.recorder.Eventf(secret, api_v1.EventTypeWarning, "UpdatedWithError", "the special Secret %v was updated, but not applied: %v", secretNsName, err)
return
}
}

func (lbc *LoadBalancerController) handleSpecialSecretUpdate(secret *api_v1.Secret) {
switch secret.Name {
case lbc.specialSecrets.defaultServerSecret:
lbc.validationTLSSpecialSecret(secret, configs.DefaultServerSecretName)
case lbc.specialSecrets.wildcardTLSSecret:
lbc.validationTLSSpecialSecret(secret, configs.WildcardSecretName)

Check warning on line 1796 in internal/k8s/controller.go

View check run for this annotation

Codecov / codecov/patch

internal/k8s/controller.go#L1791-L1796 

Added lines #L1791 - L1796 were not covered by tests
}

lbc.recorder.Eventf(secret, api_v1.EventTypeNormal, "Updated", "the special Secret %v was updated", secretNsName)
lbc.recorder.Eventf(secret, api_v1.EventTypeNormal, "Updated", "the special Secret %v was updated", secret.Namespace+"/"+secret.Name)

Check warning on line 1799 in internal/k8s/controller.go

View check run for this annotation

Codecov / codecov/patch

internal/k8s/controller.go#L1799 

Added line #L1799 was not covered by tests
}

func getStatusFromEventTitle(eventTitle string) string {
Expand Down
Loading