ESO-182: Updates to use different TLS Secret name and disables cluster resource reconcile based on user config #75
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -119,11 +119,8 @@ spec: | |
| initialDelaySeconds: 5 | ||
| periodSeconds: 10 | ||
| resources: | ||
| requests: | ||
| cpu: 100m | ||
| memory: 1Gi | ||
|
There was a problem hiding this comment. [claude-generated] Critical: CPU request increased from 10m to 100m (10x) and memory from 64Mi to 1Gi (16x). Please provide:
There was a problem hiding this comment. inline with above claude comment, curious to know 1Gi memory need? Most of it is cache or is there any other significant use of memory in this operator? There was a problem hiding this comment. It was decided based on the observation added in this comment. With just one additional day-2 operator, the memory reached 512Mib when the operator started. And I think it's safe to keep 1Gi considering the large clusters. There was a problem hiding this comment. i have not seen the memory go beyond 62MiB for the operator POD.. i started a Also, we already had limit as 128Mi which went through QA testing. But even with 64Mi limit there are no OOMKilled. |
||
| serviceAccountName: controller-manager | ||
| terminationGracePeriodSeconds: 10 | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -123,6 +123,7 @@ func (r *Reconciler) getDeploymentObject(assetName string, esc *operatorv1alpha1 | |
| checkInterval = esc.Spec.ApplicationConfig.WebhookConfig.CertificateCheckInterval.Duration.String() | ||
| } | ||
| updateWebhookContainerSpec(deployment, image, logLevel, checkInterval) | ||
| updateWebhookVolumeConfig(deployment, esc) | ||
| case certControllerDeploymentAssetName: | ||
| updateCertControllerContainerSpec(deployment, image, logLevel) | ||
| case bitwardenDeploymentAssetName: | ||
|
|
@@ -302,20 +303,31 @@ func (r *Reconciler) updateImageInStatus(esc *operatorv1alpha1.ExternalSecretsCo | |
|
|
||
| // argument list for external-secrets deployment resource | ||
| func updateContainerSpec(deployment *appsv1.Deployment, esc *operatorv1alpha1.ExternalSecretsConfig, image, logLevel string) { | ||
| var ( | ||
| enableClusterStoreArgFmt = "--enable-cluster-store-reconciler=%s" | ||
| enableClusterExternalSecretsArgFmt = "--enable-cluster-external-secret-reconciler=%s" | ||
| ) | ||
|
|
||
| args := []string{ | ||
| "--concurrent=1", | ||
| "--metrics-addr=:8080", | ||
| fmt.Sprintf("--loglevel=%s", logLevel), | ||
| "--zap-time-encoding=epoch", | ||
| "--enable-leader-election=true", | ||
| "--enable-push-secret-reconciler=true", | ||
| } | ||
|
|
||
| // when spec.appConfig.operatingNamespace is configured, which is for restricting the | ||
| // external-secrets custom resource reconcile scope to specified namespace, the reconciliation | ||
| // of cluster scoped custom resources must also be disabled. | ||
| namespace := getOperatingNamespace(esc) | ||
| if namespace != "" { | ||
| args = append(args, fmt.Sprintf("--namespace=%s", namespace), | ||
| fmt.Sprintf(enableClusterStoreArgFmt, "false"), | ||
| fmt.Sprintf(enableClusterExternalSecretsArgFmt, "false")) | ||
| } else { | ||
| args = append(args, fmt.Sprintf(enableClusterStoreArgFmt, "true"), | ||
| fmt.Sprintf(enableClusterExternalSecretsArgFmt, "true")) | ||
| } | ||
|
|
||
| for i, container := range deployment.Spec.Template.Spec.Containers { | ||
|
|
@@ -399,27 +411,29 @@ func updateBitwardenVolumeConfig(deployment *appsv1.Deployment, esc *operatorv1a | |
| } | ||
| } | ||
|
|
||
| func updateWebhookVolumeConfig(deployment *appsv1.Deployment, esc *operatorv1alpha1.ExternalSecretsConfig) { | ||
| if isCertManagerConfigEnabled(esc) { | ||
| updateSecretVolumeConfig(deployment, "certs", certmanagerTLSSecretWebhook) | ||
| } | ||
| } | ||
|
|
||
| func updateSecretVolumeConfig(deployment *appsv1.Deployment, volumeName, secretName string) { | ||
| for i := range deployment.Spec.Template.Spec.Volumes { | ||
| if deployment.Spec.Template.Spec.Volumes[i].Name == volumeName { | ||
| if deployment.Spec.Template.Spec.Volumes[i].Secret == nil { | ||
| deployment.Spec.Template.Spec.Volumes[i].Secret = &corev1.SecretVolumeSource{} | ||
| } | ||
| deployment.Spec.Template.Spec.Volumes[i].Secret.SecretName = secretName | ||
| return | ||
| } | ||
| } | ||
|
|
||
| deployment.Spec.Template.Spec.Volumes = append(deployment.Spec.Template.Spec.Volumes, corev1.Volume{ | ||
| Name: volumeName, | ||
| VolumeSource: corev1.VolumeSource{ | ||
| Secret: &corev1.SecretVolumeSource{ | ||
| SecretName: secretName, | ||
| }, | ||
| }, | ||
| }) | ||
| } | ||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The docker is used instead of$(CONTAINER_TOOL) because, by default $ (CONTAINER_TOOL) is set to podman, and buildx is supported by docker. Hence just here docker is hardcoded.