Set rotated at in secret annotation

Author: xek

controllers/keystoneapi_controller.go

@@ -1327,7 +1327,7 @@ func (r *KeystoneAPIReconciler) ensureFernetKeys(
 	helper *helper.Helper,
 	envVars *map[string]env.Setter,
 ) error {
-	fernetLabel := labels.GetGroupLabel(keystone.ServiceName) + "/rotatedat"
+	fernetAnnotation := labels.GetGroupLabel(keystone.ServiceName) + "/rotatedat"
 	labels := labels.GetLabels(instance, labels.GetGroupLabel(keystone.ServiceName), map[string]string{})
 	now := time.Now().UTC()
 
@@ -1351,15 +1351,17 @@ func (r *KeystoneAPIReconciler) ensureFernetKeys(
 			fernetKeys[fmt.Sprintf("FernetKeys%d", i)] = keystone.GenerateFernetKey()
 		}
 
-		labels[fernetLabel] = now.Format(time.RFC3339)
+		annotations := map[string]string{
+			fernetAnnotation: now.Format(time.RFC3339)}
 
 		tmpl := []util.Template{
 			{
-				Name:       secretName,
-				Namespace:  instance.Namespace,
-				Type:       util.TemplateTypeNone,
-				CustomData: fernetKeys,
-				Labels:     labels,
+				Name:        secretName,
+				Namespace:   instance.Namespace,
+				Type:        util.TemplateTypeNone,
+				CustomData:  fernetKeys,
+				Labels:      labels,
+				Annotations: annotations,
 			},
 		}
 		err := oko_secret.EnsureSecrets(ctx, helper, instance, tmpl, envVars)
@@ -1377,11 +1379,11 @@ func (r *KeystoneAPIReconciler) ensureFernetKeys(
 		//
 		// Fernet Key rotation
 		//
-		rotatedAt, err := time.Parse(time.RFC3339, labels[fernetLabel])
+		rotatedAt, err := time.Parse(time.RFC3339, secret.Annotations[fernetAnnotation])
 		duration := int(*instance.Spec.FernetRotationDays)
 
 		if err != nil {
-			labels[fernetLabel] = now.Format(time.RFC3339)
+			secret.Annotations[fernetAnnotation] = now.Format(time.RFC3339)
 		} else if rotatedAt.AddDate(0, 0, duration).After(now) {
 			secret.Data[extraKey] = secret.Data["FernetKeys0"]
 			secret.Data["FernetKeys0"] = []byte(keystone.GenerateFernetKey())
@@ -1445,11 +1447,12 @@ func (r *KeystoneAPIReconciler) ensureFernetKeys(
 
 		tmpl := []util.Template{
 			{
-				Name:       secretName,
-				Namespace:  instance.Namespace,
-				Type:       util.TemplateTypeNone,
-				CustomData: fernetKeys,
-				Labels:     labels,
+				Name:        secretName,
+				Namespace:   instance.Namespace,
+				Type:        util.TemplateTypeNone,
+				CustomData:  fernetKeys,
+				Labels:      labels,
+				Annotations: secret.Annotations,
 			},
 		}