Skip to content

Commit 103d5f6

Browse files
andrewstuckiandrewstucki
authored
Implement cluster source fields with external secrets (#1178)
* Implement cluster source fields with external secrets * plumb in cloud expansion everywhere * Add changelog entry * fix linter issues * fix console chart test * fix up validation * Add place where expander wasn't passed into factory initialization
1 parent 100aed2 commit 103d5f6

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

61 files changed

+17721
-1431
lines changed

‎.changes/unreleased/operator-Deprecated-20251111-122215.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
project: operator
2+
kind: Deprecated
3+
body: Deprecated various fields in multiple CRDs for `kafka`, `adminAPI`, and `schemaRegistry` under the static configuration of `clusterSource` so that various fields that were only specifiable via an in-cluster secret can now be pulled via either external secret provider, in-cluster secret, config map, or inlined value.
4+
time: 2025-11-11T12:22:15.813496-05:00

‎acceptance/steps/helpers.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -370,7 +370,7 @@ func clientsForCluster(ctx context.Context, cluster string) *clusterClients {
370370
t.Logf("Created fake user %q looking for cluster %q in namespace %q", referencer.Name, cluster, t.Namespace())
371371
t.Logf("Fake user cluster ref: name=%q", referencer.Spec.ClusterSource.ClusterRef.Name)
372372

373-
factory := client.NewFactory(t.RestConfig(), t).WithDialer(kube.NewPodDialer(t.RestConfig()).DialContext)
373+
factory := client.NewFactory(t.RestConfig(), t, nil).WithDialer(kube.NewPodDialer(t.RestConfig()).DialContext)
374374

375375
clients := &clusterClients{
376376
resourceTarget: referencer,
@@ -415,7 +415,7 @@ func v1ClientsForCluster(ctx context.Context, cluster string) *clusterClients {
415415
t.Logf("Created fake user %q looking for cluster %q in namespace %q", referencer.Name, cluster, t.Namespace())
416416
t.Logf("Fake v1 user cluster ref: name=%q", referencer.Spec.ClusterSource.ClusterRef.Name)
417417

418-
factory := client.NewFactory(t.RestConfig(), t).WithDialer(kube.NewPodDialer(t.RestConfig()).DialContext)
418+
factory := client.NewFactory(t.RestConfig(), t, nil).WithDialer(kube.NewPodDialer(t.RestConfig()).DialContext)
419419

420420
clients := &clusterClients{
421421
resourceTarget: referencer,

‎charts/console/chart/templates/_console.config.tpl‎

Lines changed: 25 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,7 @@
106106
{{- end -}}
107107
{{- if (ne (toJson $schema.sasl) "null") -}}
108108
{{- $_ := (set $cfg "authentication" (mustMergeOverwrite (dict) (dict "basic" (mustMergeOverwrite (dict) (dict "username" $schema.sasl.username))))) -}}
109-
{{- $_ := (get (fromJson (include "console.configMapper.addEnv" (dict "a" (list $m "SCHEMAREGISTRY_AUTHENTICATION_BASIC_PASSWORD" $schema.sasl.passwordSecretRef)))) "r") -}}
109+
{{- $_ := (get (fromJson (include "console.configMapper.addEnv" (dict "a" (list $m "SCHEMAREGISTRY_AUTHENTICATION_BASIC_PASSWORD" $schema.sasl.password)))) "r") -}}
110110
{{- $_ := (get (fromJson (include "console.configMapper.addEnv" (dict "a" (list $m "SCHEMAREGISTRY_AUTHENTICATION_BEARERTOKEN" $schema.sasl.token)))) "r") -}}
111111
{{- end -}}
112112
{{- $_is_returning = true -}}
@@ -129,15 +129,15 @@
129129
{{- if $tls.insecureSkipTlsVerify -}}
130130
{{- $_ := (set $out "insecureSkipTlsVerify" $tls.insecureSkipTlsVerify) -}}
131131
{{- end -}}
132-
{{- $ca_7 := (get (fromJson (include "console.volumes.MaybeAdd" (dict "a" (list $m.Volumes $tls.caCertSecretRef)))) "r") -}}
132+
{{- $ca_7 := (get (fromJson (include "console.volumes.MaybeAdd" (dict "a" (list $m.Volumes $tls.caCert)))) "r") -}}
133133
{{- if (ne (toJson $ca_7) "null") -}}
134134
{{- $_ := (set $out "caFilepath" $ca_7) -}}
135135
{{- end -}}
136-
{{- $cert_8 := (get (fromJson (include "console.volumes.MaybeAddSecret" (dict "a" (list $m.Volumes $tls.certSecretRef)))) "r") -}}
136+
{{- $cert_8 := (get (fromJson (include "console.volumes.MaybeAddSecret" (dict "a" (list $m.Volumes $tls.cert)))) "r") -}}
137137
{{- if (ne (toJson $cert_8) "null") -}}
138138
{{- $_ := (set $out "certFilepath" $cert_8) -}}
139139
{{- end -}}
140-
{{- $key_9 := (get (fromJson (include "console.volumes.MaybeAddSecret" (dict "a" (list $m.Volumes $tls.keySecretRef)))) "r") -}}
140+
{{- $key_9 := (get (fromJson (include "console.volumes.MaybeAddSecret" (dict "a" (list $m.Volumes $tls.key)))) "r") -}}
141141
{{- if (ne (toJson $key_9) "null") -}}
142142
{{- $_ := (set $out "keyFilepath" $key_9) -}}
143143
{{- end -}}
@@ -150,9 +150,15 @@
150150
{{- define "console.configMapper.addEnv" -}}
151151
{{- $m := (index .a 0) -}}
152152
{{- $name := (index .a 1) -}}
153-
{{- $ref := (index .a 2) -}}
153+
{{- $secretRef := (index .a 2) -}}
154154
{{- range $_ := (list 1) -}}
155155
{{- $_is_returning := false -}}
156+
{{- if (or (eq (toJson $secretRef) "null") (eq (toJson $secretRef.secretKeyRef) "null")) -}}
157+
{{- $_is_returning = true -}}
158+
{{- (dict "r" (list)) | toJson -}}
159+
{{- break -}}
160+
{{- end -}}
161+
{{- $ref := $secretRef.secretKeyRef -}}
156162
{{- if (or (eq $ref.key "") (eq $ref.name "")) -}}
157163
{{- $_is_returning = true -}}
158164
{{- (dict "r" (list)) | toJson -}}
@@ -181,7 +187,7 @@
181187
{{- $skr_11 := $ref.secretKeyRef -}}
182188
{{- if (ne (toJson $skr_11) "null") -}}
183189
{{- $_is_returning = true -}}
184-
{{- (dict "r" (get (fromJson (include "console.volumes.MaybeAddSecret" (dict "a" (list $v (mustMergeOverwrite (dict "name" "") (dict "name" $skr_11.name "key" $skr_11.key)))))) "r")) | toJson -}}
190+
{{- (dict "r" (get (fromJson (include "console.volumes.MaybeAddSecret" (dict "a" (list $v (mustMergeOverwrite (dict) (dict "secretKeyRef" (mustMergeOverwrite (dict "key" "") (mustMergeOverwrite (dict) (dict "name" $skr_11.name)) (dict "key" $skr_11.key)))))))) "r")) | toJson -}}
185191
{{- break -}}
186192
{{- end -}}
187193
{{- $_is_returning = true -}}
@@ -200,9 +206,9 @@
200206
{{- (dict "r" (coalesce nil)) | toJson -}}
201207
{{- break -}}
202208
{{- end -}}
203-
{{- $_238___ok_12 := (get (fromJson (include "_shims.dicttest" (dict "a" (list $v.ConfigMaps $ref.name (coalesce nil))))) "r") -}}
204-
{{- $_ := (index $_238___ok_12 0) -}}
205-
{{- $ok_12 := (index $_238___ok_12 1) -}}
209+
{{- $_245___ok_12 := (get (fromJson (include "_shims.dicttest" (dict "a" (list $v.ConfigMaps $ref.name (coalesce nil))))) "r") -}}
210+
{{- $_ := (index $_245___ok_12 0) -}}
211+
{{- $ok_12 := (index $_245___ok_12 1) -}}
206212
{{- if (not $ok_12) -}}
207213
{{- $_ := (set $v.ConfigMaps $ref.name (dict)) -}}
208214
{{- end -}}
@@ -215,17 +221,23 @@
215221

216222
{{- define "console.volumes.MaybeAddSecret" -}}
217223
{{- $v := (index .a 0) -}}
218-
{{- $ref := (index .a 1) -}}
224+
{{- $secretRef := (index .a 1) -}}
219225
{{- range $_ := (list 1) -}}
220226
{{- $_is_returning := false -}}
227+
{{- if (or (eq (toJson $secretRef) "null") (eq (toJson $secretRef.secretKeyRef) "null")) -}}
228+
{{- $_is_returning = true -}}
229+
{{- (dict "r" (coalesce nil)) | toJson -}}
230+
{{- break -}}
231+
{{- end -}}
232+
{{- $ref := $secretRef.secretKeyRef -}}
221233
{{- if (or (eq (toJson $ref) "null") ((and (eq $ref.key "") (eq $ref.name "")))) -}}
222234
{{- $_is_returning = true -}}
223235
{{- (dict "r" (coalesce nil)) | toJson -}}
224236
{{- break -}}
225237
{{- end -}}
226-
{{- $_250___ok_13 := (get (fromJson (include "_shims.dicttest" (dict "a" (list $v.Secrets $ref.name (coalesce nil))))) "r") -}}
227-
{{- $_ := (index $_250___ok_13 0) -}}
228-
{{- $ok_13 := (index $_250___ok_13 1) -}}
238+
{{- $_262___ok_13 := (get (fromJson (include "_shims.dicttest" (dict "a" (list $v.Secrets $ref.name (coalesce nil))))) "r") -}}
239+
{{- $_ := (index $_262___ok_13 0) -}}
240+
{{- $ok_13 := (index $_262___ok_13 1) -}}
229241
{{- if (not $ok_13) -}}
230242
{{- $_ := (set $v.Secrets $ref.name (dict)) -}}
231243
{{- end -}}

‎charts/console/config.go‎

Lines changed: 19 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -123,7 +123,7 @@ func (m *configMapper) configureKafka(kafka *ir.KafkaAPISpec) *PartialKafka {
123123
// TODO all the other ones......
124124
}
125125
if kafka.SASL.Password != nil {
126-
m.addEnv("KAFKA_SASL_PASSWORD", *kafka.SASL.Password)
126+
m.addEnv("KAFKA_SASL_PASSWORD", kafka.SASL.Password)
127127
}
128128
}
129129

@@ -187,7 +187,12 @@ func (m *configMapper) configureTLS(tls *ir.CommonTLS) *PartialTLS {
187187
return out
188188
}
189189

190-
func (m *configMapper) addEnv(name string, ref ir.SecretKeyRef) {
190+
func (m *configMapper) addEnv(name string, secretRef *ir.ValueSource) {
191+
if secretRef == nil || secretRef.SecretKeyRef == nil {
192+
return
193+
}
194+
ref := secretRef.SecretKeyRef
195+
191196
if ref.Key == "" || ref.Name == "" {
192197
return
193198
}
@@ -212,7 +217,7 @@ type volumes struct {
212217
ConfigMaps map[string]map[string]bool
213218
}
214219

215-
func (v *volumes) MaybeAdd(ref *ir.ObjectKeyRef) *string {
220+
func (v *volumes) MaybeAdd(ref *ir.ValueSource) *string {
216221
if ref == nil {
217222
return nil
218223
}
@@ -222,9 +227,11 @@ func (v *volumes) MaybeAdd(ref *ir.ObjectKeyRef) *string {
222227
}
223228

224229
if skr := ref.SecretKeyRef; skr != nil {
225-
return v.MaybeAddSecret(&ir.SecretKeyRef{
226-
Name: skr.Name,
227-
Key: skr.Key,
230+
return v.MaybeAddSecret(&ir.ValueSource{
231+
SecretKeyRef: &corev1.SecretKeySelector{
232+
LocalObjectReference: corev1.LocalObjectReference{Name: skr.Name},
233+
Key: skr.Key,
234+
},
228235
})
229236
}
230237

@@ -242,7 +249,12 @@ func (v *volumes) MaybeAddConfigMap(ref *corev1.ConfigMapKeySelector) *string {
242249
return ptr.To(fmt.Sprintf("%s/configmaps/%s/%s", v.Dir, ref.Name, ref.Key))
243250
}
244251

245-
func (v *volumes) MaybeAddSecret(ref *ir.SecretKeyRef) *string {
252+
func (v *volumes) MaybeAddSecret(secretRef *ir.ValueSource) *string {
253+
if secretRef == nil || secretRef.SecretKeyRef == nil {
254+
return nil
255+
}
256+
ref := secretRef.SecretKeyRef
257+
246258
if ref == nil || (ref.Key == "" && ref.Name == "") {
247259
return nil
248260
}

0 commit comments

Comments
 (0)