fix: sync provisioned user credential rotation

Author: overtrue

deploy/rustfs-operator/crds/tenant-crd.yaml

@@ -1895,6 +1895,9 @@ spec:
                         desiredHash:
                           nullable: true
                           type: string
+                        lastAppliedAccessKeyHash:
+                          nullable: true
+                          type: string
                         lastAppliedGeneration:
                           format: int64
                           nullable: true
@@ -1951,6 +1954,9 @@ spec:
                         desiredHash:
                           nullable: true
                           type: string
+                        lastAppliedAccessKeyHash:
+                          nullable: true
+                          type: string
                         lastAppliedGeneration:
                           format: int64
                           nullable: true
@@ -1995,6 +2001,9 @@ spec:
                         desiredHash:
                           nullable: true
                           type: string
+                        lastAppliedAccessKeyHash:
+                          nullable: true
+                          type: string
                         lastAppliedGeneration:
                           format: int64
                           nullable: true

deploy/rustfs-operator/crds/tenant.yaml

@@ -1895,6 +1895,9 @@ spec:
                         desiredHash:
                           nullable: true
                           type: string
+                        lastAppliedAccessKeyHash:
+                          nullable: true
+                          type: string
                         lastAppliedGeneration:
                           format: int64
                           nullable: true
@@ -1951,6 +1954,9 @@ spec:
                         desiredHash:
                           nullable: true
                           type: string
+                        lastAppliedAccessKeyHash:
+                          nullable: true
+                          type: string
                         lastAppliedGeneration:
                           format: int64
                           nullable: true
@@ -1995,6 +2001,9 @@ spec:
                         desiredHash:
                           nullable: true
                           type: string
+                        lastAppliedAccessKeyHash:
+                          nullable: true
+                          type: string
                         lastAppliedGeneration:
                           format: int64
                           nullable: true

docs/operator-user-guide.md

@@ -476,6 +476,8 @@ ConfigMaps and user Secrets must live in the Tenant namespace. If managed outsid
 
 For each `spec.users[]` entry, the operator reads a Secret with the same name as the user. The Secret must contain `accesskey` and `secretkey`, or the MinIO-compatible keys `CONSOLE_ACCESS_KEY` and `CONSOLE_SECRET_KEY`. If both key formats are present, their values must match. User access keys must be at least 8 characters and must not contain whitespace, `=`, or `,`; user secret keys must be at least 8 characters.
 
+Updating a user Secret's `secretkey` rotates that RustFS user's credential. The `accesskey` is immutable after the first successful reconciliation; use a new user entry and Secret when it must change, then migrate clients before removing the old entry.
+
 ```yaml
 apiVersion: v1
 kind: ConfigMap

docs/operator-user-guide.zh-CN.md

@@ -478,6 +478,8 @@ ConfigMap 和 user Secret 必须位于 Tenant namespace。若这些资源不是
 
 每个 `spec.users[]` 条目都会读取一个与 user 名同名的 Secret。Secret 必须包含 `accesskey` 和 `secretkey`，或者 MinIO 兼容 key：`CONSOLE_ACCESS_KEY` 和 `CONSOLE_SECRET_KEY`。如果两种 key 同时存在，值必须一致。user access key 至少 8 个字符，且不能包含空白、`=` 或 `,`；user secret key 至少 8 个字符。
 
+更新 user Secret 的 `secretkey` 会轮换对应 RustFS user 的凭据。首次成功 provisioning 后，`accesskey` 不可变；如需变更，请新建 user 条目和 Secret，迁移客户端后再移除旧条目。
+
 ```yaml
 apiVersion: v1
 kind: ConfigMap