Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

External Secret: Implementation to skip the creation of the default u… #1199

Merged
merged 2 commits into from
Dec 12, 2022

Conversation

DanielePalaia
Copy link
Contributor

…ser credential secret and give the possibility to use an external one

This closes #

Note to reviewers: remember to look at the commits in this PR and consider if they can be squashed

Summary Of Changes

This changement is adding a new field in the SecretBackend struct of the rabbitmqcluster crd to avoid creating the credential secret for the default user automatically. A secret can be provisioned externally to the operator and be used by the operator using this field.
Pods will remain in init mode till the secret will be provisioned.
It can be useful when an external secret tool (like external secret operator) is used to export a secret from a cloud provider secret management system (like google secret manager).

Additional Context

This can be a first step in order to improve the external secrets management.

Local Testing

Tested both the operator and topology operator system tests against this modification

Please ensure you run the unit, integration and system tests before approving the PR.

To run the unit and integration tests:

$ make unit-tests integration-tests

You will need to target a k8s cluster and have the operator deployed for running the system tests.

For example, for a Kubernetes context named dev-bunny:

$ kubectx dev-bunny
$ make destroy deploy-dev
# wait for operator to be deployed
$ make system-tests

…ser credential secret and give the possibility to use an external one
@@ -104,7 +104,8 @@ type RabbitmqClusterSpec struct {
// Future secret backends could be Secrets Store CSI Driver.
// If not configured, K8s Secrets will be used.
type SecretBackend struct {
Vault *VaultSpec `json:"vault,omitempty"`
Vault *VaultSpec `json:"vault,omitempty"`
ExternalSecret string `json:"externalSecret,omitempty"`
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like this later gets translated into a LocalObjectReference. Could this type just be a LocalObjectReference upfront? I'd be keen to find out if we get more upfront validation if we were to do that.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

By upfront validation, I mean would the Kubernetes API reject the request, rather than making it all the way to the controller before rejecting it.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @coro LocalObjectReference looks good! I modified the type!

@DanielePalaia DanielePalaia requested a review from coro December 12, 2022 09:01
@DanielePalaia DanielePalaia merged commit 9e50b90 into main Dec 12, 2022
@DanielePalaia DanielePalaia deleted the external_secret branch December 12, 2022 10:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants