Beefing up SecretScope

api/v1alpha1/secretscope_types.go

@@ -37,7 +37,9 @@ type SecretScopeSpec struct {
 type SecretScopeStatus struct {
 	// INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
 	// Important: Run "make" to regenerate code after modifying this file
-	SecretScope *dbmodels.SecretScope `json:"secretscope,omitempty"`
+	SecretScope              *dbmodels.SecretScope `json:"secretscope,omitempty"`
+	WorkspaceVerified        bool                  `json:"workspaceverified,omitempty"`
+	SecretInClusterAvailable bool                  `json:"secretinclusteravailable,omitempty"`
 }
 
 // +kubebuilder:object:root=true
@@ -51,6 +53,16 @@ type SecretScope struct {
 	Status SecretScopeStatus `json:"status,omitempty"`
 }
 
+// IsSecretAvailable returns true if secret in cluster is available
+func (ss *SecretScope) IsSecretAvailable() bool {
+	return ss.Status.SecretInClusterAvailable
+}
+
+// IsVerified returns true if the workspace has been verified as deployable ready
+func (ss *SecretScope) IsVerified() bool {
+	return ss.Status.WorkspaceVerified
+}
+
 // IsSubmitted returns true if the item has been submitted to DataBricks
 func (ss *SecretScope) IsSubmitted() bool {
 	return ss.Status.SecretScope != nil

config/crd/bases/databricks.microsoft.com_secretscopes.yaml

@@ -72,6 +72,8 @@ spec:
         status:
           description: SecretScopeStatus defines the observed state of SecretScope
           properties:
+            secretinclusteravailable:
+              type: boolean
             secretscope:
               description: 'INSERT ADDITIONAL STATUS FIELD - define observed state
                 of cluster Important: Run "make" to regenerate code after modifying
@@ -82,6 +84,8 @@ spec:
                 name:
                   type: string
               type: object
+            workspaceverified:
+              type: boolean
           type: object
       type: object
   versions:

controllers/secretscope_controller.go

@@ -47,7 +47,6 @@ type SecretScopeReconciler struct {
 
 // Reconcile implements the reconciliation loop for the operator
 func (r *SecretScopeReconciler) Reconcile(req ctrl.Request) (ctrl.Result, error) {
-	_ = context.Background()
 	_ = r.Log.WithValues("secretscope", req.NamespacedName)
 
 	// your logic here
@@ -84,16 +83,30 @@ func (r *SecretScopeReconciler) Reconcile(req ctrl.Request) (ctrl.Result, error)
 		return ctrl.Result{}, nil
 	}
 
+	if !instance.IsVerified() {
+		if err = r.verifyWorkspace(instance); err != nil {
+			r.Recorder.Event(instance, corev1.EventTypeWarning, "Failed", err.Error())
+			return ctrl.Result{}, nil
+		}
+	}
+
+	if !instance.IsSecretAvailable() {
+		if err = r.checkSecrets(instance); err != nil {
+			r.Recorder.Event(instance, corev1.EventTypeWarning, "Failed", err.Error())
+			return ctrl.Result{Requeue: true, RequeueAfter: 30 * time.Second}, fmt.Errorf("error when submitting secret scope to the API: %v", err)
+		}
+	}
+
 	if !instance.IsSubmitted() {
-		err = r.submit(instance)
-		if err != nil {
+		if err = r.submit(instance); err != nil {
 			r.Recorder.Event(instance, corev1.EventTypeWarning, "Submitting object", fmt.Sprintf("Failed to submit object: %s", err))
 			return ctrl.Result{}, fmt.Errorf("error when submitting secret scope to the API: %v", err)
 		}
 		r.Recorder.Event(instance, corev1.EventTypeNormal, "Submitted", "Object is submitted")
 	}
 
-	return ctrl.Result{RequeueAfter: 30 * time.Second}, nil
+	r.Recorder.Event(instance, corev1.EventTypeNormal, "Completed", "Object has completed")
+	return ctrl.Result{}, nil
 }
 
 // SetupWithManager adds the controller manager

controllers/secretscope_controller_databricks.go

@@ -44,6 +44,7 @@ func (r *SecretScopeReconciler) get(scope string) (*dbmodels.SecretScope, error)
 	if (dbmodels.SecretScope{}) == matchingScope {
 		return nil, fmt.Errorf("get for secret scope failed. scope not found: %s", scope)
 	}
+
 	return &matchingScope, nil
 }
 
@@ -109,6 +110,7 @@ func (r *SecretScopeReconciler) getSecretValueFrom(namespace string, scopeSecret
 		value := string(secret.Data[scopeSecret.ValueFrom.SecretKeyRef.Key])
 		return value, nil
 	}
+
 	return "", fmt.Errorf("No ValueFrom present to extract secret")
 }
 
@@ -150,25 +152,74 @@ func (r *SecretScopeReconciler) submitACLs(instance *databricksv1alpha1.SecretSc
 	return nil
 }
 
-func (r *SecretScopeReconciler) submit(instance *databricksv1alpha1.SecretScope) error {
+// verifyWorkspace checks if Databricks cluster supports ACLs, and checks if secret scope exists.
+func (r *SecretScopeReconciler) verifyWorkspace(instance *databricksv1alpha1.SecretScope) error {
 	scope := instance.ObjectMeta.Name
 	initialManagePrincipal := instance.Spec.InitialManagePrincipal
 
-	err := r.APIClient.Secrets().CreateSecretScope(scope, initialManagePrincipal)
+	// try create secret scope to see if exists or not.
+	list, err := r.APIClient.Secrets().ListSecretScopes()
 	if err != nil {
 		return err
 	}
 
-	err = r.submitSecrets(instance)
+	for _, n := range list {
+		if n.Name == scope {
+			return fmt.Errorf("Secret scope %v exists", scope)
+		}
+	}
+
+	// create the secret scope here otherwise we cannot verify ACL support.
+	err = r.APIClient.Secrets().CreateSecretScope(scope, initialManagePrincipal)
 	if err != nil {
 		return err
 	}
 
-	err = r.submitACLs(instance)
+	// try to list ACLs to see if cluster supports ACL.
+	if instance.Spec.SecretScopeACLs != nil {
+		if _, err = r.APIClient.Secrets().ListSecretACLs(scope); err != nil {
+			// delete secret scope because we're unable to deploy scope with ACL.
+			_ = r.APIClient.Secrets().DeleteSecretScope(scope)
+			return err
+		}
+	}
+
+	instance.Status.WorkspaceVerified = true
+	return r.Update(context.Background(), instance)
+}
+
+// checkSecrets checks if referenced secret is present in k8s or not.
+func (r *SecretScopeReconciler) checkSecrets(instance *databricksv1alpha1.SecretScope) error {
+	namespace := instance.Namespace
+
+	// if secret in cluster is reference, see if secret exists.
+	for _, secret := range instance.Spec.SecretScopeSecrets {
+		if secret.ValueFrom != nil {
+			if _, err := r.getSecretValueFrom(namespace, secret); err != nil {
+				return err
+			}
+		}
+	}
+
+	instance.Status.SecretInClusterAvailable = true
+	return r.Update(context.Background(), instance)
+}
+
+func (r *SecretScopeReconciler) submit(instance *databricksv1alpha1.SecretScope) error {
+	scope := instance.ObjectMeta.Name
+
+	err := r.submitSecrets(instance)
 	if err != nil {
 		return err
 	}
 
+	if instance.Spec.SecretScopeACLs != nil {
+		err := r.submitACLs(instance)
+		if err != nil {
+			return err
+		}
+	}
+
 	remoteScope, err := r.get(scope)
 	if err != nil {
 		return err