Skip to content

Conversation

@DanielePalaia
Copy link
Contributor

…ser credential secret and give the possibility to use an external one

This closes #

Note to reviewers: remember to look at the commits in this PR and consider if they can be squashed

Summary Of Changes

This changement is adding a new field in the SecretBackend struct of the rabbitmqcluster crd to avoid creating the credential secret for the default user automatically. A secret can be provisioned externally to the operator and be used by the operator using this field.
Pods will remain in init mode till the secret will be provisioned.
It can be useful when an external secret tool (like external secret operator) is used to export a secret from a cloud provider secret management system (like google secret manager).

Additional Context

This can be a first step in order to improve the external secrets management.

Local Testing

Tested both the operator and topology operator system tests against this modification

Please ensure you run the unit, integration and system tests before approving the PR.

To run the unit and integration tests:

$ make unit-tests integration-tests

You will need to target a k8s cluster and have the operator deployed for running the system tests.

For example, for a Kubernetes context named dev-bunny:

$ kubectx dev-bunny
$ make destroy deploy-dev
# wait for operator to be deployed
$ make system-tests

…ser credential secret and give the possibility to use an external one
type SecretBackend struct {
Vault *VaultSpec `json:"vault,omitempty"`
Vault *VaultSpec `json:"vault,omitempty"`
ExternalSecret string `json:"externalSecret,omitempty"`
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like this later gets translated into a LocalObjectReference. Could this type just be a LocalObjectReference upfront? I'd be keen to find out if we get more upfront validation if we were to do that.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

By upfront validation, I mean would the Kubernetes API reject the request, rather than making it all the way to the controller before rejecting it.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @coro LocalObjectReference looks good! I modified the type!

@DanielePalaia DanielePalaia requested a review from coro December 12, 2022 09:01
@DanielePalaia DanielePalaia merged commit 9e50b90 into main Dec 12, 2022
@DanielePalaia DanielePalaia deleted the external_secret branch December 12, 2022 10:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants