fix for [Repository] refactor fluxv2 to use managed-by annotation instead of system flag #4871

chart/kubeapps/README.md

@@ -472,7 +472,6 @@ Once you have installed Kubeapps follow the [Getting Started Guide](https://gith
 | `kubeappsapis.pluginConfig.kappController.packages.v1alpha1.defaultAllowDowngrades`             | Default policy for allowing applications to be downgraded to previous versions                                                                                             | `false`                            |
 | `kubeappsapis.pluginConfig.kappController.packages.v1alpha1.globalPackagingNamespace`           | Default global packaging namespace                                                                                                                                         | `kapp-controller-packaging-global` |
 | `kubeappsapis.pluginConfig.flux.packages.v1alpha1.defaultUpgradePolicy`                         | Default upgrade policy generating version constraints                                                                                                                      | `none`                             |
-| `kubeappsapis.pluginConfig.flux.packages.v1alpha1.userManagedSecrets`                           | Default policy for handling repository secrets, either managed by the user or by kubeapps-apis                                                                             | `false`                            |
 | `kubeappsapis.pluginConfig.flux.packages.v1alpha1.noCrossNamespaceRefs`                         | Enable this flag to disallow cross-namespace references, useful when running Flux on multi-tenant clusters                                                                 | `false`                            |
 | `kubeappsapis.pluginConfig.resources.packages.v1alpha1.trustedNamespaces.headerName`            | Optional header name for trusted namespaces                                                                                                                                | `""`                               |
 | `kubeappsapis.pluginConfig.resources.packages.v1alpha1.trustedNamespaces.headerPattern`         | Optional header pattern for trusted namespaces                                                                                                                             | `""`                               |
@@ -1054,4 +1053,4 @@ Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
-limitations under the License.
+limitations under the License.

chart/kubeapps/values.yaml

@@ -1537,8 +1537,6 @@ kubeappsapis:
           ## @param kubeappsapis.pluginConfig.flux.packages.v1alpha1.defaultUpgradePolicy Default upgrade policy generating version constraints
           ## enum: [ "major", "minor", "patch", "none" ]
           defaultUpgradePolicy: none
-          ## @param kubeappsapis.pluginConfig.flux.packages.v1alpha1.userManagedSecrets Default policy for handling repository secrets, either managed by the user or by kubeapps-apis
-          userManagedSecrets: false
           ## @param kubeappsapis.pluginConfig.flux.packages.v1alpha1.noCrossNamespaceRefs Enable this flag to disallow cross-namespace references, useful when running Flux on multi-tenant clusters
           noCrossNamespaceRefs: false
     resources:

cmd/kubeapps-apis/docs/kubeapps-apis.swagger.json

@@ -4437,14 +4437,6 @@
       ],
       "default": "PACKAGE_REPOSITORY_AUTH_TYPE_UNSPECIFIED"
     },
-    "pluginsfluxv2packagesv1alpha1SetUserManagedSecretsResponse": {
-      "type": "object",
-      "properties": {
-        "value": {
-          "type": "boolean"
-        }
-      }
-    },
     "protobufAny": {
       "type": "object",
       "properties": {

cmd/kubeapps-apis/plugins/fluxv2/packages/v1alpha1/chart_integration_test.go

@@ -782,8 +782,6 @@ func testKindClusterAvailablePackageEndpointsForOCIHelper(
 				}
 			}
 
-			setUserManagedSecretsAndCleanup(t, fluxPluginReposClient, true)
-
 			if err := kubeAddHelmRepositoryAndCleanup(
 				t, repoName, "oci", tc.registryUrl, secretName, 0); err != nil {
 				t.Fatal(err)
@@ -925,7 +923,7 @@ func testKindClusterAvailablePackageEndpointsForOCIHelper(
 }
 
 func TestKindClusterAvailablePackageEndpointsOCIRepo2Charts(t *testing.T) {
-	fluxPluginClient, fluxPluginReposClient, err := checkEnv(t)
+	fluxPluginClient, _, err := checkEnv(t)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -966,8 +964,6 @@ func TestKindClusterAvailablePackageEndpointsOCIRepo2Charts(t *testing.T) {
 				}
 			}
 
-			setUserManagedSecretsAndCleanup(t, fluxPluginReposClient, true)
-
 			if err := kubeAddHelmRepositoryAndCleanup(
 				t, repoName, "oci", tc.registryUrl, secretName, 0); err != nil {
 				t.Fatal(err)

cmd/kubeapps-apis/plugins/fluxv2/packages/v1alpha1/common/utils.go

@@ -34,7 +34,6 @@ import (
 	"google.golang.org/grpc/status"
 	"helm.sh/helm/v3/pkg/getter"
 	apiv1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/wait"
@@ -95,7 +94,7 @@ func NewDefaultPluginConfig() *FluxPluginConfig {
 		VersionsInSummary:    pkgutils.GetDefaultVersionsInSummary(),
 		TimeoutSeconds:       int32(-1),
 		DefaultUpgradePolicy: pkgutils.UpgradePolicyNone,
-		UserManagedSecrets:   false,
+		NoCrossNamespaceRefs: false,
 	}
 }
 
@@ -132,28 +131,6 @@ func NamespacedName(obj ctrlclient.Object) (*types.NamespacedName, error) {
 	}
 }
 
-// "Local" in the sense of no namespace is specified
-func NewLocalOpaqueSecret(ownerRepo types.NamespacedName) *apiv1.Secret {
-	return &apiv1.Secret{
-		ObjectMeta: metav1.ObjectMeta{
-			GenerateName: ownerRepo.Name + "-",
-		},
-		Type: apiv1.SecretTypeOpaque,
-		Data: map[string][]byte{},
-	}
-}
-
-// "Local" in the sense of no namespace is specified
-func NewLocalDockerConfigJsonSecret(ownerRepo types.NamespacedName) *apiv1.Secret {
-	return &apiv1.Secret{
-		ObjectMeta: metav1.ObjectMeta{
-			GenerateName: ownerRepo.Name + "-",
-		},
-		Type: apiv1.SecretTypeDockerConfigJson,
-		Data: map[string][]byte{},
-	}
-}
-
 // ref: https://blog.trailofbits.com/2020/06/09/how-to-check-if-a-mutex-is-locked-in-go/
 // I understand this is not really "kosher" in general for production usage,
 // but in one specific case (cache populateWith() func) it's okay as a confidence test
@@ -449,10 +426,6 @@ type FluxPluginConfig struct {
 	VersionsInSummary    pkgutils.VersionsInSummary
 	TimeoutSeconds       int32
 	DefaultUpgradePolicy pkgutils.UpgradePolicy
-	// whether or not secrets are fully managed by user or kubeapps
-	// see comments in design spec under AddPackageRepository.
-	// false (i.e. kubeapps manages secrets) by default
-	UserManagedSecrets bool
 	// ref https://github.com/vmware-tanzu/kubeapps/issues/5541
 	NoCrossNamespaceRefs bool
 }
@@ -477,7 +450,6 @@ func ParsePluginConfig(pluginConfigPath string) (*FluxPluginConfig, error) {
 			Packages struct {
 				V1alpha1 struct {
 					DefaultUpgradePolicy string `json:"defaultUpgradePolicy"`
-					UserManagedSecrets   bool   `json:"userManagedSecrets"`
 					NoCrossNamespaceRefs bool   `json:"noCrossNamespaceRefs"`
 				} `json:"v1alpha1"`
 			} `json:"packages"`
@@ -504,7 +476,6 @@ func ParsePluginConfig(pluginConfigPath string) (*FluxPluginConfig, error) {
 			VersionsInSummary:    config.Core.Packages.V1alpha1.VersionsInSummary,
 			TimeoutSeconds:       config.Core.Packages.V1alpha1.TimeoutSeconds,
 			DefaultUpgradePolicy: defaultUpgradePolicy,
-			UserManagedSecrets:   config.Flux.Packages.V1alpha1.UserManagedSecrets,
 			NoCrossNamespaceRefs: config.Flux.Packages.V1alpha1.NoCrossNamespaceRefs,
 		}, nil
 	}

cmd/kubeapps-apis/plugins/fluxv2/packages/v1alpha1/global_vars_test.go

@@ -1505,6 +1505,32 @@ var (
 		}
 	}
 
+	add_repo_req_30 = &corev1.AddPackageRepositoryRequest{
+		Name:            "bar",
+		Context:         &corev1.Context{Namespace: "foo"},
+		Type:            "helm",
+		NamespaceScoped: true,
+		Url:             "http://example.com",
+		Auth: &corev1.PackageRepositoryAuth{
+			Type: corev1.PackageRepositoryAuth_PACKAGE_REPOSITORY_AUTH_TYPE_BASIC_AUTH,
+			PackageRepoAuthOneOf: &corev1.PackageRepositoryAuth_UsernamePassword{
+				UsernamePassword: &corev1.UsernamePassword{
+					Username: "foo",
+					Password: "bar",
+				},
+			},
+		},
+		TlsConfig: &corev1.PackageRepositoryTlsConfig{
+			InsecureSkipVerify: false,
+			PackageRepoTlsConfigOneOf: &corev1.PackageRepositoryTlsConfig_SecretRef{
+				SecretRef: &corev1.SecretKeyReference{
+					Name: "secret-1",
+					Key:  "caFile",
+				},
+			},
+		},
+	}
+
 	add_repo_expected_resp = &corev1.AddPackageRepositoryResponse{
 		PackageRepoRef: repoRef("bar", "foo"),
 	}
@@ -3117,6 +3143,7 @@ var (
 						Username: redactedString,
 						Password: redactedString,
 						Server:   redactedString,
+						Email:    redactedString,
 					},
 				},
 			},
@@ -3158,6 +3185,7 @@ var (
 						Username: redactedString,
 						Password: redactedString,
 						Server:   redactedString,
+						Email:    redactedString,
 					},
 				},
 			},
@@ -3447,6 +3475,49 @@ var (
 		}
 	}
 
+	update_repo_req_19 = &corev1.UpdatePackageRepositoryRequest{
+		PackageRepoRef: repoRefInReq("repo-1", "namespace-1"),
+		Url:            "http://newurl.com",
+		Auth: &corev1.PackageRepositoryAuth{
+			Type: corev1.PackageRepositoryAuth_PACKAGE_REPOSITORY_AUTH_TYPE_BASIC_AUTH,
+			PackageRepoAuthOneOf: &corev1.PackageRepositoryAuth_UsernamePassword{
+				UsernamePassword: &corev1.UsernamePassword{
+					Username: "foo",
+					Password: "bar",
+				},
+			},
+		},
+		TlsConfig: &corev1.PackageRepositoryTlsConfig{
+			InsecureSkipVerify: false,
+			PackageRepoTlsConfigOneOf: &corev1.PackageRepositoryTlsConfig_SecretRef{
+				SecretRef: &corev1.SecretKeyReference{
+					Name: "secret-1",
+					Key:  "caFile",
+				},
+			},
+		},
+	}
+
+	update_repo_req_20 = &corev1.UpdatePackageRepositoryRequest{
+		PackageRepoRef: repoRefInReq("repo-1", "namespace-1"),
+		Url:            "http://newurl.com",
+		Auth: &corev1.PackageRepositoryAuth{
+			Type: corev1.PackageRepositoryAuth_PACKAGE_REPOSITORY_AUTH_TYPE_BASIC_AUTH,
+			PackageRepoAuthOneOf: &corev1.PackageRepositoryAuth_UsernamePassword{
+				UsernamePassword: &corev1.UsernamePassword{
+					Username: "foo",
+					Password: "bar",
+				},
+			},
+		},
+	}
+
+	update_repo_req_21 = &corev1.UpdatePackageRepositoryRequest{
+		PackageRepoRef: repoRefInReq("repo-1", "namespace-1"),
+		Url:            "http://newurl.com",
+		Auth:           secret_1_auth,
+	}
+
 	update_repo_resp_1 = &corev1.UpdatePackageRepositoryResponse{
 		PackageRepoRef: repoRef("repo-1", "namespace-1"),
 	}

cmd/kubeapps-apis/plugins/fluxv2/packages/v1alpha1/integration_utils_test.go

@@ -824,8 +824,8 @@ func kubeCreateSecret(t *testing.T, secret *apiv1.Secret) error {
 	return err
 }
 
-func kubeSetSecretOwnerRef(t *testing.T, secretName types.NamespacedName, ownerRepo *sourcev1.HelmRepository) error {
-	t.Logf("+kubeSetSecretOwnerRef(%s, %s)", secretName, ownerRepo.Name)
+func kubeSetKubeappsManagedSecretOwnerRef(t *testing.T, secretName types.NamespacedName, ownerRepo *sourcev1.HelmRepository) error {
+	t.Logf("+kubeSetKubeappsManagedSecretOwnerRef(%s, %s)", secretName, ownerRepo.Name)
 	typedClient, err := kubeGetTypedClient()
 	if err != nil {
 		return err
@@ -843,6 +843,9 @@ func kubeSetSecretOwnerRef(t *testing.T, secretName types.NamespacedName, ownerR
 		return err
 	}
 
+	// also sets managed-By annotation
+	setSecretManagedByKubeapps(secret)
+
 	secret.OwnerReferences = []metav1.OwnerReference{
 		*metav1.NewControllerRef(
 			ownerRepo,

cmd/kubeapps-apis/plugins/fluxv2/packages/v1alpha1/release_integration_test.go

@@ -1524,8 +1524,6 @@ func createAndWaitForHelmRelease(
 		}
 	}
 
-	setUserManagedSecretsAndCleanup(t, fluxPluginReposClient, true)
-
 	err := kubeAddHelmRepositoryAndCleanup(t, name, tc.repoType, tc.repoUrl, secretName, tc.repoInterval)
 	if err != nil {
 		t.Fatal(err)