Skip to content

Commit a0b4969

Browse files
matheuscscpmatheuscscp
authored
Merge pull request #1851 from cappyzawa/feat/oci-repository-runtime-secrets-migration
Migrate OCIRepository controller to runtime/secrets
2 parents 173a1cc + b2993a7 commit a0b4969

File tree

6 files changed

+42
-283
lines changed

6 files changed

+42
-283
lines changed

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ require (
3838
github.com/fluxcd/pkg/lockedfile v0.6.0
3939
github.com/fluxcd/pkg/masktoken v0.7.0
4040
github.com/fluxcd/pkg/oci v0.51.0
41-
github.com/fluxcd/pkg/runtime v0.73.0
41+
github.com/fluxcd/pkg/runtime v0.75.0
4242
github.com/fluxcd/pkg/sourceignore v0.13.0
4343
github.com/fluxcd/pkg/ssh v0.20.0
4444
github.com/fluxcd/pkg/tar v0.13.0

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -398,8 +398,8 @@ github.com/fluxcd/pkg/masktoken v0.7.0 h1:pitmyOg2pUVdW+nn2Lk/xqm2TaA08uxvOC0ns3
398398
github.com/fluxcd/pkg/masktoken v0.7.0/go.mod h1:Lc1uoDjO1GY6+YdkK+ZqqBIBWquyV58nlSJ5S1N1IYU=
399399
github.com/fluxcd/pkg/oci v0.51.0 h1:9oYnm+T4SCVSBif9gn80ALJkMGSERabVMDJiaMIdr7Y=
400400
github.com/fluxcd/pkg/oci v0.51.0/go.mod h1:5J6IhHoDVYCVeBEC+4E3nPeKh7d0kjJ8IEL6NVCiTx4=
401-
github.com/fluxcd/pkg/runtime v0.73.0 h1:BV3qEwMT3lfHA2lterT3Es62z6EkJr2ST/jkyBmmskQ=
402-
github.com/fluxcd/pkg/runtime v0.73.0/go.mod h1:iGhdaEq+lMJQTJNAFEPOU4gUJ7kt3yeDcJPZy7O9IUw=
401+
github.com/fluxcd/pkg/runtime v0.75.0 h1:wIaODmU5D54nyrehTqA9oQDFoi6BbBj/24adLStXc0I=
402+
github.com/fluxcd/pkg/runtime v0.75.0/go.mod h1:iGhdaEq+lMJQTJNAFEPOU4gUJ7kt3yeDcJPZy7O9IUw=
403403
github.com/fluxcd/pkg/sourceignore v0.13.0 h1:ZvkzX2WsmyZK9cjlqOFFW1onHVzhPZIqDbCh96rPqbU=
404404
github.com/fluxcd/pkg/sourceignore v0.13.0/go.mod h1:Z9H1GoBx0ljOhptnzoV0PL6Nd/UzwKcSphP27lqb4xI=
405405
github.com/fluxcd/pkg/ssh v0.20.0 h1:Ak0laIYIc/L8lEfqls/LDWRW8wYPESGaravQsCRGLb8=

‎internal/controller/helmrepository_controller_test.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -482,7 +482,7 @@ func TestHelmRepositoryReconciler_reconcileSource(t *testing.T) {
482482
repoURL, err := repository.NormalizeURL(serverURL)
483483
t.Expect(err).ToNot(HaveOccurred())
484484

485-
tlsConfig, err := secrets.TLSConfigFromSecret(context.TODO(), secret)
485+
tlsConfig, err := secrets.TLSConfigFromSecret(context.TODO(), secret, serverURL, false)
486486
t.Expect(err).ToNot(HaveOccurred())
487487

488488
getterOpts := []helmgetter.Option{
@@ -534,7 +534,7 @@ func TestHelmRepositoryReconciler_reconcileSource(t *testing.T) {
534534
repoURL, err := repository.NormalizeURL(serverURL)
535535
t.Expect(err).ToNot(HaveOccurred())
536536

537-
tlsConfig, err := secrets.TLSConfigFromSecret(context.TODO(), secret)
537+
tlsConfig, err := secrets.TLSConfigFromSecret(context.TODO(), secret, serverURL, false)
538538
t.Expect(err).ToNot(HaveOccurred())
539539

540540
getterOpts := []helmgetter.Option{
@@ -588,7 +588,7 @@ func TestHelmRepositoryReconciler_reconcileSource(t *testing.T) {
588588
repoURL, err := repository.NormalizeURL(serverURL)
589589
t.Expect(err).ToNot(HaveOccurred())
590590

591-
tlsConfig, err := secrets.TLSConfigFromSecret(context.TODO(), secret)
591+
tlsConfig, err := secrets.TLSConfigFromSecret(context.TODO(), secret, serverURL, false)
592592
t.Expect(err).ToNot(HaveOccurred())
593593

594594
getterOpts := []helmgetter.Option{

‎internal/controller/ocirepository_controller.go‎

Lines changed: 32 additions & 88 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,6 @@ import (
4343
corev1 "k8s.io/api/core/v1"
4444
"k8s.io/apimachinery/pkg/runtime"
4545
"k8s.io/apimachinery/pkg/types"
46-
"k8s.io/apimachinery/pkg/util/sets"
4746
kuberecorder "k8s.io/client-go/tools/record"
4847
"k8s.io/client-go/util/workqueue"
4948
"k8s.io/utils/ptr"
@@ -60,6 +59,7 @@ import (
6059
"github.com/fluxcd/pkg/runtime/patch"
6160
"github.com/fluxcd/pkg/runtime/predicates"
6261
rreconcile "github.com/fluxcd/pkg/runtime/reconcile"
62+
"github.com/fluxcd/pkg/runtime/secrets"
6363
"github.com/fluxcd/pkg/sourceignore"
6464
"github.com/fluxcd/pkg/tar"
6565
"github.com/fluxcd/pkg/version"
@@ -77,7 +77,6 @@ import (
7777
"github.com/fluxcd/source-controller/internal/oci/notation"
7878
sreconcile "github.com/fluxcd/source-controller/internal/reconcile"
7979
"github.com/fluxcd/source-controller/internal/reconcile/summarize"
80-
"github.com/fluxcd/source-controller/internal/tls"
8180
"github.com/fluxcd/source-controller/internal/util"
8281
)
8382

@@ -355,14 +354,21 @@ func (r *OCIRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
355354
return sreconcile.ResultEmpty, e
356355
}
357356

358-
proxyURL, err := r.getProxyURL(ctx, obj)
359-
if err != nil {
360-
e := serror.NewGeneric(
361-
fmt.Errorf("failed to get proxy address: %w", err),
362-
sourcev1.AuthenticationFailedReason,
363-
)
364-
conditions.MarkTrue(obj, sourcev1.FetchFailedCondition, e.Reason, "%s", e)
365-
return sreconcile.ResultEmpty, e
357+
var proxyURL *url.URL
358+
if obj.Spec.ProxySecretRef != nil {
359+
var err error
360+
proxyURL, err = secrets.ProxyURLFromSecretRef(ctx, r.Client, types.NamespacedName{
361+
Name: obj.Spec.ProxySecretRef.Name,
362+
Namespace: obj.GetNamespace(),
363+
})
364+
if err != nil {
365+
e := serror.NewGeneric(
366+
fmt.Errorf("failed to get proxy address: %w", err),
367+
sourcev1.AuthenticationFailedReason,
368+
)
369+
conditions.MarkTrue(obj, sourcev1.FetchFailedCondition, e.Reason, "%s", e)
370+
return sreconcile.ResultEmpty, e
371+
}
366372
}
367373

368374
if _, ok := keychain.(soci.Anonymous); obj.Spec.Provider != "" && obj.Spec.Provider != sourcev1.GenericOCIProvider && ok {
@@ -920,44 +926,36 @@ func (r *OCIRepositoryReconciler) getTagBySemver(repo name.Repository, exp strin
920926
// configuration. If no auth is specified a default keychain with
921927
// anonymous access is returned
922928
func (r *OCIRepositoryReconciler) keychain(ctx context.Context, obj *sourcev1.OCIRepository) (authn.Keychain, error) {
923-
pullSecretNames := sets.NewString()
929+
var imagePullSecrets []corev1.Secret
924930

925931
// lookup auth secret
926932
if obj.Spec.SecretRef != nil {
927-
pullSecretNames.Insert(obj.Spec.SecretRef.Name)
933+
var imagePullSecret corev1.Secret
934+
secretRef := types.NamespacedName{Namespace: obj.Namespace, Name: obj.Spec.SecretRef.Name}
935+
err := r.Get(ctx, secretRef, &imagePullSecret)
936+
if err != nil {
937+
r.eventLogf(ctx, obj, eventv1.EventTypeTrace, sourcev1.AuthenticationFailedReason,
938+
"auth secret '%s' not found", obj.Spec.SecretRef.Name)
939+
return nil, err
940+
}
941+
imagePullSecrets = append(imagePullSecrets, imagePullSecret)
928942
}
929943

930944
// lookup service account
931945
if obj.Spec.ServiceAccountName != "" {
932-
serviceAccountName := obj.Spec.ServiceAccountName
933-
serviceAccount := corev1.ServiceAccount{}
934-
err := r.Get(ctx, types.NamespacedName{Namespace: obj.Namespace, Name: serviceAccountName}, &serviceAccount)
946+
saRef := types.NamespacedName{Namespace: obj.Namespace, Name: obj.Spec.ServiceAccountName}
947+
saSecrets, err := secrets.PullSecretsFromServiceAccountRef(ctx, r.Client, saRef)
935948
if err != nil {
936949
return nil, err
937950
}
938-
for _, ips := range serviceAccount.ImagePullSecrets {
939-
pullSecretNames.Insert(ips.Name)
940-
}
951+
imagePullSecrets = append(imagePullSecrets, saSecrets...)
941952
}
942953

943954
// if no pullsecrets available return an AnonymousKeychain
944-
if len(pullSecretNames) == 0 {
955+
if len(imagePullSecrets) == 0 {
945956
return soci.Anonymous{}, nil
946957
}
947958

948-
// lookup image pull secrets
949-
imagePullSecrets := make([]corev1.Secret, len(pullSecretNames))
950-
for i, imagePullSecretName := range pullSecretNames.List() {
951-
imagePullSecret := corev1.Secret{}
952-
err := r.Get(ctx, types.NamespacedName{Namespace: obj.Namespace, Name: imagePullSecretName}, &imagePullSecret)
953-
if err != nil {
954-
r.eventLogf(ctx, obj, eventv1.EventTypeTrace, sourcev1.AuthenticationFailedReason,
955-
"auth secret '%s' not found", imagePullSecretName)
956-
return nil, err
957-
}
958-
imagePullSecrets[i] = imagePullSecret
959-
}
960-
961959
return k8schain.NewFromPullSecrets(ctx, imagePullSecrets)
962960
}
963961

@@ -995,65 +993,11 @@ func (r *OCIRepositoryReconciler) getTLSConfig(ctx context.Context, obj *sourcev
995993
return nil, nil
996994
}
997995

998-
certSecretName := types.NamespacedName{
996+
secretName := types.NamespacedName{
999997
Namespace: obj.Namespace,
1000998
Name: obj.Spec.CertSecretRef.Name,
1001999
}
1002-
var certSecret corev1.Secret
1003-
if err := r.Get(ctx, certSecretName, &certSecret); err != nil {
1004-
return nil, err
1005-
}
1006-
1007-
tlsConfig, _, err := tls.KubeTLSClientConfigFromSecret(certSecret, "")
1008-
if err != nil {
1009-
return nil, err
1010-
}
1011-
if tlsConfig == nil {
1012-
tlsConfig, _, err = tls.TLSClientConfigFromSecret(certSecret, "")
1013-
if err != nil {
1014-
return nil, err
1015-
}
1016-
if tlsConfig != nil {
1017-
ctrl.LoggerFrom(ctx).
1018-
Info("warning: specifying TLS auth data via `certFile`/`keyFile`/`caFile` is deprecated, please use `tls.crt`/`tls.key`/`ca.crt` instead")
1019-
}
1020-
}
1021-
1022-
return tlsConfig, nil
1023-
}
1024-
1025-
// getProxyURL gets the proxy configuration for the transport based on the
1026-
// specified proxy secret reference in the OCIRepository object.
1027-
func (r *OCIRepositoryReconciler) getProxyURL(ctx context.Context, obj *sourcev1.OCIRepository) (*url.URL, error) {
1028-
if obj.Spec.ProxySecretRef == nil || obj.Spec.ProxySecretRef.Name == "" {
1029-
return nil, nil
1030-
}
1031-
1032-
proxySecretName := types.NamespacedName{
1033-
Namespace: obj.Namespace,
1034-
Name: obj.Spec.ProxySecretRef.Name,
1035-
}
1036-
var proxySecret corev1.Secret
1037-
if err := r.Get(ctx, proxySecretName, &proxySecret); err != nil {
1038-
return nil, err
1039-
}
1040-
1041-
proxyData := proxySecret.Data
1042-
address, ok := proxyData["address"]
1043-
if !ok {
1044-
return nil, fmt.Errorf("invalid proxy secret '%s/%s': key 'address' is missing",
1045-
obj.Namespace, obj.Spec.ProxySecretRef.Name)
1046-
}
1047-
proxyURL, err := url.Parse(string(address))
1048-
if err != nil {
1049-
return nil, fmt.Errorf("failed to parse proxy address '%s': %w", address, err)
1050-
}
1051-
user, hasUser := proxyData["username"]
1052-
password, hasPassword := proxyData["password"]
1053-
if hasUser || hasPassword {
1054-
proxyURL.User = url.UserPassword(string(user), string(password))
1055-
}
1056-
return proxyURL, nil
1000+
return secrets.TLSConfigFromSecretRef(ctx, r.Client, secretName, obj.Spec.URL, obj.Spec.Insecure)
10571001
}
10581002

10591003
// reconcileStorage ensures the current state of the storage matches the

0 commit comments

Comments
 (0)