Skip to content

Commit 80fc345

Browse files
lllamnyplllamnyp
committed
[controller,api] Specify visible secrets
This patch carries the selectors for secrets to be shown to end users over from the legacy dashboard-resourcemap roles into the new CozystackResourceDefinition selectors. Also a {{ .namespace }} template variable is added to the variables supported in the `resourceNames` field in the selector. ```release-note [controller,api] Support {{ .namespace }} in `resourceNames` resource selectors, add whitelist of secrets to show to end-users. ``` Signed-off-by: Timofei Larkin <[email protected]>
1 parent c16e37e commit 80fc345

26 files changed

Lines changed: 70 additions & 37 deletions

‎api/v1alpha1/cozystackresourcedefinitions_types.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,7 @@ type CozystackResourceDefinitionRelease struct {
103103
// The resourceNames field supports Go templates with the following variables available:
104104
// - {{ .name }}: The name of the managing application (from apps.cozystack.io/application.name)
105105
// - {{ .kind }}: The lowercased kind of the managing application (from apps.cozystack.io/application.kind)
106+
// - {{ .namespace }}: The namespace of the resource being processed
106107
//
107108
// Example YAML:
108109
// secrets:

‎internal/lineagecontrollerwebhook/matcher.go‎

Lines changed: 16 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -2,32 +2,36 @@ package lineagecontrollerwebhook
22

33
import (
44
"bytes"
5+
"context"
56
"text/template"
67

78
cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
89
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
910
"k8s.io/apimachinery/pkg/labels"
11+
ctrl "sigs.k8s.io/controller-runtime"
12+
"sigs.k8s.io/controller-runtime/pkg/log"
1013
)
1114

1215
// matchName checks if the provided name matches any of the resource names in the array.
1316
// Each entry in resourceNames is treated as a Go template that gets rendered using the passed context.
1417
// A nil resourceNames array matches any string.
15-
func matchName(name string, context map[string]string, resourceNames []string) bool {
18+
func matchName(ctx context.Context, name string, templateContext map[string]string, resourceNames []string) bool {
1619
if resourceNames == nil {
1720
return true
1821
}
1922

23+
logger := log.FromContext(ctx)
2024
for _, templateStr := range resourceNames {
2125
tmpl, err := template.New("resourceName").Parse(templateStr)
2226
if err != nil {
23-
// TODO: emit warning if error
27+
logger.Error(err, "failed to parse resource name template", "template", templateStr)
2428
continue
2529
}
2630

2731
var buf bytes.Buffer
28-
err = tmpl.Execute(&buf, context)
32+
err = tmpl.Execute(&buf, templateContext)
2933
if err != nil {
30-
// TODO: emit warning if error
34+
logger.Error(err, "failed to execute resource name template", "template", templateStr, "context", templateContext)
3135
continue
3236
}
3337

@@ -39,31 +43,31 @@ func matchName(name string, context map[string]string, resourceNames []string) b
3943
return false
4044
}
4145

42-
func matchResourceToSelector(name string, ctx, l map[string]string, s *cozyv1alpha1.CozystackResourceDefinitionResourceSelector) bool {
43-
// TODO: emit warning if error
46+
func matchResourceToSelector(ctx context.Context, name string, templateContext, l map[string]string, s *cozyv1alpha1.CozystackResourceDefinitionResourceSelector) bool {
4447
sel, err := metav1.LabelSelectorAsSelector(&s.LabelSelector)
4548
if err != nil {
49+
log.FromContext(ctx).Error(err, "failed to convert label selector to selector")
4650
return false
4751
}
4852
labelMatches := sel.Matches(labels.Set(l))
49-
nameMatches := matchName(name, ctx, s.ResourceNames)
53+
nameMatches := matchName(ctx, name, templateContext, s.ResourceNames)
5054
return labelMatches && nameMatches
5155
}
5256

53-
func matchResourceToSelectorArray(name string, ctx, l map[string]string, ss []*cozyv1alpha1.CozystackResourceDefinitionResourceSelector) bool {
57+
func matchResourceToSelectorArray(ctx context.Context, name string, templateContext, l map[string]string, ss []*cozyv1alpha1.CozystackResourceDefinitionResourceSelector) bool {
5458
for _, s := range ss {
55-
if matchResourceToSelector(name, ctx, l, s) {
59+
if matchResourceToSelector(ctx, name, templateContext, l, s) {
5660
return true
5761
}
5862
}
5963
return false
6064
}
6165

62-
func matchResourceToExcludeInclude(name string, ctx, l map[string]string, ex, in []*cozyv1alpha1.CozystackResourceDefinitionResourceSelector) bool {
63-
if matchResourceToSelectorArray(name, ctx, l, ex) {
66+
func matchResourceToExcludeInclude(ctx context.Context, name string, templateContext, l map[string]string, ex, in []*cozyv1alpha1.CozystackResourceDefinitionResourceSelector) bool {
67+
if matchResourceToSelectorArray(ctx, name, templateContext, l, ex) {
6468
return false
6569
}
66-
if matchResourceToSelectorArray(name, ctx, l, in) {
70+
if matchResourceToSelectorArray(ctx, name, templateContext, l, in) {
6771
return true
6872
}
6973
return false

‎internal/lineagecontrollerwebhook/webhook.go‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -134,8 +134,9 @@ func (h *LineageControllerWebhook) computeLabels(ctx context.Context, o *unstruc
134134
"apps.cozystack.io/application.name": obj.GetName(),
135135
}
136136
templateLabels := map[string]string{
137-
"kind": strings.ToLower(obj.GetKind()),
138-
"name": obj.GetName(),
137+
"kind": strings.ToLower(obj.GetKind()),
138+
"name": obj.GetName(),
139+
"namespace": o.GetNamespace(),
139140
}
140141
if o.GetAPIVersion() != "v1" || o.GetKind() != "Secret" {
141142
return labels, err
@@ -149,7 +150,7 @@ func (h *LineageControllerWebhook) computeLabels(ctx context.Context, o *unstruc
149150
return corev1alpha1.TenantResourceLabelValue
150151
}
151152
return "false"
152-
}(matchResourceToExcludeInclude(o.GetName(), templateLabels, o.GetLabels(), crd.Spec.Secrets.Exclude, crd.Spec.Secrets.Include))
153+
}(matchResourceToExcludeInclude(ctx, o.GetName(), templateLabels, o.GetLabels(), crd.Spec.Secrets.Exclude, crd.Spec.Secrets.Include))
153154
return labels, err
154155
}
155156

‎packages/apps/rabbitmq/templates/rabbitmq.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,8 @@ apiVersion: v1
5858
kind: Secret
5959
metadata:
6060
name: {{ $.Release.Name }}-{{ kebabcase $user }}-credentials
61+
labels:
62+
apps.cozystack.io/user-secret: "true"
6163
type: Opaque
6264
stringData:
6365
username: {{ $user }}

‎packages/system/cozystack-api/cozyrds/bootbox.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,4 +30,4 @@ spec:
3030
keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "whitelistHTTP"], ["spec", "whitelist"], ["spec", "machines"]]
3131
secrets:
3232
exclude: []
33-
include: [{}]
33+
include: []

‎packages/system/cozystack-api/cozyrds/bucket.yaml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,4 +31,7 @@ spec:
3131
keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"]]
3232
secrets:
3333
exclude: []
34-
include: [{}]
34+
include:
35+
- resourceNames:
36+
- bucket-{{ .name }}
37+
- bucket-{{ .name }}-credentials

‎packages/system/cozystack-api/cozyrds/clickhouse.yaml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,4 +29,6 @@ spec:
2929
keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "replicas"], ["spec", "shards"], ["spec", "resources"], ["spec", "resourcesPreset"], ["spec", "size"], ["spec", "storageClass"], ["spec", "logStorageSize"], ["spec", "logTTL"], ["spec", "users"], ["spec", "backup"], ["spec", "backup", "enabled"], ["spec", "backup", "s3Region"], ["spec", "backup", "s3Bucket"], ["spec", "backup", "schedule"], ["spec", "backup", "cleanupStrategy"], ["spec", "backup", "s3AccessKey"], ["spec", "backup", "s3SecretKey"], ["spec", "backup", "resticPassword"], ["spec", "clickhouseKeeper"], ["spec", "clickhouseKeeper", "enabled"], ["spec", "clickhouseKeeper", "size"], ["spec", "clickhouseKeeper", "resourcesPreset"], ["spec", "clickhouseKeeper", "replicas"]]
3030
secrets:
3131
exclude: []
32-
include: [{}]
32+
include:
33+
- resourceNames:
34+
- clickhouse-{{ .name }}-credentials

‎packages/system/cozystack-api/cozyrds/etcd.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,4 +31,4 @@ spec:
3131
keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "size"], ["spec", "storageClass"], ["spec", "replicas"], ["spec", "resources"], ["spec", "resources", "cpu"], ["spec", "resources", "memory"]]
3232
secrets:
3333
exclude: []
34-
include: [{}]
34+
include: []

‎packages/system/cozystack-api/cozyrds/ferretdb.yaml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,4 +30,6 @@ spec:
3030
keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "replicas"], ["spec", "resources"], ["spec", "resourcesPreset"], ["spec", "size"], ["spec", "storageClass"], ["spec", "external"], ["spec", "quorum"], ["spec", "quorum", "minSyncReplicas"], ["spec", "quorum", "maxSyncReplicas"], ["spec", "users"], ["spec", "backup"], ["spec", "backup", "enabled"], ["spec", "backup", "schedule"], ["spec", "backup", "retentionPolicy"], ["spec", "backup", "endpointURL"], ["spec", "backup", "destinationPath"], ["spec", "backup", "s3AccessKey"], ["spec", "backup", "s3SecretKey"], ["spec", "bootstrap"], ["spec", "bootstrap", "enabled"], ["spec", "bootstrap", "recoveryTime"], ["spec", "bootstrap", "oldName"]]
3131
secrets:
3232
exclude: []
33-
include: [{}]
33+
include:
34+
- resourceNames:
35+
- ferretdb-{{ .name }}-credentials

‎packages/system/cozystack-api/cozyrds/http-cache.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,4 +31,4 @@ spec:
3131
keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "size"], ["spec", "storageClass"], ["spec", "external"], ["spec", "endpoints"], ["spec", "haproxy"], ["spec", "haproxy", "replicas"], ["spec", "haproxy", "resources"], ["spec", "haproxy", "resourcesPreset"], ["spec", "nginx"], ["spec", "nginx", "replicas"], ["spec", "nginx", "resources"], ["spec", "nginx", "resourcesPreset"]]
3232
secrets:
3333
exclude: []
34-
include: [{}]
34+
include: []

0 commit comments

Comments
 (0)