Repository navigation
[platform] Add secret selectors to app definitions - #1447
Conversation
This patch expands the CozystackResourceDefinitions with new label selector fields to include and exclude secrets by their labelsets. This will enable application developers to selectively show or hide application secrets to and from end-users. ```release-note [platform] Add selectors for application secrets, offering developers an API to control secret visibility for end users. ``` Signed-off-by: Timofei Larkin <[email protected]>
WalkthroughA new struct CozystackResourceDefinitionSecrets was added to define include/exclude secret label selectors. The CozystackResourceDefinitionSpec gained a new optional field Secrets with JSON key "secrets". No methods or control flow were modified. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches
🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello Timofei Larkin (@lllamnyp), I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request enhances the Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces secret selectors to the CozystackResourceDefinitions, enabling application developers to control the visibility of application secrets for end-users. The changes involve adding a Secrets field to the CozystackResourceDefinitionSpec and defining a CozystackResourceDefinitionSecrets struct with Include and Exclude label selectors. I have identified a potential issue with the DeepCopy implementation for the newly added CozystackResourceDefinitionSecrets struct, which could lead to unexpected behavior when copying these objects.
| type CozystackResourceDefinitionSecrets struct { | ||
| // Exclude contains an array of label selectors that target secrets. | ||
| // If a secret matches the selector in any of the elements in the array, it is | ||
| // hidden from the user, regardless of the matches in the include array. | ||
| Exclude []*metav1.LabelSelector `json:"exclude,omitempty"` | ||
| // Include contains an array of label selectors that target secrets. | ||
| // If a secret matches the selector in any of the elements in the array, and | ||
| // matches none of the selectors in the exclude array that secret is marked | ||
| // as a tenant secret and is visible to users. | ||
| Include []*metav1.LabelSelector `json:"include,omitempty"` | ||
| } |
There was a problem hiding this comment.
Consider adding a comment explaining the precedence of Exclude over Include. It's mentioned in the description, but adding it here will improve readability and prevent confusion.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
api/v1alpha1/cozystackresourcedefinitions_types.go(3 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Build
🔇 Additional comments (2)
api/v1alpha1/cozystackresourcedefinitions_types.go (2)
51-52: LGTM! Well-documented field addition.The new
Secretsfield is properly documented and follows Go struct conventions with appropriate JSON tags.
93-103: LGTM! Well-designed secret selector struct with clear semantics.The
CozystackResourceDefinitionSecretsstruct provides a clean API for controlling secret visibility. The exclude-takes-precedence semantics (Line 96-97) and the dual condition for inclusion (Lines 99-101) are well-documented and follow intuitive filtering patterns.The use of
[]*metav1.LabelSelectorallows for flexible label-based secret selection, which aligns well with Kubernetes conventions.
| type CozystackResourceDefinitionSecrets struct { | ||
| // Exclude contains an array of label selectors that target secrets. | ||
| // If a secret matches the selector in any of the elements in the array, it is | ||
| // hidden from the user, regardless of the matches in the include array. | ||
| Exclude []*metav1.LabelSelector `json:"exclude,omitempty"` | ||
| // Include contains an array of label selectors that target secrets. | ||
| // If a secret matches the selector in any of the elements in the array, and | ||
| // matches none of the selectors in the exclude array that secret is marked | ||
| // as a tenant secret and is visible to users. | ||
| Include []*metav1.LabelSelector `json:"include,omitempty"` | ||
| } |
There was a problem hiding this comment.
🧩 Analysis chain
Verify integration with secret filtering logic.
The new struct defines the API contract for secret selectors, but please ensure the corresponding controller or reconciler logic has been implemented to actually filter secrets based on these selectors.
🏁 Script executed:
#!/bin/bash
# Description: Search for code that processes the new Secrets field to ensure integration is complete.
# Expected: Find controller/reconciler code that uses the Include/Exclude selectors.
echo "=== Searching for usage of CozystackResourceDefinitionSecrets ==="
rg -nP --type=go "CozystackResourceDefinitionSecrets|\.Secrets\." -A 3 -B 3
echo -e "\n=== Searching for secret filtering logic ==="
rg -nP --type=go "LabelSelector.*[Ss]ecret|[Ss]ecret.*LabelSelector" -A 3 -B 3
echo -e "\n=== Searching for include/exclude secret logic ==="
rg -nP --type=go "(Include|Exclude).*[Ss]ecret|[Ss]ecret.*(Include|Exclude)" -A 3 -B 3Length of output: 2663
Implement reconciler integration for Secrets.Include/Exclude — no usages found
Searches only found the type declaration at api/v1alpha1/cozystackresourcedefinitions_types.go; there is no controller/reconciler code applying these Include/Exclude LabelSelectors. Add secret-filtering logic to the CozystackResourceDefinition reconciler/controller so secrets are listed and filtered per the API contract.
2 participants
What this PR does
This patch expands the CozystackResourceDefinitions with new label selector fields to include and exclude secrets by their labelsets. This will enable application developers to selectively show or hide application secrets to and from end-users.
Release note
Summary by CodeRabbit