Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

VSS: Add requeue configuration flags #927

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

VSS: Add requeue configuration flags #927

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e1bf318
Add configuration for horizon of VaultStaticSecrets with HMAC enabled
MM53 Sep 20, 2024
f19603f
Add configuration for min-refresh-after of VaultStaticSecrets
MM53 Sep 20, 2024
e68f14d
Add optional default for refreshAfter of VaultStaticSecrets
MM53 Sep 20, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 7 additions & 3 deletions controllers/vaultstaticsecret_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,9 @@ type VaultStaticSecretReconciler struct {
ClientFactory vault.ClientFactory
SecretDataBuilder *helpers.SecretDataBuilder
HMACValidator helpers.HMACValidator
HMACHorizon time.Duration
MinRefreshAfter time.Duration
DefaultRefreshAfter time.Duration
referenceCache ResourceReferenceCache
GlobalTransformationOptions *helpers.GlobalTransformationOptions
BackOffRegistry *BackOffRegistry
Expand Down Expand Up @@ -99,14 +102,16 @@ func (r *VaultStaticSecretReconciler) Reconcile(ctx context.Context, req ctrl.Re

var requeueAfter time.Duration
if o.Spec.RefreshAfter != "" {
d, err := parseDurationString(o.Spec.RefreshAfter, ".spec.refreshAfter", 0)
d, err := parseDurationString(o.Spec.RefreshAfter, ".spec.refreshAfter", r.MinRefreshAfter)
if err != nil {
logger.Error(err, "Field validation failed")
r.Recorder.Eventf(o, corev1.EventTypeWarning, consts.ReasonVaultStaticSecret,
"Field validation failed, err=%s", err)
return ctrl.Result{RequeueAfter: computeHorizonWithJitter(requeueDurationOnError)}, nil
}
requeueAfter = computeHorizonWithJitter(d)
} else if r.DefaultRefreshAfter > 0 {
requeueAfter = computeHorizonWithJitter(r.DefaultRefreshAfter)
}

r.referenceCache.Set(SecretTransformation, req.NamespacedName,
Expand Down Expand Up @@ -153,8 +158,7 @@ func (r *VaultStaticSecretReconciler) Reconcile(ctx context.Context, req ctrl.Re
// we want to ensure that requeueAfter is set so that we can perform the proper drift detection during each reconciliation.
// setting up a watcher on the Secret is also possibility, but polling seems to be the simplest approach for now.
if requeueAfter == 0 {
// hardcoding a default horizon here, perhaps we will want to make this value public?
requeueAfter = computeHorizonWithJitter(time.Second * 60)
requeueAfter = computeHorizonWithJitter(r.HMACHorizon)
}

// doRolloutRestart only if this is not the first time this secret has been synced
Expand Down
12 changes: 12 additions & 0 deletions main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -137,6 +137,9 @@ func main() {
var uninstall bool
var preDeleteHookTimeoutSeconds int
var minRefreshAfterHVSA time.Duration
var hmacHorizonVSS time.Duration
var minRefreshAfterVSS time.Duration
var defaultRefreshAfterVSS time.Duration
var globalTransformationOpts string
var globalVaultAuthOpts string
var backoffInitialInterval time.Duration
Expand Down Expand Up @@ -173,6 +176,12 @@ func main() {
"Pre-delete hook timeout in seconds")
flag.DurationVar(&minRefreshAfterHVSA, "min-refresh-after-hvsa", time.Second*30,
"Minimum duration between HCPVaultSecretsApp resource reconciliation.")
flag.DurationVar(&hmacHorizonVSS, "hmac-horizon-vss", time.Second*60,
"Duration between VaultStaticSecret resource reconciliation, when using HMAC.")
flag.DurationVar(&minRefreshAfterVSS, "min-refresh-after-vss", 0,
"Minimum duration between VaultStaticSecret resource reconciliation.")
flag.DurationVar(&defaultRefreshAfterVSS, "default-refresh-after-vss", 0,
"Global default for refreshAfter of VaultStaticSecret resources. Set to 0 to disable.")
flag.StringVar(&globalTransformationOpts, "global-transformation-options", "",
fmt.Sprintf("Set global secret transformation options as a comma delimited string. "+
"Also set from environment variable VSO_GLOBAL_TRANSFORMATION_OPTIONS. "+
Expand Down Expand Up @@ -449,6 +458,9 @@ func main() {
Recorder: mgr.GetEventRecorderFor("VaultStaticSecret"),
SecretDataBuilder: secretDataBuilder,
HMACValidator: hmacValidator,
HMACHorizon: hmacHorizonVSS,
MinRefreshAfter: minRefreshAfterVSS,
DefaultRefreshAfter: defaultRefreshAfterVSS,
ClientFactory: clientFactory,
BackOffRegistry: controllers.NewBackOffRegistry(backoffOpts...),
GlobalTransformationOptions: globalTransOptions,
Expand Down
Loading