github/Reloader
1
0
Fork 0
mirror of https://github.com/stakater/Reloader.git synced 2026-08-23 22:16:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

wip: port csi provider to v2 sa-8436

Browse Source
This commit is contained in:
Safwan
2026-06-22 16:42:01 +05:00
parent 14117194ac
commit 73729c951e
40 changed files with 1821 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/pkg/config/config.go
+38 -30
View File
@@ -32,6 +32,7 @@ type Config struct {
ArgoRolloutsEnabled bool `json:"argoRolloutsEnabled"`
ArgoRolloutStrategy ArgoRolloutStrategy `json:"argoRolloutStrategy"`
DeploymentConfigEnabled bool `json:"deploymentConfigEnabled"`
CSIIntegrationEnabled bool `json:"csiIntegrationEnabled"`
ReloadOnCreate bool `json:"reloadOnCreate"`
ReloadOnDelete bool `json:"reloadOnDelete"`
SyncAfterRestart bool `json:"syncAfterRestart"`
@@ -61,21 +62,24 @@ type Config struct {
// AnnotationConfig holds customizable annotation keys.
type AnnotationConfig struct {
Prefix string `json:"prefix"`
Auto string `json:"auto"`
ConfigmapAuto string `json:"configmapAuto"`
SecretAuto string `json:"secretAuto"`
ConfigmapReload string `json:"configmapReload"`
SecretReload string `json:"secretReload"`
ConfigmapExclude string `json:"configmapExclude"`
SecretExclude string `json:"secretExclude"`
Ignore string `json:"ignore"`
Search string `json:"search"`
Match string `json:"match"`
RolloutStrategy string `json:"rolloutStrategy"`
PausePeriod string `json:"pausePeriod"`
PausedAt string `json:"pausedAt"`
LastReloadedFrom string `json:"lastReloadedFrom"`
Prefix string `json:"prefix"`
Auto string `json:"auto"`
ConfigmapAuto string `json:"configmapAuto"`
SecretAuto string `json:"secretAuto"`
ConfigmapReload string `json:"configmapReload"`
SecretReload string `json:"secretReload"`
ConfigmapExclude string `json:"configmapExclude"`
SecretExclude string `json:"secretExclude"`
SecretProviderClassAuto string `json:"secretProviderClassAuto"`
SecretProviderClassReload string `json:"secretProviderClassReload"`
SecretProviderClassExclude string `json:"secretProviderClassExclude"`
Ignore string `json:"ignore"`
Search string `json:"search"`
Match string `json:"match"`
RolloutStrategy string `json:"rolloutStrategy"`
PausePeriod string `json:"pausePeriod"`
PausedAt string `json:"pausedAt"`
LastReloadedFrom string `json:"lastReloadedFrom"`
}
// AlertingConfig holds configuration for alerting integrations.
@@ -108,6 +112,7 @@ func NewDefault() *Config {
ArgoRolloutsEnabled: false,
ArgoRolloutStrategy: ArgoRolloutStrategyRollout,
DeploymentConfigEnabled: false,
CSIIntegrationEnabled: false,
ReloadOnCreate: false,
ReloadOnDelete: false,
SyncAfterRestart: false,
@@ -140,21 +145,24 @@ func NewDefault() *Config {
// DefaultAnnotations returns the default annotation configuration.
func DefaultAnnotations() AnnotationConfig {
return AnnotationConfig{
Prefix: "reloader.stakater.com",
Auto: "reloader.stakater.com/auto",
ConfigmapAuto: "configmap.reloader.stakater.com/auto",
SecretAuto: "secret.reloader.stakater.com/auto",
ConfigmapReload: "configmap.reloader.stakater.com/reload",
SecretReload: "secret.reloader.stakater.com/reload",
ConfigmapExclude: "configmaps.exclude.reloader.stakater.com/reload",
SecretExclude: "secrets.exclude.reloader.stakater.com/reload",
Ignore: "reloader.stakater.com/ignore",
Search: "reloader.stakater.com/search",
Match: "reloader.stakater.com/match",
RolloutStrategy: "reloader.stakater.com/rollout-strategy",
PausePeriod: "deployment.reloader.stakater.com/pause-period",
PausedAt: "deployment.reloader.stakater.com/paused-at",
LastReloadedFrom: "reloader.stakater.com/last-reloaded-from",
Prefix: "reloader.stakater.com",
Auto: "reloader.stakater.com/auto",
ConfigmapAuto: "configmap.reloader.stakater.com/auto",
SecretAuto: "secret.reloader.stakater.com/auto",
ConfigmapReload: "configmap.reloader.stakater.com/reload",
SecretReload: "secret.reloader.stakater.com/reload",
ConfigmapExclude: "configmaps.exclude.reloader.stakater.com/reload",
SecretExclude: "secrets.exclude.reloader.stakater.com/reload",
SecretProviderClassAuto: "secretproviderclass.reloader.stakater.com/auto",
SecretProviderClassReload: "secretproviderclass.reloader.stakater.com/reload",
SecretProviderClassExclude: "secretproviderclasses.exclude.reloader.stakater.com/reload",
Ignore: "reloader.stakater.com/ignore",
Search: "reloader.stakater.com/search",
Match: "reloader.stakater.com/match",
RolloutStrategy: "reloader.stakater.com/rollout-strategy",
PausePeriod: "deployment.reloader.stakater.com/pause-period",
PausedAt: "deployment.reloader.stakater.com/paused-at",
LastReloadedFrom: "reloader.stakater.com/last-reloaded-from",
}
}
internal/pkg/config/config_test.go
+19
View File
@@ -173,6 +173,25 @@ func TestConfig_IsWorkloadIgnored(t *testing.T) {
}
}
func TestDefaultAnnotationsSecretProviderClass(t *testing.T) {
a := DefaultAnnotations()
if a.SecretProviderClassAuto != "secretproviderclass.reloader.stakater.com/auto" {
t.Fatalf("SecretProviderClassAuto = %q", a.SecretProviderClassAuto)
}
if a.SecretProviderClassReload != "secretproviderclass.reloader.stakater.com/reload" {
t.Fatalf("SecretProviderClassReload = %q", a.SecretProviderClassReload)
}
if a.SecretProviderClassExclude != "secretproviderclasses.exclude.reloader.stakater.com/reload" {
t.Fatalf("SecretProviderClassExclude = %q", a.SecretProviderClassExclude)
}
}
func TestNewDefaultCSIDisabled(t *testing.T) {
if NewDefault().CSIIntegrationEnabled {
t.Fatal("CSIIntegrationEnabled should default to false")
}
}
func TestConfig_IsNamespaceIgnored(t *testing.T) {
cfg := NewDefault()
cfg.IgnoredNamespaces = []string{"kube-system", "kube-public"}
internal/pkg/config/flags.go
+19
View File
@@ -47,6 +47,12 @@ func BindFlags(fs *pflag.FlagSet, cfg *Config) {
"Enable OpenShift DeploymentConfig support (true/false/auto). Empty or 'auto' enables auto-detection",
)
// CSI integration
fs.Bool(
"enable-csi-integration", cfg.CSIIntegrationEnabled,
"Enable CSI SecretProviderClass integration (requires secrets-store CSI driver CRDs)",
)
// Event watching
fs.String(
"reload-on-create", "false",
@@ -241,6 +247,7 @@ func ApplyFlags(cfg *Config) error {
cfg.SyncAfterRestart = v.GetBool("sync-after-restart")
cfg.EnableHA = v.GetBool("enable-ha")
cfg.EnablePProf = v.GetBool("enable-pprof")
cfg.CSIIntegrationEnabled = v.GetBool("enable-csi-integration")
// Boolean string flags (legacy format: "true"/"false" strings)
cfg.ArgoRolloutsEnabled = parseBoolString(v.GetString("is-Argo-Rollouts"))
@@ -287,6 +294,18 @@ func ApplyFlags(cfg *Config) error {
cfg.Annotations.PausePeriod = v.GetString("pause-deployment-annotation")
cfg.Annotations.PausedAt = v.GetString("pause-deployment-time-annotation")
// SecretProviderClass annotations have no dedicated CLI flag (parity with
// master); keep the configured defaults.
if cfg.Annotations.SecretProviderClassAuto == "" {
cfg.Annotations.SecretProviderClassAuto = DefaultAnnotations().SecretProviderClassAuto
}
if cfg.Annotations.SecretProviderClassReload == "" {
cfg.Annotations.SecretProviderClassReload = DefaultAnnotations().SecretProviderClassReload
}
if cfg.Annotations.SecretProviderClassExclude == "" {
cfg.Annotations.SecretProviderClassExclude = DefaultAnnotations().SecretProviderClassExclude
}
// Alerting
cfg.Alerting.Enabled = v.GetBool("alert-on-reload")
cfg.Alerting.WebhookURL = v.GetString("alert-webhook-url")
internal/pkg/config/flags_test.go
+18
View File
@@ -26,6 +26,8 @@ func TestBindFlags(t *testing.T) {
"auto-reload-all",
"reload-strategy",
"is-Argo-Rollouts",
"is-openshift",
"enable-csi-integration",
"reload-on-create",
"reload-on-delete",
"sync-after-restart",
@@ -370,6 +372,22 @@ func TestApplyFlags_LegacyProxyEnvVar(t *testing.T) {
}
}
func TestApplyFlagsCSIIntegration(t *testing.T) {
resetViper()
cfg := NewDefault()
fs := pflag.NewFlagSet("test", pflag.ContinueOnError)
BindFlags(fs, cfg)
if err := fs.Parse([]string{"--enable-csi-integration=true"}); err != nil {
t.Fatal(err)
}
if err := ApplyFlags(cfg); err != nil {
t.Fatal(err)
}
if !cfg.CSIIntegrationEnabled {
t.Fatal("expected CSIIntegrationEnabled=true")
}
}
func TestParseBoolString(t *testing.T) {
tests := []struct {
input string
internal/pkg/controller/manager.go
+30 -2
View File
@@ -15,6 +15,7 @@ import (
"sigs.k8s.io/controller-runtime/pkg/cache"
"sigs.k8s.io/controller-runtime/pkg/healthz"
ctrlmetrics "sigs.k8s.io/controller-runtime/pkg/metrics/server"
csiv1 "sigs.k8s.io/secrets-store-csi-driver/apis/v1"
"github.com/stakater/Reloader/internal/pkg/alerting"
"github.com/stakater/Reloader/internal/pkg/config"
@@ -31,14 +32,17 @@ func init() {
utilruntime.Must(clientgoscheme.AddToScheme(runtimeScheme))
}
// AddOptionalSchemes adds optional workload type schemes if enabled.
func AddOptionalSchemes(argoRolloutsEnabled, deploymentConfigEnabled bool) {
// AddOptionalSchemes adds optional workload/resource type schemes if enabled.
func AddOptionalSchemes(argoRolloutsEnabled, deploymentConfigEnabled, csiEnabled bool) {
if argoRolloutsEnabled {
utilruntime.Must(argorolloutsv1alpha1.AddToScheme(runtimeScheme))
}
if deploymentConfigEnabled {
utilruntime.Must(openshiftv1.AddToScheme(runtimeScheme))
}
if csiEnabled {
utilruntime.Must(csiv1.AddToScheme(runtimeScheme))
}
}
// ManagerOptions contains options for creating a new Manager.
@@ -224,6 +228,30 @@ func SetupReconcilers(mgr ctrl.Manager, cfg *config.Config, log logr.Logger, col
}
}
// Setup SecretProviderClass reconciler (CSI integration)
if cfg.CSIIntegrationEnabled {
spcReconciler := NewSecretProviderClassReconciler(
ResourceReconcilerDeps{
Client: mgr.GetClient(),
Log: log.WithName("secretproviderclass-reconciler"),
Config: cfg,
ReloadService: reloadService,
Registry: registry,
Collectors: collectors,
EventRecorder: eventRecorder,
WebhookClient: webhookClient,
Alerter: alerter,
PauseHandler: pauseHandler,
NamespaceCache: nsCache,
},
mgr.GetAPIReader(),
)
if err := spcReconciler.SetupWithManager(mgr); err != nil {
return fmt.Errorf("setting up secretproviderclass reconciler: %w", err)
}
log.Info("CSI SecretProviderClass reconciler enabled")
}
// Setup Deployment reconciler for pause handling
if err := (&DeploymentReconciler{
Client: mgr.GetClient(),
internal/pkg/controller/manager_test.go
+27
View File
@@ -0,0 +1,27 @@
package controller
import (
"testing"
"k8s.io/apimachinery/pkg/runtime"
"k8s.io/apimachinery/pkg/runtime/schema"
utilruntime "k8s.io/apimachinery/pkg/util/runtime"
clientgoscheme "k8s.io/client-go/kubernetes/scheme"
)
func TestAddOptionalSchemesRegistersCSI(t *testing.T) {
// Reset to a clean scheme for the test.
runtimeScheme = runtime.NewScheme()
utilruntime.Must(clientgoscheme.AddToScheme(runtimeScheme))
AddOptionalSchemes(false, false, true)
gvk := schema.GroupVersionKind{
Group: "secrets-store.csi.x-k8s.io",
Version: "v1",
Kind: "SecretProviderClassPodStatus",
}
if !runtimeScheme.Recognizes(gvk) {
t.Fatal("expected CSI SecretProviderClassPodStatus to be registered in scheme")
}
}
internal/pkg/controller/secretproviderclass_reconciler.go
+169
View File
@@ -0,0 +1,169 @@
package controller
import (
"context"
"time"
"k8s.io/apimachinery/pkg/api/errors"
"k8s.io/apimachinery/pkg/types"
ctrl "sigs.k8s.io/controller-runtime"
"sigs.k8s.io/controller-runtime/pkg/client"
"sigs.k8s.io/controller-runtime/pkg/reconcile"
csiv1 "sigs.k8s.io/secrets-store-csi-driver/apis/v1"
"github.com/stakater/Reloader/internal/pkg/reload"
"github.com/stakater/Reloader/internal/pkg/workload"
)
// SecretProviderClassReconciler watches SecretProviderClassPodStatus objects and
// triggers workload reloads when the secret versions they track change.
//
// It watches SecretProviderClassPodStatus (the per-pod status written by the CSI
// driver) rather than SecretProviderClass directly, because only the pod status
// carries the current object IDs and versions that indicate a secret rotation.
type SecretProviderClassReconciler struct {
ResourceReconcilerDeps
// apiReader is a direct API client (not cached) used to look up the parent
// SecretProviderClass object. In tests this is set to the fake client.
apiReader client.Reader
handler *ReloadHandler
}
// NewSecretProviderClassReconciler creates a new SecretProviderClassReconciler.
func NewSecretProviderClassReconciler(deps ResourceReconcilerDeps, apiReader client.Reader) *SecretProviderClassReconciler {
return &SecretProviderClassReconciler{
ResourceReconcilerDeps: deps,
apiReader: apiReader,
}
}
// Reconcile handles a SecretProviderClassPodStatus event.
func (r *SecretProviderClassReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
startTime := time.Now()
resourceType := string(reload.ResourceTypeSecretProviderClass)
log := r.Log.WithValues("secretproviderclasspodstatus", req.NamespacedName)
r.Collectors.RecordEventReceived("reconcile", resourceType)
spcps := &csiv1.SecretProviderClassPodStatus{}
if err := r.Client.Get(ctx, req.NamespacedName, spcps); err != nil {
if errors.IsNotFound(err) {
r.Collectors.RecordSkipped("not_found")
r.Collectors.RecordReconcile("success", time.Since(startTime))
return ctrl.Result{}, nil
}
log.Error(err, "failed to get SecretProviderClassPodStatus")
r.Collectors.RecordError("get_secretproviderclasspodstatus")
r.Collectors.RecordReconcile("error", time.Since(startTime))
return ctrl.Result{}, err
}
namespace := spcps.GetNamespace()
if r.Config.IsNamespaceIgnored(namespace) {
log.V(1).Info("skipping SecretProviderClassPodStatus in ignored namespace")
r.Collectors.RecordSkipped("ignored_namespace")
r.Collectors.RecordReconcile("success", time.Since(startTime))
return ctrl.Result{}, nil
}
if r.NamespaceCache != nil && r.NamespaceCache.IsEnabled() && !r.NamespaceCache.Contains(namespace) {
log.V(1).Info("skipping SecretProviderClassPodStatus in namespace not matching selector", "namespace", namespace)
r.Collectors.RecordSkipped("namespace_selector")
r.Collectors.RecordReconcile("success", time.Since(startTime))
return ctrl.Result{}, nil
}
spcName, spcAnnotations := r.resolveSPCAnnotations(ctx, spcps)
if spcName == "" {
r.Collectors.RecordSkipped("no_spc_name")
r.Collectors.RecordReconcile("success", time.Since(startTime))
return ctrl.Result{}, nil
}
change := reload.SecretProviderClassChange{
Name: spcName,
Namespace: namespace,
Annotations: spcAnnotations,
Status: spcps.Status,
EventType: reload.EventTypeUpdate,
}
result, err := r.reloadHandler().Process(
ctx, namespace, spcName, reload.ResourceTypeSecretProviderClass,
func(workloads []workload.Workload) []reload.ReloadDecision {
return r.ReloadService.Process(change, workloads)
}, log,
)
if err != nil {
r.Collectors.RecordReconcile("error", time.Since(startTime))
} else {
r.Collectors.RecordReconcile("success", time.Since(startTime))
}
return result, err
}
// resolveSPCAnnotations looks up the SecretProviderClass referenced by the
// given pod status and returns its name and annotations. It never returns an
// error: on any Get failure it logs and returns the SPC name (from the pod
// status) with an empty annotations map, so callers can still process workloads
// that match via their own auto/named annotations. This matches master's
// behaviour in populateAnnotationsFromSecretProviderClass.
func (r *SecretProviderClassReconciler) resolveSPCAnnotations(
ctx context.Context,
spcps *csiv1.SecretProviderClassPodStatus,
) (string, map[string]string) {
spcName := spcps.Status.SecretProviderClassName
spc := &csiv1.SecretProviderClass{}
if err := r.apiReader.Get(ctx, types.NamespacedName{
Name: spcName,
Namespace: spcps.GetNamespace(),
}, spc); err != nil {
if errors.IsNotFound(err) {
r.Log.WithValues("spc", spcName).Info("SecretProviderClass not found; proceeding without its annotations")
} else {
r.Log.V(1).Error(err, "failed to get SecretProviderClass; proceeding without its annotations", "spc", spcName)
}
return spcName, map[string]string{}
}
annotations := spc.GetAnnotations()
if annotations == nil {
annotations = map[string]string{}
}
return spc.Name, annotations
}
func (r *SecretProviderClassReconciler) reloadHandler() *ReloadHandler {
if r.handler == nil {
r.handler = &ReloadHandler{
Client: r.Client,
Lister: workload.NewLister(r.Client, r.Registry, r.Config),
ReloadService: r.ReloadService,
WebhookClient: r.WebhookClient,
Collectors: r.Collectors,
EventRecorder: r.EventRecorder,
Alerter: r.Alerter,
PauseHandler: r.PauseHandler,
}
}
return r.handler
}
// SetupWithManager wires the reconciler to watch SecretProviderClassPodStatus.
func (r *SecretProviderClassReconciler) SetupWithManager(mgr ctrl.Manager) error {
var nsChecker reload.NamespaceChecker
if r.NamespaceCache != nil {
nsChecker = r.NamespaceCache
}
return ctrl.NewControllerManagedBy(mgr).
For(&csiv1.SecretProviderClassPodStatus{}).
WithEventFilter(reload.CombinedPredicates(
reload.NamespaceFilterPredicateWithCache(r.Config, nsChecker),
reload.SecretProviderClassPodStatusPredicates(r.Config, r.ReloadService.Hasher()),
)).
Complete(r)
}
var _ reconcile.Reconciler = &SecretProviderClassReconciler{}
internal/pkg/controller/secretproviderclass_reconciler_test.go
+171
View File
@@ -0,0 +1,171 @@
package controller_test
import (
"context"
"testing"
appsv1 "k8s.io/api/apps/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/types"
"sigs.k8s.io/controller-runtime/pkg/client"
csiv1 "sigs.k8s.io/secrets-store-csi-driver/apis/v1"
"github.com/stakater/Reloader/internal/pkg/config"
"github.com/stakater/Reloader/internal/pkg/controller"
"github.com/stakater/Reloader/internal/pkg/reload"
"github.com/stakater/Reloader/internal/pkg/testutil"
)
// newSecretProviderClassReconcilerWithClient creates a SecretProviderClassReconciler for
// testing and returns both the reconciler and the fake client (for assertions).
func newSecretProviderClassReconcilerWithClient(t *testing.T, cfg *config.Config, objects ...client.Object) (*controller.SecretProviderClassReconciler, client.Client) {
t.Helper()
// Convert client.Object slice to runtime.Object slice for newTestDeps.
// We create the fake client ourselves to hold the reference.
deps := newTestDeps(t, cfg)
for _, obj := range objects {
deps.client = deps.client.WithObjects(obj)
}
cl := deps.client.Build()
reconciler := controller.NewSecretProviderClassReconciler(
controller.ResourceReconcilerDeps{
Client: cl,
Log: deps.log,
Config: deps.cfg,
ReloadService: deps.reloadService,
Registry: deps.registry,
Collectors: deps.collectors,
EventRecorder: deps.eventRecorder,
WebhookClient: deps.webhookClient,
Alerter: deps.alerter,
PauseHandler: reload.NewPauseHandler(cfg),
NamespaceCache: nil,
},
cl, // APIReader = same fake client in tests
)
return reconciler, cl
}
// TestSecretProviderClassReconciler_NotFound ensures that reconciling a
// nonexistent SecretProviderClassPodStatus returns cleanly without error.
func TestSecretProviderClassReconciler_NotFound(t *testing.T) {
cfg := config.NewDefault()
reconciler, _ := newSecretProviderClassReconcilerWithClient(t, cfg)
assertReconcileSuccess(t, reconciler, reconcileRequest("nonexistent", "default"))
}
// TestSecretProviderClassReconciler_MatchingDeployment_AutoAnnotation tests the
// core happy path: a SPCPS update resolves the SPC, creates a change event, and
// the deployment gets the STAKATER_MY_SPC_SECRETPROVIDERCLASS env var.
func TestSecretProviderClassReconciler_MatchingDeployment_AutoAnnotation(t *testing.T) {
cfg := config.NewDefault()
deployment := testutil.NewDeployment("test-deployment", "default", map[string]string{
cfg.Annotations.SecretProviderClassAuto: "true",
})
spc := &csiv1.SecretProviderClass{
ObjectMeta: metav1.ObjectMeta{
Name: "my-spc",
Namespace: "default",
},
}
spcps := &csiv1.SecretProviderClassPodStatus{
ObjectMeta: metav1.ObjectMeta{
Name: "test-pod-spcps",
Namespace: "default",
},
Status: csiv1.SecretProviderClassPodStatusStatus{
SecretProviderClassName: "my-spc",
Objects: []csiv1.SecretProviderClassObject{
{ID: "a", Version: "1"},
},
},
}
reconciler, cl := newSecretProviderClassReconcilerWithClient(t, cfg, deployment, spc, spcps)
assertReconcileSuccess(t, reconciler, reconcileRequest("test-pod-spcps", "default"))
// Verify the deployment was updated with the expected env var.
updated := &appsv1.Deployment{}
if err := cl.Get(context.Background(), types.NamespacedName{Name: "test-deployment", Namespace: "default"}, updated); err != nil {
t.Fatalf("failed to get updated deployment: %v", err)
}
if len(updated.Spec.Template.Spec.Containers) == 0 {
t.Fatal("deployment has no containers")
}
const expectedEnvVar = "STAKATER_MY_SPC_SECRETPROVIDERCLASS"
found := false
for _, env := range updated.Spec.Template.Spec.Containers[0].Env {
if env.Name == expectedEnvVar && env.Value != "" {
found = true
break
}
}
if !found {
t.Errorf("expected env var %q to be set on deployment container; got envs: %v",
expectedEnvVar, updated.Spec.Template.Spec.Containers[0].Env)
}
}
// TestSecretProviderClassReconciler_SPCNotFound ensures that if the SPCPS
// references a SecretProviderClass that does not exist (e.g. it was deleted
// while secrets are still rotating), the reconciler still reloads any workload
// annotated with secretproviderclass auto/named annotations. The SPC object's
// annotations are only needed for ignore-check and search/match; auto and
// named-reload matching is driven by the workload's own annotations alone.
func TestSecretProviderClassReconciler_SPCNotFound(t *testing.T) {
cfg := config.NewDefault()
// A deployment annotated for auto-reload on any SPC change.
deployment := testutil.NewDeployment("test-deployment", "default", map[string]string{
cfg.Annotations.SecretProviderClassAuto: "true",
})
// Only add the SPCPS; the SPC ("missing-spc") is intentionally absent from
// the fake client to simulate deletion.
spcps := &csiv1.SecretProviderClassPodStatus{
ObjectMeta: metav1.ObjectMeta{
Name: "orphaned-spcps",
Namespace: "default",
},
Status: csiv1.SecretProviderClassPodStatusStatus{
SecretProviderClassName: "missing-spc",
Objects: []csiv1.SecretProviderClassObject{
{ID: "b", Version: "2"},
},
},
}
reconciler, cl := newSecretProviderClassReconcilerWithClient(t, cfg, deployment, spcps)
// Reconcile must succeed with no error and no requeue.
assertReconcileSuccess(t, reconciler, reconcileRequest("orphaned-spcps", "default"))
// The deployment must have been reloaded: container[0].Env must contain
// STAKATER_MISSING_SPC_SECRETPROVIDERCLASS with a non-empty SHA value.
updated := &appsv1.Deployment{}
if err := cl.Get(context.Background(), types.NamespacedName{Name: "test-deployment", Namespace: "default"}, updated); err != nil {
t.Fatalf("failed to get updated deployment: %v", err)
}
if len(updated.Spec.Template.Spec.Containers) == 0 {
t.Fatal("deployment has no containers")
}
const expectedEnvVar = "STAKATER_MISSING_SPC_SECRETPROVIDERCLASS"
found := false
for _, env := range updated.Spec.Template.Spec.Containers[0].Env {
if env.Name == expectedEnvVar && env.Value != "" {
found = true
break
}
}
if !found {
t.Errorf("expected env var %q to be set on deployment container after SPC-not-found reconcile; got envs: %v",
expectedEnvVar, updated.Spec.Template.Spec.Containers[0].Env)
}
}
internal/pkg/csi/detect.go
+36
View File
@@ -0,0 +1,36 @@
// Package csi provides detection of the secrets-store CSI driver CRDs.
package csi
import (
"github.com/go-logr/logr"
"k8s.io/client-go/discovery"
)
const (
// CSIAPIGroup is the API group for the secrets-store CSI driver.
CSIAPIGroup = "secrets-store.csi.x-k8s.io"
// CSIAPIVersion is the API version used by Reloader.
CSIAPIVersion = "v1"
// CSIPodStatusResource is the watched resource.
CSIPodStatusResource = "secretproviderclasspodstatuses"
)
// HasCSISupport reports whether the cluster has the secrets-store CSI driver
// CRDs installed (specifically the SecretProviderClassPodStatus resource).
func HasCSISupport(client discovery.DiscoveryInterface, log logr.Logger) bool {
resources, err := client.ServerResourcesForGroupVersion(CSIAPIGroup + "/" + CSIAPIVersion)
if err != nil {
log.V(1).Info("CSI API not available", "error", err)
return false
}
for _, r := range resources.APIResources {
if r.Name == CSIPodStatusResource {
log.Info("CSI provider detected, enabling SecretProviderClass support")
return true
}
}
log.V(1).Info("CSI resource not found in " + CSIAPIGroup + "/" + CSIAPIVersion)
return false
}
internal/pkg/csi/detect_test.go
+38
View File
@@ -0,0 +1,38 @@
package csi
import (
"testing"
"github.com/go-logr/logr"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
fake "k8s.io/client-go/discovery/fake"
clienttesting "k8s.io/client-go/testing"
)
func newFakeDiscovery(resources []*metav1.APIResourceList) *fake.FakeDiscovery {
return &fake.FakeDiscovery{
Fake: &clienttesting.Fake{Resources: resources},
}
}
func TestHasCSISupportTrue(t *testing.T) {
d := newFakeDiscovery([]*metav1.APIResourceList{
{
GroupVersion: "secrets-store.csi.x-k8s.io/v1",
APIResources: []metav1.APIResource{
{Name: "secretproviderclasspodstatuses"},
{Name: "secretproviderclasses"},
},
},
})
if !HasCSISupport(d, logr.Discard()) {
t.Fatal("expected CSI support detected")
}
}
func TestHasCSISupportFalse(t *testing.T) {
d := newFakeDiscovery(nil)
if HasCSISupport(d, logr.Discard()) {
t.Fatal("expected CSI support not detected")
}
}
internal/pkg/reload/change.go
+26
View File
@@ -2,6 +2,7 @@ package reload
import (
corev1 "k8s.io/api/core/v1"
csiv1 "sigs.k8s.io/secrets-store-csi-driver/apis/v1"
)
// EventType represents the type of change event.
@@ -54,3 +55,28 @@ func (c SecretChange) GetNamespace() string { return c.Secret.Names
func (c SecretChange) GetAnnotations() map[string]string { return c.Secret.Annotations }
func (c SecretChange) GetResourceType() ResourceType { return ResourceTypeSecret }
func (c SecretChange) ComputeHash(h *Hasher) string { return h.HashSecret(c.Secret) }
// SecretProviderClassChange represents a change event derived from a
// SecretProviderClassPodStatus update. Name/Annotations refer to the resolved
// SecretProviderClass; Status carries the SPCPS status used for hashing.
type SecretProviderClassChange struct {
Name string
Namespace string
Annotations map[string]string
Status csiv1.SecretProviderClassPodStatusStatus
EventType EventType
}
func (c SecretProviderClassChange) IsNil() bool { return c.Name == "" }
func (c SecretProviderClassChange) GetEventType() EventType { return c.EventType }
func (c SecretProviderClassChange) GetName() string { return c.Name }
func (c SecretProviderClassChange) GetNamespace() string { return c.Namespace }
func (c SecretProviderClassChange) GetAnnotations() map[string]string {
return c.Annotations
}
func (c SecretProviderClassChange) GetResourceType() ResourceType {
return ResourceTypeSecretProviderClass
}
func (c SecretProviderClassChange) ComputeHash(h *Hasher) string {
return h.HashSecretProviderClass(c.Status)
}
internal/pkg/reload/change_test.go
+51
View File
@@ -0,0 +1,51 @@
package reload
import (
"testing"
csiv1 "sigs.k8s.io/secrets-store-csi-driver/apis/v1"
)
func TestSecretProviderClassChange(t *testing.T) {
status := csiv1.SecretProviderClassPodStatusStatus{
SecretProviderClassName: "my-spc",
Objects: []csiv1.SecretProviderClassObject{{ID: "a", Version: "1"}},
}
c := SecretProviderClassChange{
Name: "my-spc",
Namespace: "ns1",
Annotations: map[string]string{"k": "v"},
Status: status,
EventType: EventTypeUpdate,
}
if c.IsNil() {
t.Fatal("IsNil() = true, want false")
}
if c.GetName() != "my-spc" {
t.Fatalf("GetName() = %q", c.GetName())
}
if c.GetNamespace() != "ns1" {
t.Fatalf("GetNamespace() = %q", c.GetNamespace())
}
if c.GetResourceType() != ResourceTypeSecretProviderClass {
t.Fatalf("GetResourceType() = %q", c.GetResourceType())
}
if c.GetEventType() != EventTypeUpdate {
t.Fatalf("GetEventType() = %q", c.GetEventType())
}
if c.GetAnnotations()["k"] != "v" {
t.Fatalf("GetAnnotations() missing key")
}
h := NewHasher()
if c.ComputeHash(h) != h.HashSecretProviderClass(status) {
t.Fatalf("ComputeHash mismatch")
}
}
func TestSecretProviderClassChangeIsNil(t *testing.T) {
c := SecretProviderClassChange{Name: ""}
if !c.IsNil() {
t.Fatal("IsNil() = false, want true for empty name")
}
}
internal/pkg/reload/csi_dep_check_test.go
+24
View File
@@ -0,0 +1,24 @@
package reload
import (
"testing"
csiv1 "sigs.k8s.io/secrets-store-csi-driver/apis/v1"
)
// TestCSIDependencyAvailable ensures the CSI types are importable and the
// fields this feature depends on exist.
func TestCSIDependencyAvailable(t *testing.T) {
status := csiv1.SecretProviderClassPodStatusStatus{
SecretProviderClassName: "spc",
Objects: []csiv1.SecretProviderClassObject{
{ID: "secret/data/foo", Version: "1"},
},
}
if status.SecretProviderClassName != "spc" {
t.Fatalf("unexpected SecretProviderClassName")
}
if len(status.Objects) != 1 || status.Objects[0].ID != "secret/data/foo" {
t.Fatalf("unexpected Objects")
}
}
internal/pkg/reload/hasher.go
+14
View File
@@ -10,6 +10,7 @@ import (
"strings"
corev1 "k8s.io/api/core/v1"
csiv1 "sigs.k8s.io/secrets-store-csi-driver/apis/v1"
)
// Hasher computes content hashes for ConfigMaps and Secrets.
@@ -68,6 +69,19 @@ func (h *Hasher) computeSHA(data string) string {
return fmt.Sprintf("%x", hasher.Sum(nil))
}
// HashSecretProviderClass computes a SHA1 hash of a SecretProviderClassPodStatus
// status: the sorted set of object ID=Version entries plus the SPC name.
// This mirrors master's util.GetSHAfromSecretProviderClassPodStatus exactly.
func (h *Hasher) HashSecretProviderClass(status csiv1.SecretProviderClassPodStatusStatus) string {
values := make([]string, 0, len(status.Objects)+1)
for _, obj := range status.Objects {
values = append(values, obj.ID+"="+obj.Version)
}
values = append(values, "SecretProviderClassName="+status.SecretProviderClassName)
sort.Strings(values)
return h.computeSHA(strings.Join(values, ";"))
}
// EmptyHash returns an empty string to signal resource deletion.
func (h *Hasher) EmptyHash() string {
return ""
internal/pkg/reload/hasher_test.go
+43
View File
@@ -4,6 +4,7 @@ import (
"testing"
corev1 "k8s.io/api/core/v1"
csiv1 "sigs.k8s.io/secrets-store-csi-driver/apis/v1"
)
func TestHasher_HashConfigMap(t *testing.T) {
@@ -234,3 +235,45 @@ func TestHasher_NilInput(t *testing.T) {
t.Error("nil Secret should return a valid hash")
}
}
func TestHashSecretProviderClass(t *testing.T) {
h := NewHasher()
status := csiv1.SecretProviderClassPodStatusStatus{
SecretProviderClassName: "my-spc",
Objects: []csiv1.SecretProviderClassObject{
{ID: "secret/data/b", Version: "2"},
{ID: "secret/data/a", Version: "1"},
},
}
// Expected = SHA1 hex of the sorted, ';'-joined string, matching master.
expectedInput := "SecretProviderClassName=my-spc;secret/data/a=1;secret/data/b=2"
expected := h.computeSHA(expectedInput)
got := h.HashSecretProviderClass(status)
if got != expected {
t.Fatalf("HashSecretProviderClass = %q, want %q", got, expected)
}
// Order independence: shuffling objects must not change the hash.
statusReordered := csiv1.SecretProviderClassPodStatusStatus{
SecretProviderClassName: "my-spc",
Objects: []csiv1.SecretProviderClassObject{
{ID: "secret/data/a", Version: "1"},
{ID: "secret/data/b", Version: "2"},
},
}
if h.HashSecretProviderClass(statusReordered) != got {
t.Fatalf("hash not order-independent")
}
}
func TestHashSecretProviderClassEmpty(t *testing.T) {
h := NewHasher()
status := csiv1.SecretProviderClassPodStatusStatus{SecretProviderClassName: "empty"}
got := h.HashSecretProviderClass(status)
want := h.computeSHA("SecretProviderClassName=empty")
if got != want {
t.Fatalf("HashSecretProviderClass(empty) = %q, want %q", got, want)
}
}
internal/pkg/reload/matcher.go
+6
View File
@@ -144,6 +144,8 @@ func (m *Matcher) isResourceExcluded(resourceName string, resourceType ResourceT
excludeAnn = m.cfg.Annotations.ConfigmapExclude
case ResourceTypeSecret:
excludeAnn = m.cfg.Annotations.SecretExclude
case ResourceTypeSecretProviderClass:
excludeAnn = m.cfg.Annotations.SecretProviderClassExclude
}
excludeList, ok := annotations[excludeAnn]
@@ -242,6 +244,8 @@ func (m *Matcher) getExplicitAnnotation(resourceType ResourceType) string {
return m.cfg.Annotations.ConfigmapReload
case ResourceTypeSecret:
return m.cfg.Annotations.SecretReload
case ResourceTypeSecretProviderClass:
return m.cfg.Annotations.SecretProviderClassReload
default:
return ""
}
@@ -253,6 +257,8 @@ func (m *Matcher) getTypedAutoAnnotation(resourceType ResourceType) string {
return m.cfg.Annotations.ConfigmapAuto
case ResourceTypeSecret:
return m.cfg.Annotations.SecretAuto
case ResourceTypeSecretProviderClass:
return m.cfg.Annotations.SecretProviderClassAuto
default:
return ""
}
internal/pkg/reload/matcher_test.go
+46
View File
@@ -404,6 +404,52 @@ func TestMatcher_AutoDoesNotIgnoreExplicit(t *testing.T) {
t.Log("✓ Explicit reload annotation works even when auto is enabled")
}
func TestMatcherSecretProviderClassExplicit(t *testing.T) {
cfg := config.NewDefault()
m := NewMatcher(cfg)
res := m.ShouldReload(MatchInput{
ResourceName: "my-spc",
ResourceType: ResourceTypeSecretProviderClass,
WorkloadAnnotations: map[string]string{
"secretproviderclass.reloader.stakater.com/reload": "my-spc",
},
})
if !res.ShouldReload || res.AutoReload {
t.Fatalf("explicit SPC reload: got %+v", res)
}
}
func TestMatcherSecretProviderClassAuto(t *testing.T) {
cfg := config.NewDefault()
m := NewMatcher(cfg)
res := m.ShouldReload(MatchInput{
ResourceName: "my-spc",
ResourceType: ResourceTypeSecretProviderClass,
WorkloadAnnotations: map[string]string{
"secretproviderclass.reloader.stakater.com/auto": "true",
},
})
if !res.ShouldReload || !res.AutoReload {
t.Fatalf("auto SPC reload: got %+v", res)
}
}
func TestMatcherSecretProviderClassExcluded(t *testing.T) {
cfg := config.NewDefault()
m := NewMatcher(cfg)
res := m.ShouldReload(MatchInput{
ResourceName: "my-spc",
ResourceType: ResourceTypeSecretProviderClass,
WorkloadAnnotations: map[string]string{
"secretproviderclass.reloader.stakater.com/auto": "true",
"secretproviderclasses.exclude.reloader.stakater.com/reload": "my-spc",
},
})
if res.ShouldReload {
t.Fatalf("excluded SPC should not reload: got %+v", res)
}
}
// TestMatcher_PrecedenceOrder verifies the correct order of precedence:
// 1. Ignore annotation → skip
// 2. Exclude annotation → skip
internal/pkg/reload/predicate.go
+20
View File
@@ -5,6 +5,7 @@ import (
"sigs.k8s.io/controller-runtime/pkg/client"
"sigs.k8s.io/controller-runtime/pkg/event"
"sigs.k8s.io/controller-runtime/pkg/predicate"
csiv1 "sigs.k8s.io/secrets-store-csi-driver/apis/v1"
"github.com/stakater/Reloader/internal/pkg/config"
)
@@ -157,3 +158,22 @@ func IgnoreAnnotationPredicate(cfg *config.Config) predicate.Predicate {
func CombinedPredicates(predicates ...predicate.Predicate) predicate.Predicate {
return predicate.And(predicates...)
}
// SecretProviderClassPodStatusPredicates filters SecretProviderClassPodStatus events.
// Create and Delete are ignored (matching master); Update passes only when the
// hashed status (object IDs/versions + SPC name) changes.
func SecretProviderClassPodStatusPredicates(cfg *config.Config, hasher *Hasher) predicate.Predicate {
return predicate.Funcs{
CreateFunc: func(e event.CreateEvent) bool { return false },
DeleteFunc: func(e event.DeleteEvent) bool { return false },
GenericFunc: func(e event.GenericEvent) bool { return false },
UpdateFunc: func(e event.UpdateEvent) bool {
oldObj, okOld := e.ObjectOld.(*csiv1.SecretProviderClassPodStatus)
newObj, okNew := e.ObjectNew.(*csiv1.SecretProviderClassPodStatus)
if !okOld || !okNew {
return false
}
return hasher.HashSecretProviderClass(oldObj.Status) != hasher.HashSecretProviderClass(newObj.Status)
},
}
}
internal/pkg/reload/predicate_test.go
+35
View File
@@ -7,6 +7,7 @@ import (
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/labels"
"sigs.k8s.io/controller-runtime/pkg/event"
csiv1 "sigs.k8s.io/secrets-store-csi-driver/apis/v1"
"github.com/stakater/Reloader/internal/pkg/config"
)
@@ -934,3 +935,37 @@ func TestLabelsSet(t *testing.T) {
t.Errorf("Get(nonexistent) = %v, want empty string", ls.Get("nonexistent"))
}
}
func TestSecretProviderClassPodStatusPredicates(t *testing.T) {
cfg := config.NewDefault()
p := SecretProviderClassPodStatusPredicates(cfg, NewHasher())
oldObj := &csiv1.SecretProviderClassPodStatus{
Status: csiv1.SecretProviderClassPodStatusStatus{
SecretProviderClassName: "spc",
Objects: []csiv1.SecretProviderClassObject{{ID: "a", Version: "1"}},
},
}
newObjChanged := &csiv1.SecretProviderClassPodStatus{
Status: csiv1.SecretProviderClassPodStatusStatus{
SecretProviderClassName: "spc",
Objects: []csiv1.SecretProviderClassObject{{ID: "a", Version: "2"}},
},
}
newObjSame := oldObj.DeepCopy()
// Create and Delete are always ignored for SPCPS.
if p.Create(event.CreateEvent{Object: oldObj}) {
t.Fatal("CreateFunc should return false")
}
if p.Delete(event.DeleteEvent{Object: oldObj}) {
t.Fatal("DeleteFunc should return false")
}
// Update only when the status hash changes.
if !p.Update(event.UpdateEvent{ObjectOld: oldObj, ObjectNew: newObjChanged}) {
t.Fatal("UpdateFunc should return true on changed status")
}
if p.Update(event.UpdateEvent{ObjectOld: oldObj, ObjectNew: newObjSame}) {
t.Fatal("UpdateFunc should return false on unchanged status")
}
}
internal/pkg/reload/resource_type.go
+4
View File
@@ -8,6 +8,8 @@ const (
ResourceTypeConfigMap ResourceType = "configmap"
// ResourceTypeSecret represents a Secret resource.
ResourceTypeSecret ResourceType = "secret"
// ResourceTypeSecretProviderClass represents a CSI SecretProviderClass resource.
ResourceTypeSecretProviderClass ResourceType = "secretproviderclass"
)
// Kind returns the capitalized Kubernetes Kind (e.g., "ConfigMap", "Secret").
@@ -17,6 +19,8 @@ func (r ResourceType) Kind() string {
return "ConfigMap"
case ResourceTypeSecret:
return "Secret"
case ResourceTypeSecretProviderClass:
return "SecretProviderClass"
default:
return string(r)
}
internal/pkg/reload/resource_type_test.go
+9
View File
@@ -26,3 +26,12 @@ func TestResourceType_Kind(t *testing.T) {
)
}
}
func TestResourceTypeSecretProviderClassKind(t *testing.T) {
if got := ResourceTypeSecretProviderClass.Kind(); got != "SecretProviderClass" {
t.Fatalf("Kind() = %q, want SecretProviderClass", got)
}
if string(ResourceTypeSecretProviderClass) != "secretproviderclass" {
t.Fatalf("value = %q, want secretproviderclass", ResourceTypeSecretProviderClass)
}
}
internal/pkg/reload/service.go
+4
View File
@@ -83,6 +83,10 @@ func (s *Service) processResource(
usesResource = wl.UsesConfigMap(resourceName)
case ResourceTypeSecret:
usesResource = wl.UsesSecret(resourceName)
case ResourceTypeSecretProviderClass:
// Annotation-only matching (parity with master): the workload's
// annotations alone decide the reload; no volume-uses scan.
usesResource = true
}
input := MatchInput{
internal/pkg/reload/service_test.go
+26
View File
@@ -7,6 +7,7 @@ import (
"github.com/go-logr/logr/testr"
corev1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
csiv1 "sigs.k8s.io/secrets-store-csi-driver/apis/v1"
"github.com/stakater/Reloader/internal/pkg/config"
"github.com/stakater/Reloader/internal/pkg/testutil"
@@ -1332,6 +1333,31 @@ func TestService_ProcessNilChange(t *testing.T) {
}
}
func TestServiceProcessSecretProviderClassAuto(t *testing.T) {
cfg := config.NewDefault()
svc := NewService(cfg, testr.New(t))
deploy := testutil.NewDeployment("test-deploy", "default", map[string]string{
"secretproviderclass.reloader.stakater.com/auto": "true",
})
workloads := []workload.Workload{workload.NewDeploymentWorkload(deploy)}
change := SecretProviderClassChange{
Name: "my-spc",
Namespace: "default",
Status: csiv1.SecretProviderClassPodStatusStatus{
SecretProviderClassName: "my-spc",
Objects: []csiv1.SecretProviderClassObject{{ID: "a", Version: "1"}},
},
EventType: EventTypeUpdate,
}
decisions := svc.Process(change, workloads)
if len(decisions) != 1 || !decisions[0].ShouldReload {
t.Fatalf("expected auto SPC reload, got %+v", decisions)
}
}
func TestService_ProcessCreateEventDisabled(t *testing.T) {
cfg := config.NewDefault()
cfg.ReloadOnCreate = false
internal/pkg/reload/strategy.go
+4
View File
@@ -19,6 +19,8 @@ const (
ConfigmapEnvVarPostfix = "CONFIGMAP"
// SecretEnvVarPostfix is the postfix for Secret environment variables.
SecretEnvVarPostfix = "SECRET"
// SecretProviderClassEnvVarPostfix is the postfix for SecretProviderClass environment variables.
SecretProviderClassEnvVarPostfix = "SECRETPROVIDERCLASS"
)
// Strategy defines how workload restarts are triggered.
@@ -108,6 +110,8 @@ func (s *EnvVarStrategy) envVarName(resourceName string, resourceType ResourceTy
postfix = ConfigmapEnvVarPostfix
case ResourceTypeSecret:
postfix = SecretEnvVarPostfix
case ResourceTypeSecretProviderClass:
postfix = SecretProviderClassEnvVarPostfix
}
return EnvVarPrefix + convertToEnvVarName(resourceName) + "_" + postfix
}
internal/pkg/reload/strategy_test.go
+9
View File
@@ -291,3 +291,12 @@ func TestNewStrategy(t *testing.T) {
}
})
}
func TestEnvVarNameSecretProviderClass(t *testing.T) {
s := NewEnvVarStrategy()
got := s.envVarName("my-vault-spc", ResourceTypeSecretProviderClass)
want := "STAKATER_MY_VAULT_SPC_SECRETPROVIDERCLASS"
if got != want {
t.Fatalf("envVarName = %q, want %q", got, want)
}
}
internal/pkg/testutil/fixtures.go
+2
View File
@@ -7,6 +7,7 @@ import (
corev1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/runtime"
csiv1 "sigs.k8s.io/secrets-store-csi-driver/apis/v1"
)
// NewDeploymentConfig creates a minimal DeploymentConfig for unit testing.
@@ -72,6 +73,7 @@ func NewScheme() *runtime.Scheme {
_ = appsv1.AddToScheme(scheme)
_ = batchv1.AddToScheme(scheme)
_ = openshiftv1.AddToScheme(scheme)
_ = csiv1.AddToScheme(scheme)
return scheme
}