wip: port csi provider to v2 sa-8436

internal/pkg/controller/manager.go

@@ -15,6 +15,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/cache"
 	"sigs.k8s.io/controller-runtime/pkg/healthz"
 	ctrlmetrics "sigs.k8s.io/controller-runtime/pkg/metrics/server"
+	csiv1 "sigs.k8s.io/secrets-store-csi-driver/apis/v1"
 
 	"github.com/stakater/Reloader/internal/pkg/alerting"
 	"github.com/stakater/Reloader/internal/pkg/config"
@@ -31,14 +32,17 @@ func init() {
 	utilruntime.Must(clientgoscheme.AddToScheme(runtimeScheme))
 }
 
-// AddOptionalSchemes adds optional workload type schemes if enabled.
-func AddOptionalSchemes(argoRolloutsEnabled, deploymentConfigEnabled bool) {
+// AddOptionalSchemes adds optional workload/resource type schemes if enabled.
+func AddOptionalSchemes(argoRolloutsEnabled, deploymentConfigEnabled, csiEnabled bool) {
 	if argoRolloutsEnabled {
 		utilruntime.Must(argorolloutsv1alpha1.AddToScheme(runtimeScheme))
 	}
 	if deploymentConfigEnabled {
 		utilruntime.Must(openshiftv1.AddToScheme(runtimeScheme))
 	}
+	if csiEnabled {
+		utilruntime.Must(csiv1.AddToScheme(runtimeScheme))
+	}
 }
 
 // ManagerOptions contains options for creating a new Manager.
@@ -224,6 +228,30 @@ func SetupReconcilers(mgr ctrl.Manager, cfg *config.Config, log logr.Logger, col
 		}
 	}
 
+	// Setup SecretProviderClass reconciler (CSI integration)
+	if cfg.CSIIntegrationEnabled {
+		spcReconciler := NewSecretProviderClassReconciler(
+			ResourceReconcilerDeps{
+				Client:         mgr.GetClient(),
+				Log:            log.WithName("secretproviderclass-reconciler"),
+				Config:         cfg,
+				ReloadService:  reloadService,
+				Registry:       registry,
+				Collectors:     collectors,
+				EventRecorder:  eventRecorder,
+				WebhookClient:  webhookClient,
+				Alerter:        alerter,
+				PauseHandler:   pauseHandler,
+				NamespaceCache: nsCache,
+			},
+			mgr.GetAPIReader(),
+		)
+		if err := spcReconciler.SetupWithManager(mgr); err != nil {
+			return fmt.Errorf("setting up secretproviderclass reconciler: %w", err)
+		}
+		log.Info("CSI SecretProviderClass reconciler enabled")
+	}
+
 	// Setup Deployment reconciler for pause handling
 	if err := (&DeploymentReconciler{
 		Client:       mgr.GetClient(),

internal/pkg/controller/manager_test.go

@@ -0,0 +1,27 @@
+package controller
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
+)
+
+func TestAddOptionalSchemesRegistersCSI(t *testing.T) {
+	// Reset to a clean scheme for the test.
+	runtimeScheme = runtime.NewScheme()
+	utilruntime.Must(clientgoscheme.AddToScheme(runtimeScheme))
+
+	AddOptionalSchemes(false, false, true)
+
+	gvk := schema.GroupVersionKind{
+		Group:   "secrets-store.csi.x-k8s.io",
+		Version: "v1",
+		Kind:    "SecretProviderClassPodStatus",
+	}
+	if !runtimeScheme.Recognizes(gvk) {
+		t.Fatal("expected CSI SecretProviderClassPodStatus to be registered in scheme")
+	}
+}

internal/pkg/controller/secretproviderclass_reconciler.go

@@ -0,0 +1,169 @@
+package controller
+
+import (
+	"context"
+	"time"
+
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/types"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+	csiv1 "sigs.k8s.io/secrets-store-csi-driver/apis/v1"
+
+	"github.com/stakater/Reloader/internal/pkg/reload"
+	"github.com/stakater/Reloader/internal/pkg/workload"
+)
+
+// SecretProviderClassReconciler watches SecretProviderClassPodStatus objects and
+// triggers workload reloads when the secret versions they track change.
+//
+// It watches SecretProviderClassPodStatus (the per-pod status written by the CSI
+// driver) rather than SecretProviderClass directly, because only the pod status
+// carries the current object IDs and versions that indicate a secret rotation.
+type SecretProviderClassReconciler struct {
+	ResourceReconcilerDeps
+
+	// apiReader is a direct API client (not cached) used to look up the parent
+	// SecretProviderClass object. In tests this is set to the fake client.
+	apiReader client.Reader
+
+	handler *ReloadHandler
+}
+
+// NewSecretProviderClassReconciler creates a new SecretProviderClassReconciler.
+func NewSecretProviderClassReconciler(deps ResourceReconcilerDeps, apiReader client.Reader) *SecretProviderClassReconciler {
+	return &SecretProviderClassReconciler{
+		ResourceReconcilerDeps: deps,
+		apiReader:              apiReader,
+	}
+}
+
+// Reconcile handles a SecretProviderClassPodStatus event.
+func (r *SecretProviderClassReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
+	startTime := time.Now()
+	resourceType := string(reload.ResourceTypeSecretProviderClass)
+	log := r.Log.WithValues("secretproviderclasspodstatus", req.NamespacedName)
+
+	r.Collectors.RecordEventReceived("reconcile", resourceType)
+
+	spcps := &csiv1.SecretProviderClassPodStatus{}
+	if err := r.Client.Get(ctx, req.NamespacedName, spcps); err != nil {
+		if errors.IsNotFound(err) {
+			r.Collectors.RecordSkipped("not_found")
+			r.Collectors.RecordReconcile("success", time.Since(startTime))
+			return ctrl.Result{}, nil
+		}
+		log.Error(err, "failed to get SecretProviderClassPodStatus")
+		r.Collectors.RecordError("get_secretproviderclasspodstatus")
+		r.Collectors.RecordReconcile("error", time.Since(startTime))
+		return ctrl.Result{}, err
+	}
+
+	namespace := spcps.GetNamespace()
+	if r.Config.IsNamespaceIgnored(namespace) {
+		log.V(1).Info("skipping SecretProviderClassPodStatus in ignored namespace")
+		r.Collectors.RecordSkipped("ignored_namespace")
+		r.Collectors.RecordReconcile("success", time.Since(startTime))
+		return ctrl.Result{}, nil
+	}
+
+	if r.NamespaceCache != nil && r.NamespaceCache.IsEnabled() && !r.NamespaceCache.Contains(namespace) {
+		log.V(1).Info("skipping SecretProviderClassPodStatus in namespace not matching selector", "namespace", namespace)
+		r.Collectors.RecordSkipped("namespace_selector")
+		r.Collectors.RecordReconcile("success", time.Since(startTime))
+		return ctrl.Result{}, nil
+	}
+
+	spcName, spcAnnotations := r.resolveSPCAnnotations(ctx, spcps)
+	if spcName == "" {
+		r.Collectors.RecordSkipped("no_spc_name")
+		r.Collectors.RecordReconcile("success", time.Since(startTime))
+		return ctrl.Result{}, nil
+	}
+
+	change := reload.SecretProviderClassChange{
+		Name:        spcName,
+		Namespace:   namespace,
+		Annotations: spcAnnotations,
+		Status:      spcps.Status,
+		EventType:   reload.EventTypeUpdate,
+	}
+
+	result, err := r.reloadHandler().Process(
+		ctx, namespace, spcName, reload.ResourceTypeSecretProviderClass,
+		func(workloads []workload.Workload) []reload.ReloadDecision {
+			return r.ReloadService.Process(change, workloads)
+		}, log,
+	)
+
+	if err != nil {
+		r.Collectors.RecordReconcile("error", time.Since(startTime))
+	} else {
+		r.Collectors.RecordReconcile("success", time.Since(startTime))
+	}
+	return result, err
+}
+
+// resolveSPCAnnotations looks up the SecretProviderClass referenced by the
+// given pod status and returns its name and annotations. It never returns an
+// error: on any Get failure it logs and returns the SPC name (from the pod
+// status) with an empty annotations map, so callers can still process workloads
+// that match via their own auto/named annotations. This matches master's
+// behaviour in populateAnnotationsFromSecretProviderClass.
+func (r *SecretProviderClassReconciler) resolveSPCAnnotations(
+	ctx context.Context,
+	spcps *csiv1.SecretProviderClassPodStatus,
+) (string, map[string]string) {
+	spcName := spcps.Status.SecretProviderClassName
+	spc := &csiv1.SecretProviderClass{}
+	if err := r.apiReader.Get(ctx, types.NamespacedName{
+		Name:      spcName,
+		Namespace: spcps.GetNamespace(),
+	}, spc); err != nil {
+		if errors.IsNotFound(err) {
+			r.Log.WithValues("spc", spcName).Info("SecretProviderClass not found; proceeding without its annotations")
+		} else {
+			r.Log.V(1).Error(err, "failed to get SecretProviderClass; proceeding without its annotations", "spc", spcName)
+		}
+		return spcName, map[string]string{}
+	}
+	annotations := spc.GetAnnotations()
+	if annotations == nil {
+		annotations = map[string]string{}
+	}
+	return spc.Name, annotations
+}
+
+func (r *SecretProviderClassReconciler) reloadHandler() *ReloadHandler {
+	if r.handler == nil {
+		r.handler = &ReloadHandler{
+			Client:        r.Client,
+			Lister:        workload.NewLister(r.Client, r.Registry, r.Config),
+			ReloadService: r.ReloadService,
+			WebhookClient: r.WebhookClient,
+			Collectors:    r.Collectors,
+			EventRecorder: r.EventRecorder,
+			Alerter:       r.Alerter,
+			PauseHandler:  r.PauseHandler,
+		}
+	}
+	return r.handler
+}
+
+// SetupWithManager wires the reconciler to watch SecretProviderClassPodStatus.
+func (r *SecretProviderClassReconciler) SetupWithManager(mgr ctrl.Manager) error {
+	var nsChecker reload.NamespaceChecker
+	if r.NamespaceCache != nil {
+		nsChecker = r.NamespaceCache
+	}
+	return ctrl.NewControllerManagedBy(mgr).
+		For(&csiv1.SecretProviderClassPodStatus{}).
+		WithEventFilter(reload.CombinedPredicates(
+			reload.NamespaceFilterPredicateWithCache(r.Config, nsChecker),
+			reload.SecretProviderClassPodStatusPredicates(r.Config, r.ReloadService.Hasher()),
+		)).
+		Complete(r)
+}
+
+var _ reconcile.Reconciler = &SecretProviderClassReconciler{}

internal/pkg/controller/secretproviderclass_reconciler_test.go

@@ -0,0 +1,171 @@
+package controller_test
+
+import (
+	"context"
+	"testing"
+
+	appsv1 "k8s.io/api/apps/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	csiv1 "sigs.k8s.io/secrets-store-csi-driver/apis/v1"
+
+	"github.com/stakater/Reloader/internal/pkg/config"
+	"github.com/stakater/Reloader/internal/pkg/controller"
+	"github.com/stakater/Reloader/internal/pkg/reload"
+	"github.com/stakater/Reloader/internal/pkg/testutil"
+)
+
+// newSecretProviderClassReconcilerWithClient creates a SecretProviderClassReconciler for
+// testing and returns both the reconciler and the fake client (for assertions).
+func newSecretProviderClassReconcilerWithClient(t *testing.T, cfg *config.Config, objects ...client.Object) (*controller.SecretProviderClassReconciler, client.Client) {
+	t.Helper()
+	// Convert client.Object slice to runtime.Object slice for newTestDeps.
+	// We create the fake client ourselves to hold the reference.
+	deps := newTestDeps(t, cfg)
+	for _, obj := range objects {
+		deps.client = deps.client.WithObjects(obj)
+	}
+	cl := deps.client.Build()
+	reconciler := controller.NewSecretProviderClassReconciler(
+		controller.ResourceReconcilerDeps{
+			Client:         cl,
+			Log:            deps.log,
+			Config:         deps.cfg,
+			ReloadService:  deps.reloadService,
+			Registry:       deps.registry,
+			Collectors:     deps.collectors,
+			EventRecorder:  deps.eventRecorder,
+			WebhookClient:  deps.webhookClient,
+			Alerter:        deps.alerter,
+			PauseHandler:   reload.NewPauseHandler(cfg),
+			NamespaceCache: nil,
+		},
+		cl, // APIReader = same fake client in tests
+	)
+	return reconciler, cl
+}
+
+// TestSecretProviderClassReconciler_NotFound ensures that reconciling a
+// nonexistent SecretProviderClassPodStatus returns cleanly without error.
+func TestSecretProviderClassReconciler_NotFound(t *testing.T) {
+	cfg := config.NewDefault()
+	reconciler, _ := newSecretProviderClassReconcilerWithClient(t, cfg)
+	assertReconcileSuccess(t, reconciler, reconcileRequest("nonexistent", "default"))
+}
+
+// TestSecretProviderClassReconciler_MatchingDeployment_AutoAnnotation tests the
+// core happy path: a SPCPS update resolves the SPC, creates a change event, and
+// the deployment gets the STAKATER_MY_SPC_SECRETPROVIDERCLASS env var.
+func TestSecretProviderClassReconciler_MatchingDeployment_AutoAnnotation(t *testing.T) {
+	cfg := config.NewDefault()
+
+	deployment := testutil.NewDeployment("test-deployment", "default", map[string]string{
+		cfg.Annotations.SecretProviderClassAuto: "true",
+	})
+
+	spc := &csiv1.SecretProviderClass{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "my-spc",
+			Namespace: "default",
+		},
+	}
+
+	spcps := &csiv1.SecretProviderClassPodStatus{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-pod-spcps",
+			Namespace: "default",
+		},
+		Status: csiv1.SecretProviderClassPodStatusStatus{
+			SecretProviderClassName: "my-spc",
+			Objects: []csiv1.SecretProviderClassObject{
+				{ID: "a", Version: "1"},
+			},
+		},
+	}
+
+	reconciler, cl := newSecretProviderClassReconcilerWithClient(t, cfg, deployment, spc, spcps)
+	assertReconcileSuccess(t, reconciler, reconcileRequest("test-pod-spcps", "default"))
+
+	// Verify the deployment was updated with the expected env var.
+	updated := &appsv1.Deployment{}
+	if err := cl.Get(context.Background(), types.NamespacedName{Name: "test-deployment", Namespace: "default"}, updated); err != nil {
+		t.Fatalf("failed to get updated deployment: %v", err)
+	}
+
+	if len(updated.Spec.Template.Spec.Containers) == 0 {
+		t.Fatal("deployment has no containers")
+	}
+
+	const expectedEnvVar = "STAKATER_MY_SPC_SECRETPROVIDERCLASS"
+	found := false
+	for _, env := range updated.Spec.Template.Spec.Containers[0].Env {
+		if env.Name == expectedEnvVar && env.Value != "" {
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Errorf("expected env var %q to be set on deployment container; got envs: %v",
+			expectedEnvVar, updated.Spec.Template.Spec.Containers[0].Env)
+	}
+}
+
+// TestSecretProviderClassReconciler_SPCNotFound ensures that if the SPCPS
+// references a SecretProviderClass that does not exist (e.g. it was deleted
+// while secrets are still rotating), the reconciler still reloads any workload
+// annotated with secretproviderclass auto/named annotations. The SPC object's
+// annotations are only needed for ignore-check and search/match; auto and
+// named-reload matching is driven by the workload's own annotations alone.
+func TestSecretProviderClassReconciler_SPCNotFound(t *testing.T) {
+	cfg := config.NewDefault()
+
+	// A deployment annotated for auto-reload on any SPC change.
+	deployment := testutil.NewDeployment("test-deployment", "default", map[string]string{
+		cfg.Annotations.SecretProviderClassAuto: "true",
+	})
+
+	// Only add the SPCPS; the SPC ("missing-spc") is intentionally absent from
+	// the fake client to simulate deletion.
+	spcps := &csiv1.SecretProviderClassPodStatus{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "orphaned-spcps",
+			Namespace: "default",
+		},
+		Status: csiv1.SecretProviderClassPodStatusStatus{
+			SecretProviderClassName: "missing-spc",
+			Objects: []csiv1.SecretProviderClassObject{
+				{ID: "b", Version: "2"},
+			},
+		},
+	}
+
+	reconciler, cl := newSecretProviderClassReconcilerWithClient(t, cfg, deployment, spcps)
+
+	// Reconcile must succeed with no error and no requeue.
+	assertReconcileSuccess(t, reconciler, reconcileRequest("orphaned-spcps", "default"))
+
+	// The deployment must have been reloaded: container[0].Env must contain
+	// STAKATER_MISSING_SPC_SECRETPROVIDERCLASS with a non-empty SHA value.
+	updated := &appsv1.Deployment{}
+	if err := cl.Get(context.Background(), types.NamespacedName{Name: "test-deployment", Namespace: "default"}, updated); err != nil {
+		t.Fatalf("failed to get updated deployment: %v", err)
+	}
+
+	if len(updated.Spec.Template.Spec.Containers) == 0 {
+		t.Fatal("deployment has no containers")
+	}
+
+	const expectedEnvVar = "STAKATER_MISSING_SPC_SECRETPROVIDERCLASS"
+	found := false
+	for _, env := range updated.Spec.Template.Spec.Containers[0].Env {
+		if env.Name == expectedEnvVar && env.Value != "" {
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Errorf("expected env var %q to be set on deployment container after SPC-not-found reconcile; got envs: %v",
+			expectedEnvVar, updated.Spec.Template.Spec.Containers[0].Env)
+	}
+}