|
|
@ -2,6 +2,7 @@ package secretsencrypt
|
|
|
|
|
|
|
|
|
|
|
|
import (
|
|
|
|
import (
|
|
|
|
"context"
|
|
|
|
"context"
|
|
|
|
|
|
|
|
"errors"
|
|
|
|
"fmt"
|
|
|
|
"fmt"
|
|
|
|
"strings"
|
|
|
|
"strings"
|
|
|
|
|
|
|
|
|
|
|
@ -12,7 +13,6 @@ import (
|
|
|
|
"github.com/sirupsen/logrus"
|
|
|
|
"github.com/sirupsen/logrus"
|
|
|
|
corev1 "k8s.io/api/core/v1"
|
|
|
|
corev1 "k8s.io/api/core/v1"
|
|
|
|
apierrors "k8s.io/apimachinery/pkg/api/errors"
|
|
|
|
apierrors "k8s.io/apimachinery/pkg/api/errors"
|
|
|
|
"k8s.io/apimachinery/pkg/api/meta"
|
|
|
|
|
|
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
|
|
"k8s.io/apimachinery/pkg/labels"
|
|
|
|
"k8s.io/apimachinery/pkg/labels"
|
|
|
|
"k8s.io/apimachinery/pkg/runtime"
|
|
|
|
"k8s.io/apimachinery/pkg/runtime"
|
|
|
@ -30,6 +30,8 @@ const (
|
|
|
|
secretsProgressEvent string = "SecretsProgress"
|
|
|
|
secretsProgressEvent string = "SecretsProgress"
|
|
|
|
secretsUpdateCompleteEvent string = "SecretsUpdateComplete"
|
|
|
|
secretsUpdateCompleteEvent string = "SecretsUpdateComplete"
|
|
|
|
secretsUpdateErrorEvent string = "SecretsUpdateError"
|
|
|
|
secretsUpdateErrorEvent string = "SecretsUpdateError"
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
secretListPageSize = 20
|
|
|
|
)
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
|
|
type handler struct {
|
|
|
|
type handler struct {
|
|
|
@ -116,7 +118,7 @@ func (h *handler) onChangeNode(nodeName string, node *corev1.Node) (*corev1.Node
|
|
|
|
return node, err
|
|
|
|
return node, err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
if err := h.updateSecrets(node); err != nil {
|
|
|
|
if err := h.updateSecrets(nodeRef); err != nil {
|
|
|
|
h.recorder.Event(nodeRef, corev1.EventTypeWarning, secretsUpdateErrorEvent, err.Error())
|
|
|
|
h.recorder.Event(nodeRef, corev1.EventTypeWarning, secretsUpdateErrorEvent, err.Error())
|
|
|
|
return node, err
|
|
|
|
return node, err
|
|
|
|
}
|
|
|
|
}
|
|
|
@ -213,23 +215,18 @@ func (h *handler) validateReencryptStage(node *corev1.Node, annotation string) (
|
|
|
|
return true, nil
|
|
|
|
return true, nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
func (h *handler) updateSecrets(node *corev1.Node) error {
|
|
|
|
func (h *handler) updateSecrets(nodeRef *corev1.ObjectReference) error {
|
|
|
|
nodeRef := &corev1.ObjectReference{
|
|
|
|
|
|
|
|
Kind: "Node",
|
|
|
|
|
|
|
|
Name: node.Name,
|
|
|
|
|
|
|
|
UID: types.UID(node.Name),
|
|
|
|
|
|
|
|
Namespace: "",
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
secretPager := pager.New(pager.SimplePageFunc(func(opts metav1.ListOptions) (runtime.Object, error) {
|
|
|
|
secretPager := pager.New(pager.SimplePageFunc(func(opts metav1.ListOptions) (runtime.Object, error) {
|
|
|
|
return h.secrets.List("", opts)
|
|
|
|
return h.secrets.List(metav1.NamespaceAll, opts)
|
|
|
|
}))
|
|
|
|
}))
|
|
|
|
secretsList, _, err := secretPager.List(h.ctx, metav1.ListOptions{})
|
|
|
|
secretPager.PageSize = secretListPageSize
|
|
|
|
if err != nil {
|
|
|
|
|
|
|
|
return err
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
i := 0
|
|
|
|
i := 0
|
|
|
|
err = meta.EachListItem(secretsList, func(obj runtime.Object) error {
|
|
|
|
if err := secretPager.EachListItem(h.ctx, metav1.ListOptions{}, func(obj runtime.Object) error {
|
|
|
|
if secret, ok := obj.(*corev1.Secret); ok {
|
|
|
|
secret, ok := obj.(*corev1.Secret)
|
|
|
|
|
|
|
|
if !ok {
|
|
|
|
|
|
|
|
return errors.New("failed to convert object to Secret")
|
|
|
|
|
|
|
|
}
|
|
|
|
if _, err := h.secrets.Update(secret); err != nil && !apierrors.IsConflict(err) {
|
|
|
|
if _, err := h.secrets.Update(secret); err != nil && !apierrors.IsConflict(err) {
|
|
|
|
return fmt.Errorf("failed to update secret: %v", err)
|
|
|
|
return fmt.Errorf("failed to update secret: %v", err)
|
|
|
|
}
|
|
|
|
}
|
|
|
@ -237,12 +234,11 @@ func (h *handler) updateSecrets(node *corev1.Node) error {
|
|
|
|
h.recorder.Eventf(nodeRef, corev1.EventTypeNormal, secretsProgressEvent, "reencrypted %d secrets", i)
|
|
|
|
h.recorder.Eventf(nodeRef, corev1.EventTypeNormal, secretsProgressEvent, "reencrypted %d secrets", i)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
i++
|
|
|
|
i++
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
return nil
|
|
|
|
})
|
|
|
|
}); err != nil {
|
|
|
|
if err != nil {
|
|
|
|
|
|
|
|
return err
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
h.recorder.Eventf(nodeRef, corev1.EventTypeNormal, secretsUpdateCompleteEvent, "completed reencrypt of %d secrets", i)
|
|
|
|
h.recorder.Eventf(nodeRef, corev1.EventTypeNormal, secretsUpdateCompleteEvent, "completed reencrypt of %d secrets", i)
|
|
|
|
return nil
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|