VAULT-36773 Fixed and add deprecation messages

Author: vijayavelsekar

config/manifests/bases/vault-secrets-operator.clusterserviceversion.yaml

@@ -83,18 +83,22 @@ spec:
   apiservicedefinitions: {}
   customresourcedefinitions:
     owned:
-    - description: "HCPAuth is the Schema for the hcpauths API \n Deprecated: HCPAuth
-        and HCP Vault Secrets support are deprecated and will be removed in a future
-        release of the Vault Secrets Operator. Migrate off HCP Vault Secrets before
-        upgrading to the removal release."
+    - description: |-
+        HCPAuth is the Schema for the hcpauths API
+
+        Deprecated: HCPAuth and HCP Vault Secrets support are deprecated and will be
+        removed in a future release of the Vault Secrets Operator. Migrate off HCP
+        Vault Secrets before upgrading to the removal release.
       displayName: HCPAuth
       kind: HCPAuth
       name: hcpauths.secrets.hashicorp.com
       version: v1beta1
-    - description: "HCPVaultSecretsApp is the Schema for the hcpvaultsecretsapps API
-        \n Deprecated: HCPVaultSecretsApp and HCP Vault Secrets support are deprecated
+    - description: |-
+        HCPVaultSecretsApp is the Schema for the hcpvaultsecretsapps API
+
+        Deprecated: HCPVaultSecretsApp and HCP Vault Secrets support are deprecated
         and will be removed in a future release of the Vault Secrets Operator. Migrate
-        off HCP Vault Secrets before upgrading to the removal release."
+        off HCP Vault Secrets before upgrading to the removal release.
       displayName: HCPVault Secrets App
       kind: HCPVaultSecretsApp
       name: hcpvaultsecretsapps.secrets.hashicorp.com

controllers/hcpauth_controller.go

@@ -69,12 +69,10 @@ func (r *HCPAuthReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ct
 	logger.Info("HCPAuth is deprecated and will be removed in a future release of " +
 		"the Vault Secrets Operator; migrate off HCP Vault Secrets before upgrading " +
 		"to the removal release")
-	if r.Recorder != nil {
-		r.Recorder.Event(o, corev1.EventTypeWarning, consts.ReasonDeprecated,
-			"HCPAuth is deprecated and will be removed in a future release of the "+
-				"Vault Secrets Operator; migrate off HCP Vault Secrets before upgrading "+
-				"to the removal release")
-	}
+	r.Recorder.Event(o, corev1.EventTypeWarning, consts.ReasonDeprecated,
+		"HCPAuth is deprecated and will be removed in a future release of the "+
+			"Vault Secrets Operator; migrate off HCP Vault Secrets before upgrading "+
+			"to the removal release")
 
 	// perform a rudimentary health check on the HCP host on port 443.
 	conn, err := net.DialTimeout("tcp",

helpers/rollout_restart.go

@@ -25,7 +25,8 @@ import (
 const AnnotationRestartedAt = "vso.secrets.hashicorp.com/restartedAt"
 
 // HandleRolloutRestarts for all v1beta1.RolloutRestartTarget(s) configured for obj.
-// Supported objs are: v1beta1.VaultDynamicSecret, v1beta1.VaultStaticSecret, v1beta1.VaultPKISecret
+// Supported objs are: v1beta1.VaultDynamicSecret, v1beta1.VaultStaticSecret,
+// v1beta1.VaultPKISecret, v1beta1.HCPVaultSecretsApp (deprecated)
 // Please note the following:
 // - a rollout-restart will be triggered for each configured v1beta1.RolloutRestartTarget
 // - the rollout-restart action has no support for roll-back

helpers/secrets.go

@@ -30,7 +30,13 @@ import (
 )
 
 const (
-	SecretDataKeyRaw      = "_raw"
+	SecretDataKeyRaw = "_raw"
+
+	// HVSSecretTypeKV, HVSSecretTypeRotating, and HVSSecretTypeDynamic are the
+	// HVS secret type identifiers.
+	//
+	// Deprecated: HCP Vault Secrets support is deprecated and will be removed in
+	// a future release of the Vault Secrets Operator.
 	HVSSecretTypeKV       = "kv"
 	HVSSecretTypeRotating = "rotating"
 	HVSSecretTypeDynamic  = "dynamic"
@@ -535,6 +541,9 @@ func marshalJSON(value any) ([]byte, error) {
 
 // WithHVSAppSecrets returns the K8s Secret data from HCP Vault Secrets App. This
 // method must always return a non-nil data map to avoid HMAC calculation issues.
+//
+// Deprecated: HCP Vault Secrets support is deprecated and will be removed in a
+// future release of the Vault Secrets Operator.
 func (s *SecretDataBuilder) WithHVSAppSecrets(resp *hvsclient.OpenAppSecretsOK, opt *SecretTransformationOption) (map[string][]byte, error) {
 	if opt == nil {
 		opt = &SecretTransformationOption{}
@@ -711,6 +720,9 @@ func NewSecretsDataBuilder() *SecretDataBuilder {
 
 // MakeHVSShadowSecretData converts a list of HVS OpenSecrets to k8s secret
 // data. Only dynamic secrets are included.
+//
+// Deprecated: HCP Vault Secrets support is deprecated and will be removed in a
+// future release of the Vault Secrets Operator.
 func MakeHVSShadowSecretData(secrets []*models.Secrets20231128OpenSecret) (map[string][]byte, error) {
 	data := make(map[string][]byte)
 	for _, v := range secrets {
@@ -728,6 +740,9 @@ func MakeHVSShadowSecretData(secrets []*models.Secrets20231128OpenSecret) (map[s
 }
 
 // FromHVSShadowSecret converts a k8s secret data entry to an HVS OpenSecret.
+//
+// Deprecated: HCP Vault Secrets support is deprecated and will be removed in a
+// future release of the Vault Secrets Operator.
 func FromHVSShadowSecret(data []byte) (*models.Secrets20231128OpenSecret, error) {
 	secret := &models.Secrets20231128OpenSecret{}
 	if err := secret.UnmarshalBinary(data); err != nil {