Skip to content

Commit 1e7f1e8

Browse files
mabulgumabulgu
committed
handle secret by using the secret manager
Signed-off-by: mabulgu <mabulgu@gmail.com>
1 parent e75d091 commit 1e7f1e8

3 files changed

Lines changed: 47 additions & 29 deletions

File tree

‎internal/controller/metal3.io/baremetalhost_controller.go‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2250,7 +2250,7 @@ func (r *BareMetalHostReconciler) getBMCSecretAndSetOwner(ctx context.Context, r
22502250
// getImageAuthSecret validates and extracts the OCI registry credentials for the image.
22512251
// It returns the base64-encoded credentials in the format expected by Ironic, or an empty
22522252
// string if no auth secret is configured.
2253-
func (r *BareMetalHostReconciler) getImageAuthSecret(ctx context.Context, _ ctrl.Request, host *metal3api.BareMetalHost, image *metal3api.Image) (string, error) {
2253+
func (r *BareMetalHostReconciler) getImageAuthSecret(ctx context.Context, request ctrl.Request, host *metal3api.BareMetalHost, image *metal3api.Image) (string, error) {
22542254
// Only process OCI images
22552255
if image == nil || !strings.HasPrefix(image.URL, "oci://") {
22562256
return "", nil
@@ -2261,9 +2261,13 @@ func (r *BareMetalHostReconciler) getImageAuthSecret(ctx context.Context, _ ctrl
22612261
return "", nil
22622262
}
22632263

2264+
// Use SecretManager following the BMC credentials pattern
2265+
reqLogger := r.Log.WithValues("baremetalhost", request.NamespacedName)
2266+
secretManager := r.secretManager(ctx, reqLogger)
2267+
22642268
// Validate and extract credentials
2265-
validator := secretutils.NewValidator(r.Client, r.Recorder)
2266-
result, err := validator.Validate(ctx, host)
2269+
validator := secretutils.NewValidator(r.Recorder)
2270+
result, err := validator.Validate(ctx, host, secretManager)
22672271
if err != nil {
22682272
return "", fmt.Errorf("failed to validate auth secret: %w", err)
22692273
}

‎pkg/secretutils/validator.go‎

Lines changed: 9 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@ import (
99
k8serrors "k8s.io/apimachinery/pkg/api/errors"
1010
"k8s.io/apimachinery/pkg/types"
1111
"k8s.io/client-go/tools/record"
12-
"sigs.k8s.io/controller-runtime/pkg/client"
1312
)
1413

1514
const (
@@ -28,19 +27,18 @@ type Result struct {
2827
}
2928

3029
type Validator interface {
31-
Validate(ctx context.Context, bmh *metal3api.BareMetalHost) (*Result, error)
30+
Validate(ctx context.Context, bmh *metal3api.BareMetalHost, secretMgr SecretManager) (*Result, error)
3231
}
3332

3433
type validator struct {
35-
c client.Client
3634
recorder record.EventRecorder
3735
}
3836

39-
func NewValidator(c client.Client, recorder record.EventRecorder) Validator {
40-
return &validator{c: c, recorder: recorder}
37+
func NewValidator(recorder record.EventRecorder) Validator {
38+
return &validator{recorder: recorder}
4139
}
4240

43-
func (v *validator) Validate(ctx context.Context, bmh *metal3api.BareMetalHost) (*Result, error) {
41+
func (v *validator) Validate(_ context.Context, bmh *metal3api.BareMetalHost, secretMgr SecretManager) (*Result, error) {
4442
res := &Result{Valid: false}
4543

4644
img := bmh.Spec.Image
@@ -62,9 +60,10 @@ func (v *validator) Validate(ctx context.Context, bmh *metal3api.BareMetalHost)
6260
"authSecretName=%q is set but image URL is not oci:// (%s)", secretName, img.URL)
6361
}
6462

65-
var sec corev1.Secret
63+
// Use SecretManager to obtain and label the secret (following BMC credentials pattern)
6664
key := types.NamespacedName{Namespace: bmh.Namespace, Name: secretName}
67-
if err := v.c.Get(ctx, key, &sec); err != nil {
65+
sec, err := secretMgr.ObtainSecret(key)
66+
if err != nil {
6867
if k8serrors.IsNotFound(err) {
6968
return res, nil
7069
}
@@ -81,7 +80,7 @@ func (v *validator) Validate(ctx context.Context, bmh *metal3api.BareMetalHost)
8180

8281
// For OCI images, extract the credentials from the Docker config
8382
if ociRelevant {
84-
credentials, err := ExtractRegistryCredentials(&sec, img.URL)
83+
credentials, err := ExtractRegistryCredentials(sec, img.URL)
8584
if err != nil {
8685
if v.recorder != nil {
8786
v.recorder.Eventf(bmh, corev1.EventTypeWarning, "ImageAuthParseError",
@@ -92,7 +91,7 @@ func (v *validator) Validate(ctx context.Context, bmh *metal3api.BareMetalHost)
9291
res.Credentials = credentials
9392
}
9493

95-
res.Secret = &sec
94+
res.Secret = sec
9695
res.Valid = true
9796
return res, nil
9897
}

‎pkg/secretutils/validator_test.go‎

Lines changed: 31 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ import (
55
"encoding/json"
66
"testing"
77

8+
"github.com/go-logr/logr"
89
metal3api "github.com/metal3-io/baremetal-operator/apis/metal3.io/v1alpha1"
910
corev1 "k8s.io/api/core/v1"
1011
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -21,7 +22,8 @@ func TestValidate_NoAuthSecret(t *testing.T) {
2122

2223
c := fake.NewClientBuilder().WithScheme(scheme).Build()
2324
recorder := record.NewFakeRecorder(10)
24-
validator := NewValidator(c, recorder)
25+
secretManager := NewSecretManager(t.Context(), testLogger(t), c, c)
26+
validator := NewValidator(recorder)
2527

2628
bmh := &metal3api.BareMetalHost{
2729
ObjectMeta: metav1.ObjectMeta{
@@ -36,7 +38,7 @@ func TestValidate_NoAuthSecret(t *testing.T) {
3638
},
3739
}
3840

39-
result, err := validator.Validate(t.Context(), bmh)
41+
result, err := validator.Validate(t.Context(), bmh, secretManager)
4042
if err != nil {
4143
t.Fatalf("unexpected error: %v", err)
4244
}
@@ -56,7 +58,8 @@ func TestValidate_SecretNotFound(t *testing.T) {
5658

5759
c := fake.NewClientBuilder().WithScheme(scheme).Build()
5860
recorder := record.NewFakeRecorder(10)
59-
validator := NewValidator(c, recorder)
61+
secretManager := NewSecretManager(t.Context(), testLogger(t), c, c)
62+
validator := NewValidator(recorder)
6063

6164
secretName := "my-secret"
6265
bmh := &metal3api.BareMetalHost{
@@ -72,7 +75,7 @@ func TestValidate_SecretNotFound(t *testing.T) {
7275
},
7376
}
7477

75-
result, err := validator.Validate(t.Context(), bmh)
78+
result, err := validator.Validate(t.Context(), bmh, secretManager)
7679
if err != nil {
7780
t.Fatalf("unexpected error: %v", err)
7881
}
@@ -105,7 +108,8 @@ func TestValidate_WrongSecretType(t *testing.T) {
105108

106109
c := fake.NewClientBuilder().WithScheme(scheme).WithObjects(secret).Build()
107110
recorder := record.NewFakeRecorder(10)
108-
validator := NewValidator(c, recorder)
111+
secretManager := NewSecretManager(t.Context(), testLogger(t), c, c)
112+
validator := NewValidator(recorder)
109113

110114
bmh := &metal3api.BareMetalHost{
111115
ObjectMeta: metav1.ObjectMeta{
@@ -120,7 +124,7 @@ func TestValidate_WrongSecretType(t *testing.T) {
120124
},
121125
}
122126

123-
result, err := validator.Validate(t.Context(), bmh)
127+
result, err := validator.Validate(t.Context(), bmh, secretManager)
124128
if err != nil {
125129
t.Fatalf("unexpected error: %v", err)
126130
}
@@ -177,7 +181,8 @@ func TestValidate_ValidDockerConfigJSON(t *testing.T) {
177181

178182
c := fake.NewClientBuilder().WithScheme(scheme).WithObjects(secret).Build()
179183
recorder := record.NewFakeRecorder(10)
180-
validator := NewValidator(c, recorder)
184+
secretManager := NewSecretManager(t.Context(), testLogger(t), c, c)
185+
validator := NewValidator(recorder)
181186

182187
bmh := &metal3api.BareMetalHost{
183188
ObjectMeta: metav1.ObjectMeta{
@@ -192,7 +197,7 @@ func TestValidate_ValidDockerConfigJSON(t *testing.T) {
192197
},
193198
}
194199

195-
result, err := validator.Validate(t.Context(), bmh)
200+
result, err := validator.Validate(t.Context(), bmh, secretManager)
196201
if err != nil {
197202
t.Fatalf("unexpected error: %v", err)
198203
}
@@ -257,7 +262,8 @@ func TestValidate_RegistryNotInSecret(t *testing.T) {
257262

258263
c := fake.NewClientBuilder().WithScheme(scheme).WithObjects(secret).Build()
259264
recorder := record.NewFakeRecorder(10)
260-
validator := NewValidator(c, recorder)
265+
secretManager := NewSecretManager(t.Context(), testLogger(t), c, c)
266+
validator := NewValidator(recorder)
261267

262268
bmh := &metal3api.BareMetalHost{
263269
ObjectMeta: metav1.ObjectMeta{
@@ -272,7 +278,7 @@ func TestValidate_RegistryNotInSecret(t *testing.T) {
272278
},
273279
}
274280

275-
result, err := validator.Validate(t.Context(), bmh)
281+
result, err := validator.Validate(t.Context(), bmh, secretManager)
276282
if err != nil {
277283
t.Fatalf("unexpected error: %v", err)
278284
}
@@ -337,7 +343,8 @@ func TestValidate_NonOCIImageWithSecret(t *testing.T) {
337343

338344
c := fake.NewClientBuilder().WithScheme(scheme).WithObjects(secret).Build()
339345
recorder := record.NewFakeRecorder(10)
340-
validator := NewValidator(c, recorder)
346+
secretManager := NewSecretManager(t.Context(), testLogger(t), c, c)
347+
validator := NewValidator(recorder)
341348

342349
bmh := &metal3api.BareMetalHost{
343350
ObjectMeta: metav1.ObjectMeta{
@@ -352,7 +359,7 @@ func TestValidate_NonOCIImageWithSecret(t *testing.T) {
352359
},
353360
}
354361

355-
result, err := validator.Validate(t.Context(), bmh)
362+
result, err := validator.Validate(t.Context(), bmh, secretManager)
356363
if err != nil {
357364
t.Fatalf("unexpected error: %v", err)
358365
}
@@ -382,7 +389,8 @@ func TestValidate_NilImage(t *testing.T) {
382389

383390
c := fake.NewClientBuilder().WithScheme(scheme).Build()
384391
recorder := record.NewFakeRecorder(10)
385-
validator := NewValidator(c, recorder)
392+
secretManager := NewSecretManager(t.Context(), testLogger(t), c, c)
393+
validator := NewValidator(recorder)
386394

387395
bmh := &metal3api.BareMetalHost{
388396
ObjectMeta: metav1.ObjectMeta{
@@ -394,7 +402,7 @@ func TestValidate_NilImage(t *testing.T) {
394402
},
395403
}
396404

397-
result, err := validator.Validate(t.Context(), bmh)
405+
result, err := validator.Validate(t.Context(), bmh, secretManager)
398406
if err != nil {
399407
t.Fatalf("unexpected error: %v", err)
400408
}
@@ -512,9 +520,10 @@ func TestIntegration_ValidateAndExtractCredentials(t *testing.T) {
512520
)
513521

514522
recorder := record.NewFakeRecorder(10)
515-
validator := NewValidator(c, recorder)
523+
secretManager := NewSecretManager(t.Context(), testLogger(t), c, c)
524+
validator := NewValidator(recorder)
516525

517-
result, err := validator.Validate(t.Context(), bmh)
526+
result, err := validator.Validate(t.Context(), bmh, secretManager)
518527
if err != nil {
519528
t.Fatalf("unexpected error: %v", err)
520529
}
@@ -537,3 +546,9 @@ func TestIntegration_ValidateAndExtractCredentials(t *testing.T) {
537546
t.Errorf("expected decoded credentials to be 'myuser:mypassword', got '%s'", string(decoded))
538547
}
539548
}
549+
550+
// Helper function to create a test logger.
551+
func testLogger(t *testing.T) logr.Logger {
552+
t.Helper()
553+
return logr.Discard()
554+
}

0 commit comments

Comments
 (0)