Add managed-by label for Authorino to API key secrets (#23)

API key Secrets created by the key-manager include the
label `authorino.kuadrant.io/managed-by=authorino`. This makes new
secrets immediately discoverable by Authorino without requiring
a hot-reload.

Signed-off-by: Brent Salisbury <bsalisbu@redhat.com>

Author: nerdalert

deployment/kuadrant-openshift/key-manager/04-token-rate-limit-policy.yaml

@@ -8,7 +8,6 @@ metadata:
   name: gateway-default-unlimited
   namespace: llm
   labels:
-    maas/managed-by: "key-manager"
     maas/resource-type: "default-rate-limit"
   annotations:
     maas/description: "Default unlimited rate policy - teams can override with specific limits"

deployment/kuadrant-openshift/key-manager/internal/auth/middleware.go

@@ -56,4 +56,4 @@ func getEnvOrDefault(key, defaultValue string) string {
 		return value
 	}
 	return defaultValue
-}
+}

deployment/kuadrant-openshift/key-manager/internal/config/config.go

@@ -50,4 +50,4 @@ func getEnvOrDefault(key, defaultValue string) string {
 		return value
 	}
 	return defaultValue
-}
+}

deployment/kuadrant-openshift/key-manager/internal/handlers/health.go

@@ -17,4 +17,4 @@ func NewHealthHandler() *HealthHandler {
 // HealthCheck handles GET /health
 func (h *HealthHandler) HealthCheck(c *gin.Context) {
 	c.JSON(http.StatusOK, gin.H{"status": "healthy"})
-}
+}

deployment/kuadrant-openshift/key-manager/internal/handlers/keys.go

@@ -131,4 +131,4 @@ func (h *KeysHandler) ListUserKeys(c *gin.Context) {
 		"keys":       keys,
 		"total_keys": len(keys),
 	})
-}
+}

deployment/kuadrant-openshift/key-manager/internal/handlers/legacy.go

@@ -79,4 +79,4 @@ func (h *LegacyHandler) DeleteKey(c *gin.Context) {
 		"message":     "API key deleted successfully",
 		"secret_name": secretName,
 	})
-}
+}

deployment/kuadrant-openshift/key-manager/internal/handlers/models.go

@@ -35,4 +35,4 @@ func (h *ModelsHandler) ListModels(c *gin.Context) {
 	}
 
 	c.JSON(http.StatusOK, response)
-}
+}

deployment/kuadrant-openshift/key-manager/internal/handlers/teams.go

@@ -143,4 +143,4 @@ func (h *TeamsHandler) DeleteTeam(c *gin.Context) {
 
 	log.Printf("Team deleted successfully: %s", teamID)
 	c.JSON(http.StatusOK, gin.H{"message": "Team deleted successfully", "team_id": teamID})
-}
+}

deployment/kuadrant-openshift/key-manager/internal/handlers/usage.go

@@ -26,7 +26,7 @@ type UsageHandler struct {
 // NewUsageHandler creates a new usage handler
 func NewUsageHandler(clientset *kubernetes.Clientset, config *rest.Config, keyNamespace string) *UsageHandler {
 	collector := usage.NewCollector(clientset, config, keyNamespace)
-	
+
 	return &UsageHandler{
 		clientset:    clientset,
 		config:       config,
@@ -108,11 +108,11 @@ func (h *UsageHandler) enrichUserUsage(userUsage *types.UserUsage) error {
 	}
 
 	// Create policy -> team mapping
-	policyToTeam := make(map[string]struct{
+	policyToTeam := make(map[string]struct {
 		teamID   string
 		teamName string
 	})
-	
+
 	for _, secret := range secrets.Items {
 		policy := secret.Annotations["maas/policy"]
 		if policy != "" {
@@ -141,9 +141,9 @@ func (h *UsageHandler) enrichUserUsage(userUsage *types.UserUsage) error {
 func (h *UsageHandler) enrichTeamUsage(teamUsage *types.TeamUsage) error {
 	for i, userUsage := range teamUsage.UserBreakdown {
 		// Find user's API key secret to get email
-		labelSelector := fmt.Sprintf("kuadrant.io/apikeys-by=rhcl-keys,maas/team-id=%s,maas/user-id=%s", 
+		labelSelector := fmt.Sprintf("kuadrant.io/apikeys-by=rhcl-keys,maas/team-id=%s,maas/user-id=%s",
 			teamUsage.TeamID, userUsage.UserID)
-		
+
 		secrets, err := h.clientset.CoreV1().Secrets(h.keyNamespace).List(
 			context.Background(), metav1.ListOptions{LabelSelector: labelSelector})
 		if err != nil {
@@ -160,4 +160,4 @@ func (h *UsageHandler) enrichTeamUsage(teamUsage *types.TeamUsage) error {
 	}
 
 	return nil
-}
+}

deployment/kuadrant-openshift/key-manager/internal/keys/generator.go

@@ -34,4 +34,4 @@ func isValidUserID(userID string) bool {
 // ValidateUserID validates a user ID using Kubernetes naming rules
 func ValidateUserID(userID string) bool {
 	return isValidUserID(userID)
-}
+}