allow empty object digest generation for annotations

Author: eg-ayoub

charts/fluent-bit.yaml

@@ -6,7 +6,7 @@ existingConfigMap: fluent-bit
 
 podAnnotations:
   checksum/config: '__slot__:salt:metalk8s_kubernetes.get_object_digest(kind="ConfigMap", apiVersion="v1", namespace="metalk8s-logging", name="fluent-bit", path="data:fluent-bit.conf")'
-  checksum/secret: '__slot__:salt:metalk8s_kubernetes.get_object_digest(kind="Secret", apiVersion="v1", namespace="metalk8s-logging", name="fluent-bit-certs")'
+  checksum/secret: '__slot__:salt:metalk8s_kubernetes.get_object_digest(kind="Secret", apiVersion="v1", namespace="metalk8s-logging", name="fluent-bit-certs", path="data", allow_empty=True)'
 
 resources: '__var__(fluent_bit.spec.deployment.resources)'
 

salt/_modules/metalk8s_kubernetes.py

@@ -410,7 +410,7 @@ def list_objects(
     return result.to_dict()["items"]
 
 
-def get_object_digest(path=None, checksum="sha256", *args, **kwargs):
+def get_object_digest(allow_empty=False, path=None, checksum="sha256", *args, **kwargs):
     """
     Helper to get the digest of one kubernetes object or from a specific key
     of this object using a path
@@ -432,7 +432,11 @@ def get_object_digest(path=None, checksum="sha256", *args, **kwargs):
         obj = salt.utils.data.traverse_dict_and_list(obj, path, delimiter=":")
 
         if not obj:
-            raise CommandExecutionError(f'Unable to find key "{path}" in the object')
+            if not allow_empty:
+                raise CommandExecutionError(
+                    f'Unable to find key "{path}" in the object'
+                )
+            return ""
 
     if isinstance(obj, dict):
         obj = json.dumps(obj, sort_keys=True)

salt/metalk8s/addons/logging/fluent-bit/deployed/chart.sls

@@ -1697,7 +1697,8 @@ spec:
         checksum/config: __slot__:salt:metalk8s_kubernetes.get_object_digest(kind="ConfigMap",
           apiVersion="v1", namespace="metalk8s-logging", name="fluent-bit", path="data:fluent-bit.conf")
         checksum/secret: __slot__:salt:metalk8s_kubernetes.get_object_digest(kind="Secret",
-          apiVersion="v1", namespace="metalk8s-logging", name="fluent-bit-certs")
+          apiVersion="v1", namespace="metalk8s-logging", name="fluent-bit-certs",
+          path="data", allow_empty=True)
       labels:
         app.kubernetes.io/instance: fluent-bit
         app.kubernetes.io/name: fluent-bit

salt/metalk8s/addons/logging/fluent-bit/deployed/secret.sls

@@ -19,6 +19,7 @@ Create metalk8s-fluent-bit-certs Secret:
         metadata:
           name: fluent-bit-certs
           namespace: metalk8s-logging
+        data: {}
 
 {%- else %}
 

salt/tests/unit/modules/files/test_metalk8s_kubernetes.yaml

@@ -702,6 +702,17 @@ get_object_digest:
     raises: True
     result: 'Unable to find key "metadata:invalid:path" in the object'
 
+  # allow_empty = true and path points to an empty dict
+  - obj:
+      apiVersion: v1
+      kind: Secret
+      metadata:
+        name: my_secret
+      data: {}
+    path: 'data'
+    allow_empty: True
+    result: ''
+
 check_object_ready:
   # Simple Pod Ready
   - obj: