Support reading database ServerConfig credentials from k8s secrets (#440

)
otterize · Jun 23, 2024 · 27d9ebb · 27d9ebb
1 parent ef0b3c4
commit 27d9ebb
Show file tree

Hide file tree

Showing 24 changed files with 1,144 additions and 107 deletions.
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
@@ -94,6 +94,17 @@ jobs:
     needs:
       - build
 
+  helm-e2e-test:
+    uses: otterize/helm-charts/.github/workflows/e2e-test.yaml@main
+    name: Trigger e2e tests from helm charts repo
+    secrets: inherit
+    with:
+      gcr-registry: ${{ needs.build.outputs.registry }}
+      intents-operator-tag: ${{ github.sha }}
+    needs:
+      - build
+
+
   tag-latest-dev:
     name: Tag latest
     if: github.ref == 'refs/heads/main'

diff --git a/src/go.sum b/src/go.sum
diff --git a/src/operator/api/v1alpha3/postgresqlserverconfig_types.go b/src/operator/api/v1alpha3/postgresqlserverconfig_types.go
@@ -20,9 +20,34 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
+type DatabaseCredentialsSecretRef struct {
+	// Name is the name of he k8s secret storing the credentials
+	Name string `json:"name,omitempty"`
+	// Namespace is the namespace in which the secret is stored.
+	// If not provided, the operator will look for the secret in the same namespace as the database ServerConfig.
+	//+optional
+	Namespace string `json:"namespace,omitempty"`
+	// UsernameKey is the key in the secret that stores the username
+	//+optional
+	//+kubebuilder:default="username"
+	UsernameKey string `json:"usernameKey,omitempty"`
+	// PasswordKey is the key in the secret that stores the password
+	//+optional
+	//+kubebuilder:default="password"
+	PasswordKey string `json:"passwordKey,omitempty"`
+}
+
+// DatabaseCredentials defines the credentials to access the database
 type DatabaseCredentials struct {
-	Username string `json:"username"`
-	Password string `json:"password"`
+	// Username is the plaintext username to access the database
+	//+optional
+	Username string `json:"username,omitempty"`
+	// Password is the plaintext password to access the database
+	//+optional
+	Password string `json:"password,omitempty"`
+	// SecretRef is a reference to a k8s secret storing the credentials
+	//+optional
+	SecretRef *DatabaseCredentialsSecretRef `json:"secretRef,omitempty"`
 }
 
 // PostgreSQLServerConfigSpec defines the desired state of PostgreSQLServerConfig

diff --git a/src/operator/api/v1alpha3/zz_generated.deepcopy.go b/src/operator/api/v1alpha3/zz_generated.deepcopy.go
diff --git a/src/operator/config/crd/k8s.otterize.com_mysqlserverconfigs.patched b/src/operator/config/crd/k8s.otterize.com_mysqlserverconfigs.patched
@@ -56,14 +56,36 @@ spec:
                 address:
                   type: string
                 credentials:
+                  description: DatabaseCredentials defines the credentials to access the database
                   properties:
                     password:
+                      description: Password is the plaintext password to access the database
                       type: string
+                    secretRef:
+                      description: SecretRef is a reference to a k8s secret storing the credentials
+                      properties:
+                        name:
+                          description: Name is the name of he k8s secret storing the credentials
+                          type: string
+                        namespace:
+                          description: |-
+                            Namespace is the namespace in which the secret is stored.
+                            If not provided, the operator will look for the secret in the same namespace as the database ServerConfig.
+                          type: string
+                        passwordKey:
+                          default: password
+                          description: PasswordKey is the key in the secret that stores the password
+                          type: string
+                        usernameKey:
+                          default: username
+                          description: UsernameKey is the key in the secret that stores the username
+                          type: string
+                      required:
+                        - name
+                      type: object
                     username:
+                      description: Username is the plaintext username to access the database
                       type: string
-                  required:
-                    - password
-                    - username
                   type: object
               required:
                 - address

diff --git a/src/operator/config/crd/k8s.otterize.com_mysqlserverconfigs.yaml b/src/operator/config/crd/k8s.otterize.com_mysqlserverconfigs.yaml
@@ -42,14 +42,43 @@ spec:
               address:
                 type: string
               credentials:
+                description: DatabaseCredentials defines the credentials to access
+                  the database
                 properties:
                   password:
+                    description: Password is the plaintext password to access the
+                      database
                     type: string
+                  secretRef:
+                    description: SecretRef is a reference to a k8s secret storing
+                      the credentials
+                    properties:
+                      name:
+                        description: Name is the name of he k8s secret storing the
+                          credentials
+                        type: string
+                      namespace:
+                        description: |-
+                          Namespace is the namespace in which the secret is stored.
+                          If not provided, the operator will look for the secret in the same namespace as the database ServerConfig.
+                        type: string
+                      passwordKey:
+                        default: password
+                        description: PasswordKey is the key in the secret that stores
+                          the password
+                        type: string
+                      usernameKey:
+                        default: username
+                        description: UsernameKey is the key in the secret that stores
+                          the username
+                        type: string
+                    required:
+                    - name
+                    type: object
                   username:
+                    description: Username is the plaintext username to access the
+                      database
                     type: string
-                required:
-                - password
-                - username
                 type: object
             required:
             - address

diff --git a/src/operator/config/crd/k8s.otterize.com_postgresqlserverconfigs.patched b/src/operator/config/crd/k8s.otterize.com_postgresqlserverconfigs.patched
@@ -56,14 +56,36 @@ spec:
                 address:
                   type: string
                 credentials:
+                  description: DatabaseCredentials defines the credentials to access the database
                   properties:
                     password:
+                      description: Password is the plaintext password to access the database
                       type: string
+                    secretRef:
+                      description: SecretRef is a reference to a k8s secret storing the credentials
+                      properties:
+                        name:
+                          description: Name is the name of he k8s secret storing the credentials
+                          type: string
+                        namespace:
+                          description: |-
+                            Namespace is the namespace in which the secret is stored.
+                            If not provided, the operator will look for the secret in the same namespace as the database ServerConfig.
+                          type: string
+                        passwordKey:
+                          default: password
+                          description: PasswordKey is the key in the secret that stores the password
+                          type: string
+                        usernameKey:
+                          default: username
+                          description: UsernameKey is the key in the secret that stores the username
+                          type: string
+                      required:
+                        - name
+                      type: object
                     username:
+                      description: Username is the plaintext username to access the database
                       type: string
-                  required:
-                    - password
-                    - username
                   type: object
               required:
                 - address

diff --git a/src/operator/config/crd/k8s.otterize.com_postgresqlserverconfigs.yaml b/src/operator/config/crd/k8s.otterize.com_postgresqlserverconfigs.yaml
@@ -43,14 +43,43 @@ spec:
               address:
                 type: string
               credentials:
+                description: DatabaseCredentials defines the credentials to access
+                  the database
                 properties:
                   password:
+                    description: Password is the plaintext password to access the
+                      database
                     type: string
+                  secretRef:
+                    description: SecretRef is a reference to a k8s secret storing
+                      the credentials
+                    properties:
+                      name:
+                        description: Name is the name of he k8s secret storing the
+                          credentials
+                        type: string
+                      namespace:
+                        description: |-
+                          Namespace is the namespace in which the secret is stored.
+                          If not provided, the operator will look for the secret in the same namespace as the database ServerConfig.
+                        type: string
+                      passwordKey:
+                        default: password
+                        description: PasswordKey is the key in the secret that stores
+                          the password
+                        type: string
+                      usernameKey:
+                        default: username
+                        description: UsernameKey is the key in the secret that stores
+                          the username
+                        type: string
+                    required:
+                    - name
+                    type: object
                   username:
+                    description: Username is the plaintext username to access the
+                      database
                     type: string
-                required:
-                - password
-                - username
                 type: object
             required:
             - address

diff --git a/src/operator/config/rbac/manifests-patched.yaml b/src/operator/config/rbac/manifests-patched.yaml
@@ -113,6 +113,12 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
 - apiGroups:
   - iam.cnrm.cloud.google.com
   resources:

diff --git a/src/operator/config/rbac/role.yaml b/src/operator/config/rbac/role.yaml
@@ -113,6 +113,12 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
 - apiGroups:
   - iam.cnrm.cloud.google.com
   resources: