subscribe to secret change

api/common/common.go

@@ -3,6 +3,8 @@ package common
 import (
 	"fmt"
 
+	"k8s.io/apimachinery/pkg/api/meta"
+
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -13,6 +15,7 @@ type ControllerName string
 const (
 	ServiceInstanceController       ControllerName = "ServiceInstance"
 	ServiceBindingController        ControllerName = "ServiceBinding"
+	SecretController                ControllerName = "Secret"
 	FinalizerName                   string         = "services.cloud.sap.com/sap-btp-finalizer"
 	StaleBindingIDLabel             string         = "services.cloud.sap.com/stale"
 	StaleBindingRotationOfLabel     string         = "services.cloud.sap.com/rotationOf"
@@ -74,11 +77,18 @@ type SAPBTPResource interface {
 	GetParameters() *runtime.RawExtension
 	GetStatus() interface{}
 	SetStatus(status interface{})
-	GetObservedGeneration() int64
-	SetObservedGeneration(int64)
 	DeepClone() SAPBTPResource
 	SetReady(metav1.ConditionStatus)
 	GetReady() metav1.ConditionStatus
 	GetAnnotations() map[string]string
 	SetAnnotations(map[string]string)
 }
+
+func GetObservedGeneration(obj SAPBTPResource) int64 {
+	cond := meta.FindStatusCondition(obj.GetConditions(), ConditionSucceeded)
+	observedGen := int64(0)
+	if cond != nil {
+		observedGen = cond.ObservedGeneration
+	}
+	return observedGen
+}

api/common/consts.go

@@ -3,6 +3,8 @@ package common
 const (
 	ManagedByBTPOperatorLabel = "services.cloud.sap.com/managed-by-sap-btp-operator"
 	ClusterSecretLabel        = "services.cloud.sap.com/cluster-secret"
+	InstanceSecretRefLabel    = "services.cloud.sap.com/secret-ref_"
+	WatchSecretLabel          = "services.cloud.sap.com/watch-secret"
 
 	NamespaceLabel = "_namespace"
 	K8sNameLabel   = "_k8sname"

api/v1/servicebinding_types.go

@@ -123,9 +123,6 @@ type ServiceBindingStatus struct {
 	// Service binding conditions
 	Conditions []metav1.Condition `json:"conditions"`
 
-	// Last generation that was acted on
-	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
-
 	// Indicates whether binding is ready for usage
 	Ready metav1.ConditionStatus `json:"ready,omitempty"`
 
@@ -179,14 +176,6 @@ func (sb *ServiceBinding) SetStatus(status interface{}) {
 	sb.Status = status.(ServiceBindingStatus)
 }
 
-func (sb *ServiceBinding) GetObservedGeneration() int64 {
-	return sb.Status.ObservedGeneration
-}
-
-func (sb *ServiceBinding) SetObservedGeneration(newObserved int64) {
-	sb.Status.ObservedGeneration = newObserved
-}
-
 func (sb *ServiceBinding) DeepClone() common.SAPBTPResource {
 	return sb.DeepCopy()
 }

api/v1/servicebinding_types_test.go

@@ -66,18 +66,6 @@ var _ = Describe("Service Binding Type Test", func() {
 		Expect(binding.GetControllerName()).To(Equal(common.ServiceBindingController))
 	})
 
-	It("should update observed generation", func() {
-		Expect(binding.Status.ObservedGeneration).To(Equal(int64(0)))
-		binding.SetObservedGeneration(2)
-		Expect(binding.GetObservedGeneration()).To(Equal(int64(2)))
-	})
-
-	It("should update observed generation", func() {
-		Expect(binding.Status.ObservedGeneration).To(Equal(int64(0)))
-		binding.SetObservedGeneration(2)
-		Expect(binding.Status.ObservedGeneration).To(Equal(int64(2)))
-	})
-
 	It("should update ready", func() {
 		Expect(binding.Status.Ready).To(Equal(metav1.ConditionStatus("")))
 		binding.SetReady(metav1.ConditionTrue)

api/v1/serviceinstance_types.go

@@ -17,11 +17,16 @@ limitations under the License.
 package v1
 
 import (
+	"crypto/md5"
+	"encoding/hex"
+	"encoding/json"
+
 	"github.com/SAP/sap-btp-service-operator/api/common"
 	"github.com/SAP/sap-btp-service-operator/client/sm/types"
 	v1 "k8s.io/api/authentication/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/utils/ptr"
 )
 
 // EDIT THIS FILE!  THIS IS SCAFFOLDING FOR YOU TO OWN!
@@ -72,6 +77,10 @@ type ServiceInstanceSpec struct {
 	// +optional
 	ParametersFrom []ParametersFromSource `json:"parametersFrom,omitempty"`
 
+	// indicate instance will update on secrets from parametersFrom change
+	// +optional
+	SubscribeToSecretChanges *bool `json:"subscribeToSecretChanges,omitempty"`
+
 	// List of custom tags describing the ServiceInstance, will be copied to `ServiceBinding` secret in the key called `tags`.
 	// +optional
 	CustomTags []string `json:"customTags,omitempty"`
@@ -107,9 +116,6 @@ type ServiceInstanceStatus struct {
 	// Service instance conditions
 	Conditions []metav1.Condition `json:"conditions"`
 
-	// Last generation that was acted on
-	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
-
 	// Indicates whether instance is ready for usage
 	Ready metav1.ConditionStatus `json:"ready,omitempty"`
 
@@ -118,6 +124,9 @@ type ServiceInstanceStatus struct {
 
 	// The subaccount id of the service instance
 	SubaccountID string `json:"subaccountID,omitempty"`
+
+	// if true need to update instance
+	ForceReconcile bool `json:"forceReconcile,omitempty"`
 }
 
 // +kubebuilder:object:root=true
@@ -165,14 +174,6 @@ func (si *ServiceInstance) SetStatus(status interface{}) {
 	si.Status = status.(ServiceInstanceStatus)
 }
 
-func (si *ServiceInstance) GetObservedGeneration() int64 {
-	return si.Status.ObservedGeneration
-}
-
-func (si *ServiceInstance) SetObservedGeneration(newObserved int64) {
-	si.Status.ObservedGeneration = newObserved
-}
-
 func (si *ServiceInstance) DeepClone() common.SAPBTPResource {
 	return si.DeepCopy()
 }
@@ -207,6 +208,19 @@ func init() {
 
 func (si *ServiceInstance) Hub() {}
 
-func (si *ServiceInstance) ShouldBeShared() bool {
+func (si *ServiceInstance) GetShared() bool {
 	return si.Spec.Shared != nil && *si.Spec.Shared
 }
+
+func (si *ServiceInstance) IsSubscribedToSecretChange() bool {
+	return si.Spec.SubscribeToSecretChanges != nil && *si.Spec.SubscribeToSecretChanges
+}
+
+func (si *ServiceInstance) GetSpecHash() string {
+	spec := si.Spec
+	spec.Shared = ptr.To(false)
+	specBytes, _ := json.Marshal(spec)
+	s := string(specBytes)
+	hash := md5.Sum([]byte(s))
+	return hex.EncodeToString(hash[:])
+}

api/v1/serviceinstance_types_test.go

@@ -1,12 +1,17 @@
 package v1
 
 import (
+	"crypto/md5"
+	"encoding/hex"
+	"encoding/json"
+
 	"github.com/SAP/sap-btp-service-operator/api/common"
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/utils/ptr"
 )
 
 var _ = Describe("Service Instance Type Test", func() {
@@ -96,12 +101,6 @@ var _ = Describe("Service Instance Type Test", func() {
 		Expect(instance.GetControllerName()).To(Equal(common.ServiceInstanceController))
 	})
 
-	It("should update observed generation", func() {
-		Expect(instance.Status.ObservedGeneration).To(Equal(int64(0)))
-		instance.SetObservedGeneration(2)
-		Expect(instance.GetObservedGeneration()).To(Equal(int64(2)))
-	})
-
 	It("should update ready", func() {
 		Expect(instance.Status.Ready).To(Equal(metav1.ConditionStatus("")))
 		instance.SetReady(metav1.ConditionTrue)
@@ -129,4 +128,85 @@ var _ = Describe("Service Instance Type Test", func() {
 		instance.SetAnnotations(annotation)
 		Expect(instance.GetAnnotations()).To(Equal(annotation))
 	})
+
+	It("should update SubscribeToSecretChanges", func() {
+		instance.Spec.SubscribeToSecretChanges = &[]bool{true}[0]
+		Expect(instance.IsSubscribedToSecretChange()).To(BeTrue())
+	})
+
+	It("should return correct spec hash", func() {
+		// Calculate expected hash
+		spec := instance.Spec
+		spec.Shared = ptr.To(false)
+		specBytes, _ := json.Marshal(spec)
+		hash := md5.Sum(specBytes)
+		expectedHash := hex.EncodeToString(hash[:])
+
+		// Get actual hash
+		actualHash := instance.GetSpecHash()
+
+		// Compare hashes
+		Expect(actualHash).To(Equal(expectedHash))
+	})
+	It("should update spec hash when spec changes", func() {
+		// Calculate initial hash
+		initialHash := instance.GetSpecHash()
+
+		// Modify the spec
+		instance.Spec.ServicePlanName = "new-plan"
+
+		// Calculate new hash
+		newHash := instance.GetSpecHash()
+
+		// Ensure the hash has changed
+		Expect(initialHash).NotTo(Equal(newHash))
+	})
+	It("should update spec hash when parametersFrom changes", func() {
+		// Calculate initial hash
+		initialHash := instance.GetSpecHash()
+
+		// Modify the parametersFrom field
+		instance.Spec.ParametersFrom = []ParametersFromSource{
+			{
+				SecretKeyRef: &SecretKeyReference{
+					Name: "new-param-secret",
+					Key:  "new-secret-parameter",
+				},
+			},
+		}
+
+		// Calculate new hash
+		newHash := instance.GetSpecHash()
+
+		// Ensure the hash has changed
+		Expect(initialHash).NotTo(Equal(newHash))
+	})
+	It("should update spec hash when parametersFrom changes with initial object", func() {
+		// Initialize ParametersFrom with an object
+		instance.Spec.ParametersFrom = []ParametersFromSource{
+			{
+				SecretKeyRef: &SecretKeyReference{
+					Name: "initial-param-secret",
+					Key:  "initial-secret-parameter",
+				},
+			},
+		}
+
+		// Calculate initial hash
+		initialHash := instance.GetSpecHash()
+
+		// Modify the parametersFrom field
+		instance.Spec.ParametersFrom = append(instance.Spec.ParametersFrom, ParametersFromSource{
+			SecretKeyRef: &SecretKeyReference{
+				Name: "new-param-secret",
+				Key:  "new-secret-parameter",
+			},
+		})
+
+		// Calculate new hash
+		newHash := instance.GetSpecHash()
+
+		// Ensure the hash has changed
+		Expect(initialHash).NotTo(Equal(newHash))
+	})
 })

api/v1/suite_test.go

@@ -77,6 +77,7 @@ func getInstance() *ServiceInstance {
 					},
 				},
 			},
+			SubscribeToSecretChanges: &[]bool{true}[0],
 			UserInfo: &v1.UserInfo{
 				Username: "test-user",
 				Groups:   []string{"test-group"},