feat: initial implementation of secrets sync controller #1466

mandreap · 2024-03-12T18:35:30Z

What type of PR is this?
/kind feature

What this PR does / why we need it:
This PR proposes an implementation for the Secret Sync Controller. This proposal is a diversion from the current design of the CSI driver. Based on feedback, some of the users want the CSI driver to sync the secret store objects as Kubernetes secrets without the mount instead of the tight coupling between the mount and the sync as it is today.

To support this, we could extract the sync controller from the CSI driver and have it as a standalone deployment. Just syncing as Kubernetes secrets is a cluster-scope operation and doesn’t require the controller or CSI pods to be run on all nodes. The controller would need to watch for Create/Update events for the SS (Secret Sync) and create the Kubernetes secrets by making an RPC call to the provider.

For more information, see the design proposal.

squashed commits
includes documentation
adds unit tests

Bumps [k8s.io/klog/v2](https://github.com/kubernetes/klog) from 2.100.1 to 2.120.1. - [Release notes](https://github.com/kubernetes/klog/releases) - [Changelog](https://github.com/kubernetes/klog/blob/main/RELEASE.md) - [Commits](kubernetes/klog@v2.100.1...v2.120.1) --- updated-dependencies: - dependency-name: k8s.io/klog/v2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>

Bumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 3.1.5 to 4.0.0. - [Release notes](https://github.com/actions/dependency-review-action/releases) - [Commits](actions/dependency-review-action@c74b580...4901385) --- updated-dependencies: - dependency-name: actions/dependency-review-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]>

k8s-ci-robot · 2024-03-12T18:35:40Z

Hi @mandreap. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

aramase · 2024-03-12T19:20:55Z

/retitle feat: initial implementation of secrets sync controller
/assign aramase enj

aramase

These comments are based on some initial testing. I haven't done a complete review yet of the changes in this PR.

I've a gist with the steps documented: https://gist.github.com/aramase/46bd3d4270d9c44b59e8c2afe56fbc09

secret-sync-controller/charts/secretsync/templates/create_update_secrets_types.yaml

secret-sync-controller/charts/secretsync/templates/update_owners_check_old_object.yaml

secret-sync-controller/config/validatingadmissionpolicies/create_update_secrets_types.yaml

secret-sync-controller/config/validatingadmissionpolicies/update_owners_check_old_object.yaml

secret-sync-controller/charts/secretsync/templates/auth_proxy_role.yaml

secret-sync-controller/charts/secretsync/templates/auth_proxy_role_binding.yaml

secret-sync-controller/main.go

aramase

Review part 1 on the manifests and charts

Going to review the controller implementation next.

secret-sync-controller/Dockerfile

secret-sync-controller/Makefile

secret-sync-controller/PROJECT

secret-sync-controller/api/v1alpha1/groupversion_info.go

secret-sync-controller/charts/index.yaml

secret-sync-controller/config/prometheus/monitor.yaml

secret-sync-controller/config/rbac/auth_proxy_client_clusterrole.yaml

secret-sync-controller/config/rbac/auth_proxy_role_binding.yaml

secret-sync-controller/controllers/conditions.go

secret-sync-controller/controllers/secretsync_controller.go

aramase

The previous review was only for the controller implementation. Still need to look at all the files that are after controller.

aramase

Another round of review for controller and token manager implementation.

secret-sync-controller/Dockerfile

secret-sync-controller/Makefile

secret-sync-controller/api/v1alpha1/groupversion_info.go

secret-sync-controller/api/v1alpha1/secretsync_types.go

secret-sync-controller/pkg/k8s/token.go

enj · 2024-05-07T16:55:42Z

/assign nilekhc

aramase

/ok-to-test

aramase

@mandreap Only comment to fix the licenses before we can merge.

The previous comments I added have mostly been addressed. I'm ok with merging this PR to the feature branch as-is (after the license is fixed) in an effort to make progress on moving these changes to https://github.com/kubernetes-sigs/secrets-store-sync-controller.

aramase · 2024-05-13T08:38:19Z

secret-sync-controller/controllers/conditions.go

+/*
+Copyright 2023.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/


@mandreap This license is still incorrect. Please update it to https://github.com/kubernetes-sigs/secrets-store-csi-driver/pull/1466/files#r1571866927.

aramase

/lgtm
/approve

Thank you for the pre-alpha implementation.

The next step for this feature is going to be moving to the new repo and targetting the alpha release so users can try it out!

k8s-ci-robot · 2024-05-13T17:14:13Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aramase, mandreap

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [aramase]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

dependabot bot added 2 commits March 12, 2024 17:02

k8s-ci-robot added kind/feature Categorizes issue or PR as related to a new feature. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Mar 12, 2024

k8s-ci-robot added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label Mar 12, 2024

k8s-ci-robot requested review from nilekhc and tam7t March 12, 2024 18:35

k8s-ci-robot assigned aramase and enj Mar 12, 2024

k8s-ci-robot changed the title ~~Mandrea/secret sync controller~~ feat: initial implementation of secrets sync controller Mar 12, 2024

mandreap force-pushed the mandrea/secret-sync-controller branch 3 times, most recently from 0c1db60 to fd62f2b Compare March 15, 2024 17:58

aramase requested changes Mar 15, 2024

View reviewed changes

mandreap force-pushed the mandrea/secret-sync-controller branch 2 times, most recently from e22f2dc to 18b99da Compare March 18, 2024 16:06

mandreap requested a review from aramase March 21, 2024 11:19

mandreap force-pushed the mandrea/secret-sync-controller branch from 18b99da to 87b14a4 Compare March 21, 2024 16:47

aramase requested changes Mar 29, 2024

View reviewed changes

mandreap commented Apr 3, 2024

View reviewed changes

secret-sync-controller/controllers/secretsync_controller.go Outdated Show resolved Hide resolved

aramase requested changes Apr 5, 2024

View reviewed changes

mandreap requested a review from aramase April 12, 2024 19:17

mandreap force-pushed the mandrea/secret-sync-controller branch from 139775a to 7625c37 Compare April 15, 2024 10:37

aramase requested changes Apr 19, 2024

View reviewed changes

mandreap force-pushed the mandrea/secret-sync-controller branch 2 times, most recently from 213c6e0 to aa8476a Compare May 2, 2024 09:54

mandreap force-pushed the mandrea/secret-sync-controller branch from aa8476a to 7137c90 Compare May 2, 2024 09:59

enj removed their assignment May 7, 2024

k8s-ci-robot assigned nilekhc May 7, 2024

nilekhc mentioned this pull request May 8, 2024

Move Secrets Store Sync Controller code to this repo kubernetes-sigs/secrets-store-sync-controller#1

Closed

mandreap force-pushed the mandrea/secret-sync-controller branch 2 times, most recently from c4afd9b to b4154ee Compare May 9, 2024 14:16

aramase reviewed May 13, 2024

View reviewed changes

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels May 13, 2024

aramase reviewed May 13, 2024

View reviewed changes

secret sync controller implementation

3f27b06

mandreap force-pushed the mandrea/secret-sync-controller branch from b4154ee to 3f27b06 Compare May 13, 2024 17:08

aramase reviewed May 13, 2024

View reviewed changes

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 13, 2024

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 13, 2024

k8s-ci-robot merged commit a4ed0fb into kubernetes-sigs:feature/secrets-sync-controller May 13, 2024
2 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: initial implementation of secrets sync controller #1466

feat: initial implementation of secrets sync controller #1466

mandreap commented Mar 12, 2024

k8s-ci-robot commented Mar 12, 2024

aramase commented Mar 12, 2024

aramase left a comment •

edited

Loading

aramase left a comment

aramase left a comment

aramase left a comment

enj commented May 7, 2024

aramase left a comment

aramase left a comment

aramase May 13, 2024

aramase left a comment

k8s-ci-robot commented May 13, 2024

feat: initial implementation of secrets sync controller #1466

feat: initial implementation of secrets sync controller #1466

Conversation

mandreap commented Mar 12, 2024

k8s-ci-robot commented Mar 12, 2024

aramase commented Mar 12, 2024

aramase left a comment • edited Loading

Choose a reason for hiding this comment

aramase left a comment

Choose a reason for hiding this comment

aramase left a comment

Choose a reason for hiding this comment

aramase left a comment

Choose a reason for hiding this comment

enj commented May 7, 2024

aramase left a comment

Choose a reason for hiding this comment

aramase left a comment

Choose a reason for hiding this comment

aramase May 13, 2024

Choose a reason for hiding this comment

aramase left a comment

Choose a reason for hiding this comment

k8s-ci-robot commented May 13, 2024

aramase left a comment •

edited

Loading