SecretProvider

apis/config/v1beta1/operatorconfig_types.go

@@ -38,6 +38,22 @@ type OperatorConfig struct {
 
 	// ImageConfigFile indicates the path where to load the imageConfig from
 	ImageConfigFile string `json:"imageConfigFile,omitempty"`
+
+	// SecretProvider sets where the Secrets are loaded from. If unset, loads them from Kubernetes
+	SecretProvider SecretProviderConfigSpec `json:"secretProvider,omitempty"`
+}
+
+type SecretProviderConfigSpec struct {
+	Source SecretProviderSource `json:",inline,omitempty"`
+}
+
+type SecretProviderSource struct {
+	Filesystem *SecretProviderFilesystemSource `json:"filesystem,omitempty"`
+}
+
+type SecretProviderFilesystemSource struct {
+	Path            string `json:"path"`
+	NamespacedPaths bool   `json:"namespaced,omitempty"`
 }
 
 func init() {

pkg/secrets/provider.go

@@ -0,0 +1,39 @@
+package secrets
+
+import (
+	"context"
+
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/serializer"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/client-go/kubernetes/scheme"
+)
+
+type SecretProvider interface {
+	RetrieveSecret(context.Context, types.NamespacedName) (*corev1.Secret, error)
+	StoreOrUpdateSecret(context.Context, *corev1.Secret) error
+}
+
+// Common methods that could be used by multiple implementations
+
+func decodeSecret(data []byte) (*corev1.Secret, error) {
+	decoder := serializer.NewCodecFactory(scheme.Scheme).UniversalDecoder()
+	object := &corev1.Secret{}
+
+	err := runtime.DecodeInto(decoder, data, object)
+	if err != nil {
+		return nil, err
+	}
+	return object, nil
+}
+
+func encodeSecret(secret *corev1.Secret) ([]byte, error) {
+	encoder := serializer.NewCodecFactory(scheme.Scheme).LegacyCodec(corev1.SchemeGroupVersion)
+	b, err := runtime.Encode(encoder, secret)
+	if err != nil {
+		return nil, err
+	}
+	return b, nil
+
+}

pkg/secrets/provider_file.go

@@ -0,0 +1,53 @@
+package secrets
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+type FileProvider struct {
+	path              string
+	namespacePrefixed bool
+}
+
+func NewFileProvider(directoryPath string, namespacePrefix bool) *FileProvider {
+	return &FileProvider{
+		path:              directoryPath,
+		namespacePrefixed: namespacePrefix,
+	}
+}
+
+// SecretProvider interface
+
+func (f *FileProvider) RetrieveSecret(ctx context.Context, name types.NamespacedName) (*corev1.Secret, error) {
+	filename := f.secretPath(name)
+	return readSecret(filename)
+}
+
+func (f *FileProvider) StoreOrUpdateSecret(ctx context.Context, secret *corev1.Secret) error {
+	// This provider does not store updates to the disk. This is intended for use-cases where the secrets are externally
+	// applied to operator's volume
+	return nil
+}
+
+// Rest of the implementation
+
+func (f *FileProvider) secretPath(name types.NamespacedName) string {
+	if f.namespacePrefixed {
+		return filepath.Join(f.path, name.Namespace, name.Name)
+	}
+	return filepath.Join(f.path, name.Name)
+}
+
+func readSecret(path string) (*corev1.Secret, error) {
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return nil, err
+	}
+
+	return decodeSecret(b)
+}

pkg/secrets/provider_file_test.go

@@ -0,0 +1,73 @@
+package secrets
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+var _ SecretProvider = &FileProvider{}
+
+func TestSecretPathsNoPrefix(t *testing.T) {
+	assert := assert.New(t)
+	f := &FileProvider{
+		path:              "/etc/secrets",
+		namespacePrefixed: false,
+	}
+
+	sName := types.NamespacedName{Name: "cert-client", Namespace: "cluster1"}
+	path := f.secretPath(sName)
+	assert.Equal("/etc/secrets/cert-client", path)
+}
+
+func TestSecretPathsWithPrefix(t *testing.T) {
+	assert := assert.New(t)
+	f := &FileProvider{
+		path:              "/etc/secrets",
+		namespacePrefixed: true,
+	}
+
+	sName := types.NamespacedName{Name: "cert-client", Namespace: "cluster1"}
+	path := f.secretPath(sName)
+	assert.Equal("/etc/secrets/cluster1/cert-client", path)
+}
+
+func TestSecretReading(t *testing.T) {
+	require := require.New(t)
+	s := &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-secret",
+			Namespace: "test-ns",
+		},
+		StringData: map[string]string{
+			"a": "b",
+			"c": "d",
+		},
+	}
+
+	data, err := encodeSecret(s)
+	require.NoError(err)
+
+	tempDir, err := os.MkdirTemp("", "")
+	require.NoError(err)
+	defer os.RemoveAll(tempDir)
+
+	err = os.WriteFile(filepath.Join(tempDir, "test-secret"), data, 0755)
+	require.NoError(err)
+
+	f := NewFileProvider(tempDir, false)
+
+	s2, err := f.RetrieveSecret(context.TODO(), types.NamespacedName{Name: s.Name, Namespace: s.Namespace})
+	require.NoError(err)
+
+	require.Equal(s.Name, s2.Name)
+	require.Equal(s.Namespace, s2.Namespace)
+	require.Equal(s.StringData, s2.StringData)
+}

pkg/secrets/provider_kubernetes.go

@@ -0,0 +1,39 @@
+package secrets
+
+import (
+	"context"
+
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+type KubernetesProvider struct {
+	client.Client
+}
+
+func NewKubernetesProvider(cli client.Client) *KubernetesProvider {
+	return &KubernetesProvider{
+		Client: cli,
+	}
+}
+
+// SecretProvider interfaces
+
+func (k *KubernetesProvider) RetrieveSecret(ctx context.Context, name types.NamespacedName) (*corev1.Secret, error) {
+	secret := &corev1.Secret{}
+	if err := k.Client.Get(ctx, name, secret); err != nil {
+		return nil, err
+	}
+	return secret, nil
+}
+
+func (k *KubernetesProvider) StoreOrUpdateSecret(ctx context.Context, secret *corev1.Secret) error {
+	if err := k.Client.Create(ctx, secret); err != nil {
+		if errors.IsAlreadyExists(err) {
+			return k.Client.Update(ctx, secret)
+		}
+	}
+	return nil
+}