@@ -31,12 +31,16 @@ const (
3131 SecretCaKey = "ca.crt"
3232 SecretAuthHeaderKey = "authorizationHeader"
3333 DockerConfigJsonKey = ".dockerconfigjson"
34+
35+ Annotation_ManagedBy_Key = "kubeapps.dev/managed-by"
36+ Annotation_ManagedBy_Value = "plugin:helm"
3437)
3538
36- func newLocalOpaqueSecret (ownerRepo types. NamespacedName ) * k8scorev1.Secret {
39+ func newLocalOpaqueSecret (repoName string ) * k8scorev1.Secret {
3740 return & k8scorev1.Secret {
3841 ObjectMeta : metav1.ObjectMeta {
39- Name : helm .SecretNameForRepo (ownerRepo .Name ),
42+ Name : helm .SecretNameForRepo (repoName ),
43+ Annotations : map [string ]string {Annotation_ManagedBy_Key : Annotation_ManagedBy_Value },
4044 },
4145 Type : k8scorev1 .SecretTypeOpaque ,
4246 Data : map [string ][]byte {},
@@ -62,10 +66,10 @@ func handleAuthSecretForCreate(
6266
6367 // create/get secret
6468 if hasCaRef || hasAuthRef {
65- secret , err := validateUserManagedRepoSecret (ctx , typedClient , repoName , tlsConfig , auth )
69+ secret , err := validateUserManagedRepoSecret (ctx , typedClient , repoName . Namespace , tlsConfig , auth )
6670 return secret , false , err
6771 } else if hasCaData || hasAuthData {
68- secret , _ , err := newSecretFromTlsConfigAndAuth (repoName , tlsConfig , auth )
72+ secret , _ , err := newSecretFromTlsConfigAndAuth (repoName . Name , tlsConfig , auth )
6973 return secret , true , err
7074 } else {
7175 return nil , false , nil
@@ -75,17 +79,18 @@ func handleAuthSecretForCreate(
7579func handleImagesPullSecretForCreate (
7680 ctx context.Context ,
7781 typedClient kubernetes.Interface ,
78- repo * HelmRepository ) (* k8scorev1.Secret , bool , error ) {
82+ repoName types.NamespacedName ,
83+ customDetail * v1alpha1.HelmPackageRepositoryCustomDetail ) (* k8scorev1.Secret , bool , error ) {
7984
80- hasRef := repo . customDetail != nil && repo . customDetail .ImagesPullSecret != nil && repo . customDetail .ImagesPullSecret .GetSecretRef () != ""
81- hasData := repo . customDetail != nil && repo . customDetail .ImagesPullSecret != nil && repo . customDetail .ImagesPullSecret .GetCredentials () != nil
85+ hasRef := customDetail != nil && customDetail .ImagesPullSecret != nil && customDetail .ImagesPullSecret .GetSecretRef () != ""
86+ hasData := customDetail != nil && customDetail .ImagesPullSecret != nil && customDetail .ImagesPullSecret .GetCredentials () != nil
8287
8388 // create/get secret
8489 if hasRef {
85- secret , err := validateDockerImagePullSecret (ctx , typedClient , repo . name , repo . customDetail .ImagesPullSecret .GetSecretRef ())
90+ secret , err := validateDockerImagePullSecret (ctx , typedClient , repoName . Namespace , customDetail .ImagesPullSecret .GetSecretRef ())
8691 return secret , false , err
8792 } else if hasData {
88- secret , _ , err := newDockerImagePullSecret (repo . name , repo . customDetail .ImagesPullSecret .GetCredentials ())
93+ secret , _ , err := newDockerImagePullSecret (repoName . Name , customDetail .ImagesPullSecret .GetCredentials ())
8994 return secret , true , err
9095 } else {
9196 return nil , false , nil
@@ -95,7 +100,7 @@ func handleImagesPullSecretForCreate(
95100func handleAuthSecretForUpdate (
96101 ctx context.Context ,
97102 typedClient kubernetes.Interface ,
98- repoName types. NamespacedName ,
103+ repo * apprepov1alpha1. AppRepository ,
99104 tlsConfig * corev1.PackageRepositoryTlsConfig ,
100105 auth * corev1.PackageRepositoryAuth ,
101106 secret * k8scorev1.Secret ) (updatedSecret * k8scorev1.Secret , secretIsKubeappsManaged bool , secretIsUpdated bool , err error ) {
@@ -112,19 +117,19 @@ func handleAuthSecretForUpdate(
112117
113118 // check we cannot change mode (per design spec)
114119 if secret != nil && (hasCaRef || hasCaData || hasAuthRef || hasAuthData ) {
115- if isAuthSecretKubeappsManaged (repoName . Name , secret ) != (hasAuthData || hasCaData ) {
120+ if isAuthSecretKubeappsManaged (repo , secret ) != (hasAuthData || hasCaData ) {
116121 return nil , false , false , status .Errorf (codes .InvalidArgument , "Auth management mode cannot be changed" )
117122 }
118123 }
119124
120125 // handle user managed secret
121126 if hasCaRef || hasAuthRef {
122- updatedSecret , err := validateUserManagedRepoSecret (ctx , typedClient , repoName , tlsConfig , auth )
127+ updatedSecret , err := validateUserManagedRepoSecret (ctx , typedClient , repo . GetNamespace () , tlsConfig , auth )
123128 return updatedSecret , false , true , err
124129 }
125130
126131 // handle kubeapps managed secret
127- updatedSecret , isSameSecret , err := newSecretFromTlsConfigAndAuth (repoName , tlsConfig , auth )
132+ updatedSecret , isSameSecret , err := newSecretFromTlsConfigAndAuth (repo . GetName () , tlsConfig , auth )
128133 if err != nil {
129134 return nil , true , false , err
130135 } else if isSameSecret {
@@ -146,12 +151,13 @@ func handleAuthSecretForUpdate(
146151func handleImagesPullSecretForUpdate (
147152 ctx context.Context ,
148153 typedClient kubernetes.Interface ,
149- repo * HelmRepository ,
154+ repo * apprepov1alpha1.AppRepository ,
155+ customDetail * v1alpha1.HelmPackageRepositoryCustomDetail ,
150156 secret * k8scorev1.Secret ) (updatedSecret * k8scorev1.Secret , secretIsKubeappsManaged bool , secretIsUpdated bool , err error ) {
151157
152158 var imagesPullSecrets * v1alpha1.ImagesPullSecret
153- if repo . customDetail != nil && repo . customDetail .ImagesPullSecret != nil {
154- imagesPullSecrets = repo . customDetail .ImagesPullSecret
159+ if customDetail != nil && customDetail .ImagesPullSecret != nil {
160+ imagesPullSecrets = customDetail .ImagesPullSecret
155161 } else {
156162 imagesPullSecrets = & v1alpha1.ImagesPullSecret {}
157163 }
@@ -161,19 +167,19 @@ func handleImagesPullSecretForUpdate(
161167
162168 // check we are not changing mode
163169 if secret != nil && (hasRef || hasData ) {
164- if isImagesPullSecretKubeappsManaged (repo . name . Name , secret ) != hasData {
170+ if isImagesPullSecretKubeappsManaged (repo , secret ) != hasData {
165171 return nil , false , false , status .Errorf (codes .InvalidArgument , "Auth management mode cannot be changed" )
166172 }
167173 }
168174
169175 // handle user managed secret
170176 if hasRef {
171- updatedSecret , err := validateDockerImagePullSecret (ctx , typedClient , repo .name , imagesPullSecrets .GetSecretRef ())
177+ updatedSecret , err := validateDockerImagePullSecret (ctx , typedClient , repo .GetNamespace () , imagesPullSecrets .GetSecretRef ())
172178 return updatedSecret , false , true , err
173179 }
174180
175181 // handle kubeapps managed secret
176- updatedSecret , isSameSecret , err := newDockerImagePullSecret (repo .name , imagesPullSecrets .GetCredentials ())
182+ updatedSecret , isSameSecret , err := newDockerImagePullSecret (repo .GetName () , imagesPullSecrets .GetCredentials ())
177183 if err != nil {
178184 return nil , true , false , err
179185 } else if isSameSecret {
@@ -193,7 +199,7 @@ func handleImagesPullSecretForUpdate(
193199}
194200
195201// this func is only used with kubeapps-managed secrets
196- func newSecretFromTlsConfigAndAuth (repoName types. NamespacedName ,
202+ func newSecretFromTlsConfigAndAuth (repoName string ,
197203 tlsConfig * corev1.PackageRepositoryTlsConfig ,
198204 auth * corev1.PackageRepositoryAuth ) (secret * k8scorev1.Secret , isSameSecret bool , err error ) {
199205 if tlsConfig != nil {
@@ -370,10 +376,10 @@ func createKubeappsManagedRepoSecret(
370376
371377func validateDockerImagePullSecret (ctx context.Context ,
372378 typedClient kubernetes.Interface ,
373- repoName types. NamespacedName ,
379+ namespace string ,
374380 secretName string ) (* k8scorev1.Secret , error ) {
375381
376- if secret , err := typedClient .CoreV1 ().Secrets (repoName . Namespace ).Get (ctx , secretName , metav1.GetOptions {}); err != nil {
382+ if secret , err := typedClient .CoreV1 ().Secrets (namespace ).Get (ctx , secretName , metav1.GetOptions {}); err != nil {
377383 return nil , statuserror .FromK8sError ("get" , "secret" , secretName , err )
378384 } else if secret .Type != k8scorev1 .SecretTypeDockerConfigJson {
379385 return nil , status .Errorf (codes .InvalidArgument , "Images Docker pull secret %s does not have valid type" , secretName )
@@ -388,15 +394,16 @@ func imagesPullSecretName(repoName string) string {
388394 return fmt .Sprintf ("pullsecret-%s" , repoName )
389395}
390396
391- func newDockerImagePullSecret (ownerRepo types. NamespacedName , credentials * corev1.DockerCredentials ) (secret * k8scorev1.Secret , isSameSecret bool , err error ) {
397+ func newDockerImagePullSecret (repoName string , credentials * corev1.DockerCredentials ) (secret * k8scorev1.Secret , isSameSecret bool , err error ) {
392398 if credentials != nil {
393399 if credentials .Server == "" || credentials .Username == "" || credentials .Password == "" || credentials .Email == "" {
394400 return nil , false , status .Errorf (codes .InvalidArgument , "Images pull secret Docker credentials are wrong" )
395401 }
396402
397403 secret = & k8scorev1.Secret {
398404 ObjectMeta : metav1.ObjectMeta {
399- Name : imagesPullSecretName (ownerRepo .Name ),
405+ Name : imagesPullSecretName (repoName ),
406+ Annotations : map [string ]string {Annotation_ManagedBy_Key : Annotation_ManagedBy_Value },
400407 },
401408 Type : k8scorev1 .SecretTypeDockerConfigJson ,
402409 Data : map [string ][]byte {},
@@ -461,7 +468,7 @@ func (s *Server) deleteRepositorySecretFromNamespace(typedClient kubernetes.Inte
461468func validateUserManagedRepoSecret (
462469 ctx context.Context ,
463470 typedClient kubernetes.Interface ,
464- repoName types. NamespacedName ,
471+ namespace string ,
465472 tlsConfig * corev1.PackageRepositoryTlsConfig ,
466473 auth * corev1.PackageRepositoryAuth ) (* k8scorev1.Secret , error ) {
467474 var secretRefTls , secretRefAuth string
@@ -498,7 +505,7 @@ func validateUserManagedRepoSecret(
498505 if secretRef != "" {
499506 var err error
500507 // check that the specified secret exists
501- if secret , err = typedClient .CoreV1 ().Secrets (repoName . Namespace ).Get (ctx , secretRef , metav1.GetOptions {}); err != nil {
508+ if secret , err = typedClient .CoreV1 ().Secrets (namespace ).Get (ctx , secretRef , metav1.GetOptions {}); err != nil {
502509 return nil , statuserror .FromK8sError ("get" , "secret" , secretRef , err )
503510 } else {
504511 // also check that the data in the opaque secret corresponds
@@ -532,7 +539,7 @@ func validateUserManagedRepoSecret(
532539func getRepoImagesPullSecret (source * apprepov1alpha1.AppRepository , imagesPullSecret * k8scorev1.Secret ) * v1alpha1.ImagesPullSecret {
533540 if imagesPullSecret == nil {
534541 return nil
535- } else if isImagesPullSecretKubeappsManaged (source . GetName () , imagesPullSecret ) {
542+ } else if isImagesPullSecretKubeappsManaged (source , imagesPullSecret ) {
536543 return & v1alpha1.ImagesPullSecret {
537544 DockerRegistryCredentialOneOf : & v1alpha1.ImagesPullSecret_Credentials {
538545 Credentials : & corev1.DockerCredentials {
@@ -577,7 +584,7 @@ func getRepoTlsConfigAndAuth(
577584 tlsConfig = & corev1.PackageRepositoryTlsConfig {}
578585 }
579586
580- if isAuthSecretKubeappsManaged (source . GetName () , caSecret ) {
587+ if isAuthSecretKubeappsManaged (source , caSecret ) {
581588 tlsConfig .PackageRepoTlsConfigOneOf = & corev1.PackageRepositoryTlsConfig_CertAuthority {
582589 CertAuthority : RedactedString ,
583590 }
@@ -614,7 +621,7 @@ func getRepoTlsConfigAndAuth(
614621 }
615622
616623 // create data
617- if isAuthSecretKubeappsManaged (source . GetName () , authSecret ) {
624+ if isAuthSecretKubeappsManaged (source , authSecret ) {
618625 switch auth .Type {
619626 case corev1 .PackageRepositoryAuth_PACKAGE_REPOSITORY_AUTH_TYPE_BASIC_AUTH :
620627 auth .PackageRepoAuthOneOf = & corev1.PackageRepositoryAuth_UsernamePassword {
@@ -666,12 +673,30 @@ func getRepoTlsConfigAndAuth(
666673 return tlsConfig , auth , nil
667674}
668675
669- // note: for now, checking based on name pattern for backward compatibility
670- func isAuthSecretKubeappsManaged (repoName string , secret * k8scorev1.Secret ) bool {
671- return secret .GetName () == helm .SecretNameForRepo (repoName )
676+ func isAuthSecretKubeappsManaged (repo * apprepov1alpha1.AppRepository , secret * k8scorev1.Secret ) bool {
677+ if isSecretKubeappsManaged (repo , secret ) {
678+ return true
679+ }
680+
681+ // note: until fully deprecated, we also check based on name pattern for backward compatibility
682+ return secret .GetName () == helm .SecretNameForRepo (repo .GetName ())
672683}
673684
674- // note: for now, checking based on name pattern for backward compatibility
675- func isImagesPullSecretKubeappsManaged (repoName string , secret * k8scorev1.Secret ) bool {
676- return secret .GetName () == imagesPullSecretName (repoName )
685+ func isImagesPullSecretKubeappsManaged (repo * apprepov1alpha1.AppRepository , secret * k8scorev1.Secret ) bool {
686+ if isSecretKubeappsManaged (repo , secret ) {
687+ return true
688+ }
689+
690+ // note: until fully deprecated, we also check based on name pattern for backward compatibility
691+ return secret .GetName () == imagesPullSecretName (repo .GetName ())
692+ }
693+
694+ func isSecretKubeappsManaged (repo * apprepov1alpha1.AppRepository , secret * k8scorev1.Secret ) bool {
695+ if ! metav1 .IsControlledBy (secret , repo ) {
696+ return false
697+ }
698+ if managedby := secret .GetAnnotations ()[Annotation_ManagedBy_Key ]; managedby != Annotation_ManagedBy_Value {
699+ return false
700+ }
701+ return true
677702}
0 commit comments