trigger the RoleReconciler if the referenced secret changes

Author: ThoSap

README.md

@@ -94,7 +94,7 @@ If you want to learn more about building native executables, please consult <htt
 ## Related Guides
 
 - Operator SDK ([guide](https://docs.quarkiverse.io/quarkus-operator-sdk/dev/index.html)): Quarkus extension for the Java Operator SDK (https://javaoperatorsdk.io)
-- Helm ([guide](https://docs.quarkiverse.io/quarkus-helm/dev/index.html)): Quarkus extension for Kubernetes Helm chars
+- Helm ([guide](https://docs.quarkiverse.io/quarkus-helm/dev/index.html)): Quarkus extension for Kubernetes Helm charts
 - SmallRye Health ([guide](https://quarkus.io/guides/smallrye-health)): Monitor service health
 - Micrometer metrics ([guide](https://quarkus.io/guides/micrometer)): Instrument the runtime and your application with dimensional metrics using Micrometer.
 - YAML Configuration ([guide](https://quarkus.io/guides/config-yaml)): Use YAML to configure your Quarkus application

build.gradle.kts

@@ -87,6 +87,7 @@ dependencies {
      * Testing
      */
     testImplementation("io.quarkus:quarkus-junit5")
+    testImplementation("org.awaitility:awaitility")
     testImplementation(libs.assertj)
     testImplementation(libs.datafaker)
 }

src/main/java/it/aboutbits/postgresql/core/BaseReconciler.java

@@ -40,21 +40,23 @@ public S initializeStatus(CR resource) {
     }
 
     public String getResourceNamespaceOrOwn(
+            CR resource,
             @Nullable String resourceNamespace
     ) {
         if (resourceNamespace != null) {
             return resourceNamespace;
         }
 
-        return ((HasMetadata) this).getMetadata().getNamespace();
+        return resource.getMetadata().getNamespace();
     }
 
     public Optional<ClusterConnection> getReferencedClusterConnection(
             KubernetesClient kubernetesClient,
+            CR resource,
             ClusterReference clusterRef
     ) {
         var connectionName = clusterRef.getName();
-        var connectionNamespace = getResourceNamespaceOrOwn(clusterRef.getNamespace());
+        var connectionNamespace = getResourceNamespaceOrOwn(resource, clusterRef.getNamespace());
 
         var clusterConnection = kubernetesClient.resources(ClusterConnection.class)
                 .inNamespace(connectionNamespace)

src/main/java/it/aboutbits/postgresql/core/CRStatus.java

@@ -13,15 +13,15 @@
 /**
  * Status Object for the Custom Resources.
  * <p>
- * This object captures the current state of a bucket as observed by the reconciler.
+ * This object captures the current state of a Custom Resource as observed by the reconciler.
  */
 @NullMarked
 @Getter
 @Setter
 @Accessors(chain = true)
 public class CRStatus {
     /**
-     * The actual bucket name in MinIO (may differ from metadata.name).
+     * The Custom Resource name (may differ from metadata.name).
      */
     @Nullable
     private String name = null;

src/main/java/it/aboutbits/postgresql/core/ClusterReference.java

@@ -1,9 +1,7 @@
 package it.aboutbits.postgresql.core;
 
 import io.fabric8.generator.annotation.Required;
-import lombok.AllArgsConstructor;
 import lombok.Getter;
-import lombok.NoArgsConstructor;
 import lombok.Setter;
 import org.jspecify.annotations.NullMarked;
 import org.jspecify.annotations.Nullable;

src/main/java/it/aboutbits/postgresql/core/KubernetesUtil.java

@@ -18,34 +18,38 @@ public static Credentials getSecretRefCredentials(
             KubernetesClient kubernetesClient,
             ClusterConnection clusterConnection
     ) {
-        var spec = clusterConnection.getSpec();
-        var metadata = clusterConnection.getMetadata();
+        return getSecretRefCredentials(
+                kubernetesClient,
+                clusterConnection.getSpec().getAdminSecretRef(),
+                clusterConnection.getMetadata().getNamespace()
+        );
+    }
 
-        var passwordSecretRef = spec.getAdminSecretRef();
+    public static Credentials getSecretRefCredentials(
+            KubernetesClient kubernetesClient,
+            SecretRef secretRef,
+            String defaultNamespace
+    ) {
+        var secretNamespace = secretRef.getNamespace() != null
+                ? secretRef.getNamespace()
+                : defaultNamespace;
 
-        var secretNamespace = passwordSecretRef.getNamespace() != null
-                ? passwordSecretRef.getNamespace()
-                : clusterConnection.getMetadata().getNamespace();
-        var secretName = passwordSecretRef.getName();
+        var secretName = secretRef.getName();
 
         var secret = kubernetesClient.secrets()
                 .inNamespace(secretNamespace)
                 .withName(secretName)
                 .get();
 
         if (secret == null) {
-            throw new IllegalStateException("ClusterConnection SecretRef not found [clusterConnection.namespace=%s, clusterConnection.name=%s, secret.namespace=%s, secret.name=%s]".formatted(
-                    metadata.getNamespace(),
-                    metadata.getName(),
+            throw new IllegalStateException("SecretRef not found [secret.namespace=%s, secret.name=%s]".formatted(
                     secretNamespace,
                     secretName
             ));
         }
 
         if (!secret.getType().equals(SECRET_TYPE_BASIC_AUTH)) {
-            throw new IllegalArgumentException("The ClusterConnection SecretRef is of the wrong type [clusterConnection.namespace=%s, clusterConnection.name=%s, secret.namespace=%s, secret.name=%s, expected.secret.type=%s, actual.secret.type=%s]".formatted(
-                    metadata.getNamespace(),
-                    metadata.getName(),
+            throw new IllegalArgumentException("The SecretRef is of the wrong type [secret.namespace=%s, secret.name=%s, expected.secret.type=%s, actual.secret.type=%s]".formatted(
                     secretNamespace,
                     secretName,
                     SECRET_TYPE_BASIC_AUTH,
@@ -55,9 +59,7 @@ public static Credentials getSecretRefCredentials(
 
         var data = secret.getData();
         if (data == null || data.isEmpty()) {
-            throw new IllegalStateException("The ClusterConnection SecretRef has no data set [clusterConnection.namespace=%s, clusterConnection.name=%s, secret.namespace=%s, secret.name=%s]".formatted(
-                    metadata.getNamespace(),
-                    metadata.getName(),
+            throw new IllegalStateException("The SecretRef has no data set [secret.namespace=%s, secret.name=%s]".formatted(
                     secretNamespace,
                     secretName
             ));
@@ -72,9 +74,7 @@ public static Credentials getSecretRefCredentials(
 
         var passwordBase64 = data.get(SECRET_DATA_BASIC_AUTH_PASSWORD_KEY);
         if (passwordBase64 == null) {
-            throw new IllegalStateException("The ClusterConnection SecretRef is missing required data password [clusterConnection.namespace=%s, clusterConnection.name=%s, secret.namespace=%s, secret.name=%s]".formatted(
-                    metadata.getNamespace(),
-                    metadata.getName(),
+            throw new IllegalStateException("The SecretRef is missing required data password [secret.namespace=%s, secret.name=%s]".formatted(
                     secretNamespace,
                     secretName
             ));

src/main/java/it/aboutbits/postgresql/core/SecretRef.java

@@ -1,9 +1,7 @@
 package it.aboutbits.postgresql.core;
 
 import io.fabric8.generator.annotation.Required;
-import lombok.AllArgsConstructor;
 import lombok.Getter;
-import lombok.NoArgsConstructor;
 import lombok.Setter;
 import org.jspecify.annotations.NullMarked;
 import org.jspecify.annotations.Nullable;
@@ -15,6 +13,10 @@ public class SecretRef {
     @Required
     private String name;
 
+    /**
+     * The namespace where the Secret is located.
+     * If it is null, it means the Secret is in the same namespace as the resource referencing it.
+     */
     @Nullable
     @io.fabric8.generator.annotation.Nullable
     private String namespace;

src/main/java/it/aboutbits/postgresql/crd/role/RoleReconciler.java

@@ -1,9 +1,16 @@
 package it.aboutbits.postgresql.crd.role;
 
+import io.fabric8.kubernetes.api.model.Secret;
 import io.fabric8.kubernetes.client.KubernetesClient;
+import io.javaoperatorsdk.operator.api.config.informer.InformerEventSourceConfiguration;
 import io.javaoperatorsdk.operator.api.reconciler.Context;
+import io.javaoperatorsdk.operator.api.reconciler.EventSourceContext;
 import io.javaoperatorsdk.operator.api.reconciler.Reconciler;
 import io.javaoperatorsdk.operator.api.reconciler.UpdateControl;
+import io.javaoperatorsdk.operator.processing.event.ResourceID;
+import io.javaoperatorsdk.operator.processing.event.source.EventSource;
+import io.javaoperatorsdk.operator.processing.event.source.SecondaryToPrimaryMapper;
+import io.javaoperatorsdk.operator.processing.event.source.informer.InformerEventSource;
 import it.aboutbits.postgresql.core.BaseReconciler;
 import it.aboutbits.postgresql.core.CRPhase;
 import it.aboutbits.postgresql.core.CRStatus;
@@ -14,7 +21,9 @@
 import org.jspecify.annotations.NonNull;
 
 import java.sql.SQLException;
+import java.util.List;
 import java.util.concurrent.TimeUnit;
+import java.util.stream.Collectors;
 
 @RequiredArgsConstructor
 public class RoleReconciler
@@ -36,13 +45,14 @@ public UpdateControl<Role> reconcile(
 
         var clusterConnectionOptional = getReferencedClusterConnection(
                 kubernetesClient,
+                resource,
                 clusterRef
         );
 
         if (clusterConnectionOptional.isEmpty()) {
             status.setPhase(CRPhase.PENDING)
                     .setMessage("The specified ClusterConnection does not exist or is not ready yet [clusterRef=%s/%s]".formatted(
-                            getResourceNamespaceOrOwn(clusterRef.getNamespace()),
+                            getResourceNamespaceOrOwn(resource, clusterRef.getNamespace()),
                             clusterRef.getName()
                     ));
 
@@ -56,13 +66,15 @@ public UpdateControl<Role> reconcile(
         expectedFlags.getRole().sort(String.CASE_INSENSITIVE_ORDER);
         expectedFlags.getInRole().sort(String.CASE_INSENSITIVE_ORDER);
 
-        var loginExpected = spec.getPasswordSecretRef() != null;
+        var passwordSecretRef = spec.getPasswordSecretRef();
+        var loginExpected = passwordSecretRef != null;
 
         String password;
         if (loginExpected) {
             password = KubernetesUtil.getSecretRefCredentials(
                     kubernetesClient,
-                    clusterConnection
+                    passwordSecretRef,
+                    resource.getMetadata().getNamespace()
             ).password();
         } else {
             password = null;
@@ -139,8 +151,59 @@ public UpdateControl<Role> reconcile(
         return updateControl;
     }
 
+    @Override
+    public List<EventSource<?, Role>> prepareEventSources(EventSourceContext<Role> context) {
+        // 1. Define the Mapper
+        // We define how to find the Primary Resource (Role) when a Secret changes
+        SecondaryToPrimaryMapper<Secret> secretToRoleMapper = (Secret secret) -> {
+            // 2. Filter Roles that reference this specific Secret
+            return context.getPrimaryCache()
+                    .list()
+                    .filter(role -> isReferencedBy(role, secret))
+                    .map(ResourceID::fromResource)
+                    .collect(Collectors.toSet());
+        };
+
+        // 2. Build the Event Source Configuration which binds the InformerConfig + Mapper
+        var eventSourceConfig = InformerEventSourceConfiguration.from(Secret.class, Role.class)
+                .withSecondaryToPrimaryMapper(secretToRoleMapper)
+                // or .withWatchAllNamespaces() if we want to have the secret in another namespace than the Role CR instance
+                .withNamespacesInheritedFromController()
+                .build();
+
+        // 3. Create the Event Source
+        // This will watch for Secret changes and run the mapper
+        var secretEventSource = new InformerEventSource<>(
+                eventSourceConfig,
+                context
+        );
+
+        return List.of(secretEventSource);
+    }
+
     @Override
     protected @NonNull CRStatus newStatus() {
         return new CRStatus();
     }
+
+    /**
+     * Checks if the given Role's spec.passwordSecretRef points to the changed Secret.
+     */
+    private boolean isReferencedBy(
+            Role role,
+            Secret secret
+    ) {
+        var spec = role.getSpec();
+
+        if (spec.getPasswordSecretRef() == null) {
+            return false;
+        }
+
+        var ref = spec.getPasswordSecretRef();
+        var refName = ref.getName();
+        var refNamespace = getResourceNamespaceOrOwn(role, ref.getNamespace());
+
+        return refName.equals(secret.getMetadata().getName()) &&
+                refNamespace.equals(secret.getMetadata().getNamespace());
+    }
 }

src/test/java/it/aboutbits/postgresql/_support/testdata/base/TestDataCreator.java

@@ -51,7 +51,7 @@ public static String randomKubernetesNameSuffix(String name) {
 
         if (name.length() > 60) {
             throw new IllegalArgumentException(
-                    "The name is too long (must be <= 60 to allow '-' + at least 2 random chars, max %d total) [name=%s, lenght=%d]".formatted(
+                    "The name is too long (must be <= 60 to allow '-' + at least 2 random chars, max %d total) [name=%s, length=%d]".formatted(
                             maxLength,
                             name,
                             name.length()

src/test/java/it/aboutbits/postgresql/_support/testdata/persisted/Given.java

@@ -65,8 +65,7 @@ public Item describedAs(String description) {
         public SecretRefCreate secretRef() {
             return new SecretRefCreate(
                     numberOfItems,
-                    kubernetesClient,
-                    dbConnectionDetails()
+                    kubernetesClient
             );
         }