Skip to content

Commit 4eed8d2

Browse files
tam7ttam7t
committed
feat: require RequiresRepublish for rotation
Remove the rotation controller and rely exclusively on RequiresRepublish for secret rotation. All supported k8s versions have RequiresRepublish support enabled by default. Resolves: kubernetes-sigs#585 The flags will be no-ops in this and removed in 1.5+.
1 parent 52df376 commit 4eed8d2

36 files changed

+25
-3034
lines changed

Diff for: ‎Makefile

+2-20
Original file line numberDiff line numberDiff line change
@@ -411,9 +411,9 @@ e2e-deploy-manifest:
411411
kubectl apply -f manifest_staging/deploy/role-secretproviderclasses-admin.yaml
412412
kubectl apply -f manifest_staging/deploy/role-secretproviderclasses-viewer.yaml
413413

414-
yq e '(.spec.template.spec.containers[1].image = "$(IMAGE_TAG)") | (.spec.template.spec.containers[1].args as $$x | $$x += "--enable-secret-rotation=true" | $$x[-1] style="double") | (.spec.template.spec.containers[1].args as $$x | $$x += "--rotation-poll-interval=30s" | $$x[-1] style="double")' 'manifest_staging/deploy/secrets-store-csi-driver.yaml' | kubectl apply -f -
414+
yq e '(.spec.template.spec.containers[1].image = "$(IMAGE_TAG)")' 'manifest_staging/deploy/secrets-store-csi-driver.yaml' | kubectl apply -f -
415415

416-
yq e '(.spec.template.spec.containers[1].args as $$x | $$x += "--enable-secret-rotation=true" | $$x[-1] style="double") | (.spec.template.spec.containers[1].args as $$x | $$x += "--rotation-poll-interval=30s" | $$x[-1] style="double")' 'manifest_staging/deploy/secrets-store-csi-driver-windows.yaml' | kubectl apply -f -
416+
yq e '' 'manifest_staging/deploy/secrets-store-csi-driver-windows.yaml' | kubectl apply -f -
417417

418418
.PHONY: e2e-helm-deploy
419419
e2e-helm-deploy:
@@ -430,8 +430,6 @@ e2e-helm-deploy:
430430
--set windows.enabled=true \
431431
--set linux.enabled=true \
432432
--set syncSecret.enabled=true \
433-
--set enableSecretRotation=true \
434-
--set rotationPollInterval=30s \
435433
--set tokenRequests[0].audience="aud1" \
436434
--set tokenRequests[1].audience="aud2"
437435

@@ -517,22 +515,6 @@ manifests: $(CONTROLLER_GEN) $(KUSTOMIZE)
517515
@sed -i '1s/^/{{ if .Values.syncSecret.enabled }}\n/gm; $$s/$$/\n{{ end }}/gm' manifest_staging/charts/secrets-store-csi-driver/templates/role-syncsecret.yaml
518516
@sed -i '1s/^/{{ if .Values.syncSecret.enabled }}\n/gm; s/namespace: .*/namespace: {{ .Release.Namespace }}/gm; $$s/$$/\n{{ end }}/gm' manifest_staging/charts/secrets-store-csi-driver/templates/role-syncsecret_binding.yaml
519517

520-
# Generate rotation specific RBAC
521-
$(CONTROLLER_GEN) rbac:roleName=secretproviderrotation-role paths="./pkg/rotation" output:dir=config/rbac-rotation
522-
$(KUSTOMIZE) build config/rbac-rotation -o manifest_staging/deploy/rbac-secretproviderrotation.yaml
523-
cp config/rbac-rotation/role.yaml manifest_staging/charts/secrets-store-csi-driver/templates/role-rotation.yaml
524-
cp config/rbac-rotation/role_binding.yaml manifest_staging/charts/secrets-store-csi-driver/templates/role-rotation_binding.yaml
525-
@sed -i '1s/^/{{ if .Values.enableSecretRotation }}\n/gm; $$s/$$/\n{{ end }}/gm' manifest_staging/charts/secrets-store-csi-driver/templates/role-rotation.yaml
526-
@sed -i '1s/^/{{ if .Values.enableSecretRotation }}\n/gm; s/namespace: .*/namespace: {{ .Release.Namespace }}/gm; $$s/$$/\n{{ end }}/gm' manifest_staging/charts/secrets-store-csi-driver/templates/role-rotation_binding.yaml
527-
528-
# Generate token requests specific RBAC
529-
$(CONTROLLER_GEN) rbac:roleName=secretprovidertokenrequest-role paths="./controllers/tokenrequest" output:dir=config/rbac-tokenrequest
530-
$(KUSTOMIZE) build config/rbac-tokenrequest -o manifest_staging/deploy/rbac-secretprovidertokenrequest.yaml
531-
cp config/rbac-tokenrequest/role.yaml manifest_staging/charts/secrets-store-csi-driver/templates/role-tokenrequest.yaml
532-
cp config/rbac-tokenrequest/role_binding.yaml manifest_staging/charts/secrets-store-csi-driver/templates/role-tokenrequest_binding.yaml
533-
@sed -i '1s/^/{{ if .Values.tokenRequests }}\n/gm; $$s/$$/\n{{ end }}/gm' manifest_staging/charts/secrets-store-csi-driver/templates/role-tokenrequest.yaml
534-
@sed -i '1s/^/{{ if .Values.tokenRequests }}\n/gm; s/namespace: .*/namespace: {{ .Release.Namespace }}/gm; $$s/$$/\n{{ end }}/gm' manifest_staging/charts/secrets-store-csi-driver/templates/role-tokenrequest_binding.yaml
535-
536518
.PHONY: generate-protobuf
537519
generate-protobuf: $(PROTOC) $(PROTOC_GEN_GO) $(PROTOC_GEN_GO_GRPC) # generates protobuf
538520
@PATH=$(PATH):$(TOOLS_BIN_DIR) $(PROTOC) -I . provider/v1alpha1/service.proto --go-grpc_out=require_unimplemented_servers=false:. --go_out=.

Diff for: ‎cmd/secrets-store-csi-driver/main.go

+8-27
Original file line numberDiff line numberDiff line change
@@ -28,9 +28,7 @@ import (
2828

2929
secretsstorev1 "sigs.k8s.io/secrets-store-csi-driver/apis/v1"
3030
"sigs.k8s.io/secrets-store-csi-driver/controllers"
31-
"sigs.k8s.io/secrets-store-csi-driver/pkg/k8s"
3231
"sigs.k8s.io/secrets-store-csi-driver/pkg/metrics"
33-
"sigs.k8s.io/secrets-store-csi-driver/pkg/rotation"
3432
secretsstore "sigs.k8s.io/secrets-store-csi-driver/pkg/secrets-store"
3533
"sigs.k8s.io/secrets-store-csi-driver/pkg/version"
3634

@@ -40,7 +38,6 @@ import (
4038
"k8s.io/apimachinery/pkg/fields"
4139
"k8s.io/apimachinery/pkg/labels"
4240
"k8s.io/apimachinery/pkg/runtime"
43-
"k8s.io/client-go/kubernetes"
4441
clientgoscheme "k8s.io/client-go/kubernetes/scheme"
4542
"k8s.io/client-go/rest"
4643
logsapi "k8s.io/component-base/logs/api/v1"
@@ -62,11 +59,12 @@ var (
6259
// https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/823.
6360
additionalProviderPaths = flag.String("additional-provider-volume-paths", "/etc/kubernetes/secrets-store-csi-providers", "Comma separated list of additional paths to communicate with providers")
6461
metricsAddr = flag.String("metrics-addr", ":8095", "The address the metric endpoint binds to")
65-
enableSecretRotation = flag.Bool("enable-secret-rotation", false, "Enable secret rotation feature [alpha]")
66-
rotationPollInterval = flag.Duration("rotation-poll-interval", 2*time.Minute, "Secret rotation poll interval duration")
67-
enableProfile = flag.Bool("enable-pprof", false, "enable pprof profiling")
68-
profilePort = flag.Int("pprof-port", 6065, "port for pprof profiling")
69-
maxCallRecvMsgSize = flag.Int("max-call-recv-msg-size", 1024*1024*4, "maximum size in bytes of gRPC response from plugins")
62+
// TODO: remove these flags in 1.5.
63+
enableSecretRotation = flag.Bool("enable-secret-rotation", false, "Enable secret rotation feature [deprecated]")
64+
_ = flag.Duration("rotation-poll-interval", 2*time.Minute, "Secret rotation poll interval duration [deprecated]")
65+
enableProfile = flag.Bool("enable-pprof", false, "enable pprof profiling")
66+
profilePort = flag.Int("pprof-port", 6065, "port for pprof profiling")
67+
maxCallRecvMsgSize = flag.Int("max-call-recv-msg-size", 1024*1024*4, "maximum size in bytes of gRPC response from plugins")
7068

7169
// Enable optional healthcheck for provider clients that exist in memory
7270
providerHealthCheck = flag.Bool("provider-health-check", false, "Enable health check for configured providers")
@@ -190,29 +188,12 @@ func main() {
190188
reconciler.RunPatcher(ctx)
191189
}()
192190

193-
// token request client
194-
kubeClient := kubernetes.NewForConfigOrDie(cfg)
195-
tokenClient := k8s.NewTokenClient(kubeClient, *driverName, 10*time.Minute)
196-
if err != nil {
197-
klog.ErrorS(err, "failed to create token client")
198-
os.Exit(1)
199-
}
200-
if err = tokenClient.Run(ctx.Done()); err != nil {
201-
klog.ErrorS(err, "failed to run token client")
202-
os.Exit(1)
203-
}
204-
205191
// Secret rotation
206192
if *enableSecretRotation {
207-
rec, err := rotation.NewReconciler(mgr.GetCache(), scheme, *providerVolumePath, *nodeID, *rotationPollInterval, providerClients, tokenClient)
208-
if err != nil {
209-
klog.ErrorS(err, "failed to initialize rotation reconciler")
210-
os.Exit(1)
211-
}
212-
go rec.Run(ctx.Done())
193+
klog.Warning("--enable-secret-rotation and --rotation-poll-interval are deprecated, use RequiresRepublish instead.")
213194
}
214195

215-
driver := secretsstore.NewSecretsStoreDriver(*driverName, *nodeID, *endpoint, *providerVolumePath, providerClients, mgr.GetClient(), mgr.GetAPIReader(), tokenClient)
196+
driver := secretsstore.NewSecretsStoreDriver(*driverName, *nodeID, *endpoint, *providerVolumePath, providerClients, mgr.GetClient(), mgr.GetAPIReader())
216197
driver.Run(ctx)
217198
}
218199

Diff for: ‎config/crd/bases/secrets-store.csi.x-k8s.io_secretproviderclasses.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
33
kind: CustomResourceDefinition
44
metadata:
55
annotations:
6-
controller-gen.kubebuilder.io/version: v0.9.0
6+
controller-gen.kubebuilder.io/version: v0.10.0
77
creationTimestamp: null
88
name: secretproviderclasses.secrets-store.csi.x-k8s.io
99
spec:

Diff for: ‎config/crd/bases/secrets-store.csi.x-k8s.io_secretproviderclasspodstatuses.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
33
kind: CustomResourceDefinition
44
metadata:
55
annotations:
6-
controller-gen.kubebuilder.io/version: v0.9.0
6+
controller-gen.kubebuilder.io/version: v0.10.0
77
creationTimestamp: null
88
name: secretproviderclasspodstatuses.secrets-store.csi.x-k8s.io
99
spec:

Diff for: ‎controllers/tokenrequest/tokenrequest.go

-22
This file was deleted.

Diff for: ‎docs/book/src/topics/command-reference.md

-2
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,6 @@ The `secrets-store` container in the DaemonSet can be configured using the follo
1515
| `--provider-volume` | Volume path for provider | `/etc/kubernetes/secrets-store-csi-providers` |
1616
| `--additional-provider-volume-paths` | Comma separated list of additional paths to communicate with providers | `/var/run/secrets-store-csi-providers` |
1717
| `--metrics-addr` | The address the metric endpoint binds to | `:8095` |
18-
| `--enable-secret-rotation` | Enable secret rotation feature [alpha] | `false` |
19-
| `--rotation-poll-interval` | Secret rotation poll interval duration | `2m` |
2018
| `--enable-pprof` | Enable pprof profiling | `false` |
2119
| `--pprof-port` | Port for pprof profiling | `6065` |
2220
| `--max-call-recv-msg-size` | Maximum size in bytes of gRPC response from plugins | `4194304` |

Diff for: ‎manifest_staging/charts/secrets-store-csi-driver/crds/secrets-store.csi.x-k8s.io_secretproviderclasses.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
33
kind: CustomResourceDefinition
44
metadata:
55
annotations:
6-
controller-gen.kubebuilder.io/version: v0.9.0
6+
controller-gen.kubebuilder.io/version: v0.10.0
77
creationTimestamp: null
88
name: secretproviderclasses.secrets-store.csi.x-k8s.io
99
spec:

Diff for: ‎manifest_staging/charts/secrets-store-csi-driver/crds/secrets-store.csi.x-k8s.io_secretproviderclasspodstatuses.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
33
kind: CustomResourceDefinition
44
metadata:
55
annotations:
6-
controller-gen.kubebuilder.io/version: v0.9.0
6+
controller-gen.kubebuilder.io/version: v0.10.0
77
creationTimestamp: null
88
name: secretproviderclasspodstatuses.secrets-store.csi.x-k8s.io
99
spec:

Diff for: ‎manifest_staging/charts/secrets-store-csi-driver/templates/role-rotation.yaml

-19
This file was deleted.

Diff for: ‎manifest_staging/charts/secrets-store-csi-driver/templates/role-rotation_binding.yaml

-16
This file was deleted.

Diff for: ‎manifest_staging/charts/secrets-store-csi-driver/templates/role-syncsecret.yaml

-2
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,6 @@ kind: ClusterRole
55
metadata:
66
creationTimestamp: null
77
name: secretprovidersyncing-role
8-
labels:
9-
{{ include "sscd.labels" . | indent 4 }}
108
rules:
119
- apiGroups:
1210
- ""

Diff for: ‎manifest_staging/charts/secrets-store-csi-driver/templates/role-syncsecret_binding.yaml

-2
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,6 @@ apiVersion: rbac.authorization.k8s.io/v1
33
kind: ClusterRoleBinding
44
metadata:
55
name: secretprovidersyncing-rolebinding
6-
labels:
7-
{{ include "sscd.labels" . | indent 4 }}
86
roleRef:
97
apiGroup: rbac.authorization.k8s.io
108
kind: ClusterRole

Diff for: ‎manifest_staging/charts/secrets-store-csi-driver/templates/role-tokenrequest.yaml

-17
This file was deleted.

Diff for: ‎manifest_staging/charts/secrets-store-csi-driver/templates/role-tokenrequest_binding.yaml

-16
This file was deleted.

Diff for: ‎manifest_staging/charts/secrets-store-csi-driver/templates/role.yaml

+1-3
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,6 @@ kind: ClusterRole
55
metadata:
66
creationTimestamp: null
77
name: secretproviderclasses-role
8-
labels:
9-
{{ include "sscd.labels" . | indent 4 }}
108
rules:
119
- apiGroups:
1210
- ""
@@ -61,7 +59,7 @@ rules:
6159
- get
6260
- list
6361
- watch
64-
{{- if and .Values.rbac.pspEnabled (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") }}
62+
{{- if .Values.rbac.pspEnabled }}
6563
- apiGroups:
6664
- policy
6765
resources:

Diff for: ‎manifest_staging/charts/secrets-store-csi-driver/templates/role_binding.yaml

-2
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,6 @@ apiVersion: rbac.authorization.k8s.io/v1
33
kind: ClusterRoleBinding
44
metadata:
55
name: secretproviderclasses-rolebinding
6-
labels:
7-
{{ include "sscd.labels" . | indent 4 }}
86
roleRef:
97
apiGroup: rbac.authorization.k8s.io
108
kind: ClusterRole

Diff for: ‎manifest_staging/charts/secrets-store-csi-driver/templates/secrets-store-csi-driver-windows.yaml

-6
Original file line numberDiff line numberDiff line change
@@ -74,12 +74,6 @@ spec:
7474
- "--nodeid=$(KUBE_NODE_NAME)"
7575
- "--provider-volume={{ .Values.windows.providersDir }}"
7676
- "--additional-provider-volume-paths={{ join "," .Values.windows.additionalProvidersDirs }}"
77-
{{- if and (semverCompare ">= v0.0.15-0" .Values.windows.image.tag) .Values.enableSecretRotation }}
78-
- "--enable-secret-rotation={{ .Values.enableSecretRotation }}"
79-
{{- end }}
80-
{{- if and (semverCompare ">= v0.0.15-0" .Values.windows.image.tag) .Values.rotationPollInterval }}
81-
- "--rotation-poll-interval={{ .Values.rotationPollInterval }}"
82-
{{- end }}
8377
- "--metrics-addr={{ .Values.windows.metricsAddr }}"
8478
{{- if and (semverCompare ">= v0.0.22-0" .Values.windows.image.tag) .Values.providerHealthCheck }}
8579
- "--provider-health-check={{ .Values.providerHealthCheck }}"

Diff for: ‎manifest_staging/charts/secrets-store-csi-driver/templates/secrets-store-csi-driver.yaml

-6
Original file line numberDiff line numberDiff line change
@@ -74,12 +74,6 @@ spec:
7474
- "--nodeid=$(KUBE_NODE_NAME)"
7575
- "--provider-volume={{ .Values.linux.providersDir }}"
7676
- "--additional-provider-volume-paths={{ join "," .Values.linux.additionalProvidersDirs }}"
77-
{{- if and (semverCompare ">= v0.0.15-0" .Values.linux.image.tag) .Values.enableSecretRotation }}
78-
- "--enable-secret-rotation={{ .Values.enableSecretRotation }}"
79-
{{- end }}
80-
{{- if and (semverCompare ">= v0.0.15-0" .Values.linux.image.tag) .Values.rotationPollInterval }}
81-
- "--rotation-poll-interval={{ .Values.rotationPollInterval }}"
82-
{{- end }}
8377
- "--metrics-addr={{ .Values.linux.metricsAddr }}"
8478
{{- if and (semverCompare ">= v0.0.22-0" .Values.linux.image.tag) .Values.providerHealthCheck }}
8579
- "--provider-health-check={{ .Values.providerHealthCheck }}"

Diff for: ‎manifest_staging/charts/secrets-store-csi-driver/templates/serviceaccount.yaml

+1-2
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,5 @@ kind: ServiceAccount
44
metadata:
55
name: secrets-store-csi-driver
66
namespace: {{ .Release.Namespace }}
7-
labels:
8-
{{ include "sscd.labels" . | indent 4 }}
7+
{{ include "sscd.labels" . | indent 2 }}
98
{{ end }}

Diff for: ‎manifest_staging/deploy/secrets-store-csi-driver.yaml

-2
Original file line numberDiff line numberDiff line change
@@ -51,8 +51,6 @@ spec:
5151
- "--provider-volume=/var/run/secrets-store-csi-providers"
5252
- "--additional-provider-volume-paths=/etc/kubernetes/secrets-store-csi-providers"
5353
- "--metrics-addr=:8095"
54-
- "--enable-secret-rotation=false"
55-
- "--rotation-poll-interval=2m"
5654
- "--provider-health-check=false"
5755
- "--provider-health-check-interval=2m"
5856
env:

Diff for: ‎manifest_staging/deploy/secrets-store.csi.x-k8s.io_secretproviderclasses.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
33
kind: CustomResourceDefinition
44
metadata:
55
annotations:
6-
controller-gen.kubebuilder.io/version: v0.9.0
6+
controller-gen.kubebuilder.io/version: v0.10.0
77
creationTimestamp: null
88
name: secretproviderclasses.secrets-store.csi.x-k8s.io
99
spec:

Diff for: ‎manifest_staging/deploy/secrets-store.csi.x-k8s.io_secretproviderclasspodstatuses.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
33
kind: CustomResourceDefinition
44
metadata:
55
annotations:
6-
controller-gen.kubebuilder.io/version: v0.9.0
6+
controller-gen.kubebuilder.io/version: v0.10.0
77
creationTimestamp: null
88
name: secretproviderclasspodstatuses.secrets-store.csi.x-k8s.io
99
spec:

0 commit comments

Comments
 (0)