-
Notifications
You must be signed in to change notification settings - Fork 2.7k
/
secretsync.go
92 lines (77 loc) · 2.32 KB
/
secretsync.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
// SPDX-License-Identifier: Apache-2.0
// Copyright Authors of Cilium
package ingress
import (
"context"
"github.com/sirupsen/logrus"
corev1 "k8s.io/api/core/v1"
networkingv1 "k8s.io/api/networking/v1"
"k8s.io/apimachinery/pkg/types"
"sigs.k8s.io/controller-runtime/pkg/client"
"sigs.k8s.io/controller-runtime/pkg/handler"
"sigs.k8s.io/controller-runtime/pkg/reconcile"
"github.com/cilium/cilium/pkg/logging/logfields"
)
func EnqueueReferencedTLSSecrets(c client.Client, logger logrus.FieldLogger) handler.EventHandler {
return handler.EnqueueRequestsFromMapFunc(func(ctx context.Context, obj client.Object) []reconcile.Request {
scopedLog := logger.WithFields(logrus.Fields{
logfields.Controller: "secrets",
logfields.Resource: obj.GetName(),
})
ing, ok := obj.(*networkingv1.Ingress)
if !ok {
return nil
}
// Check whether Ingress is managed by Cilium
if !isCiliumManagedIngress(ctx, c, logger, *ing) {
return nil
}
var reqs []reconcile.Request
for _, tls := range ing.Spec.TLS {
if len(tls.SecretName) == 0 {
continue
}
s := types.NamespacedName{
Namespace: ing.Namespace,
Name: tls.SecretName,
}
reqs = append(reqs, reconcile.Request{NamespacedName: s})
scopedLog.WithField("secret", s).Debug("Enqueued secret for Ingress")
}
return reqs
})
}
func enqueueAllSecrets(c client.Client) handler.EventHandler {
return handler.EnqueueRequestsFromMapFunc(func(ctx context.Context, _ client.Object) []reconcile.Request {
secretList := &corev1.SecretList{}
if err := c.List(ctx, secretList); err != nil {
return nil
}
requests := []reconcile.Request{}
for _, s := range secretList.Items {
requests = append(requests, reconcile.Request{
NamespacedName: types.NamespacedName{
Namespace: s.GetNamespace(),
Name: s.GetName(),
},
})
}
return requests
})
}
func IsReferencedByCiliumIngress(ctx context.Context, c client.Client, logger logrus.FieldLogger, obj *corev1.Secret) bool {
ingresses := networkingv1.IngressList{}
if err := c.List(ctx, &ingresses, client.InNamespace(obj.GetNamespace())); err != nil {
return false
}
for _, i := range ingresses.Items {
if isCiliumManagedIngress(ctx, c, logger, i) {
for _, t := range i.Spec.TLS {
if t.SecretName == obj.GetName() {
return true
}
}
}
}
return false
}