Explicitly set the secret credential data on sync.

The behavior previously changed to patching the credential secrets as
opposed to updating them. As a result, sometimes when a credential is
changed it can continue to have pieces of the old credential.

This change overrides the entire credential data to be explicitly set to
the new credential. This will remove all old credential data when
syncing the new credential.

pkg/aws/actuator/actuator.go

@@ -1025,9 +1025,8 @@ func (a *AWSActuator) syncAccessKeySecret(ctx context.Context, cr *minterv1.Cred
 		secret.Annotations[minterv1.AnnotationCredentialsRequest] = fmt.Sprintf("%s/%s", cr.Namespace, cr.Name)
 		secret.Annotations[minterv1.AnnotationAWSPolicyLastApplied] = userPolicy
 
-		if secret.Data == nil {
-			secret.Data = map[string][]byte{}
-		}
+		secret.Data = map[string][]byte{}
+
 		// either we know the access key ID and secret access key, or we get them from the secret itself
 		for identifier, into := range map[string]*string{
 			secretDataAccessKey: &accessKeyID,

pkg/azure/actuator.go

@@ -391,9 +391,9 @@ func (a *Actuator) syncCredentialSecrets(ctx context.Context, cr *minterv1.Crede
 			secret.Annotations = map[string]string{}
 		}
 		secret.Annotations[minterv1.AnnotationCredentialsRequest] = fmt.Sprintf("%s/%s", cr.Namespace, cr.Name)
-		if secret.Data == nil {
-			secret.Data = map[string][]byte{}
-		}
+
+		secret.Data = map[string][]byte{}
+
 		secret.Data[AzureClientID] = cloudCredsSecret.Data[AzureClientID]
 		secret.Data[AzureClientSecret] = cloudCredsSecret.Data[AzureClientSecret]
 		secret.Data[AzureRegion] = cloudCredsSecret.Data[AzureRegion]

pkg/gcp/actuator/actuator.go

@@ -784,9 +784,9 @@ func (a *Actuator) syncSecret(ctx context.Context, cr *minterv1.CredentialsReque
 			secret.Annotations = map[string]string{}
 		}
 		secret.Annotations[minterv1.AnnotationCredentialsRequest] = fmt.Sprintf("%s/%s", cr.Namespace, cr.Name)
-		if secret.Data == nil {
-			secret.Data = map[string][]byte{}
-		}
+
+		secret.Data = map[string][]byte{}
+
 		secret.Data[gcpSecretJSONKey] = privateKeyData
 		return nil
 	})

pkg/kubevirt/actuator.go

@@ -185,9 +185,6 @@ func (a *KubevirtActuator) syncCredentialSecret(ctx context.Context, cr *minterv
 		}
 		secret.Annotations[minterv1.AnnotationCredentialsRequest] = fmt.Sprintf("%s/%s", cr.Namespace, cr.Name)
 		if kubevirtCredentialData != nil {
-			if secret.Data == nil {
-				secret.Data = map[string][]byte{}
-			}
 			secret.Data = map[string][]byte{
 				KubevirtCredentialsSecretKey: *kubevirtCredentialData,
 			}

pkg/openstack/actuator.go

@@ -139,9 +139,7 @@ func (a *OpenStackActuator) syncCredentialSecret(ctx context.Context, cr *minter
 		}
 		secret.Annotations[minterv1.AnnotationCredentialsRequest] = fmt.Sprintf("%s/%s", cr.Namespace, cr.Name)
 		if clouds != "" {
-			if secret.Data == nil {
-				secret.Data = map[string][]byte{}
-			}
+			secret.Data = map[string][]byte{}
 			secret.Data[RootOpenStackCredsSecretKey] = []byte(clouds)
 		}
 		return nil

pkg/ovirt/actuator.go

@@ -156,9 +156,9 @@ func (a *OvirtActuator) syncCredentialSecret(ctx context.Context, cr *minterv1.C
 			secret.Annotations = map[string]string{}
 		}
 		secret.Annotations[minterv1.AnnotationCredentialsRequest] = fmt.Sprintf("%s/%s", cr.Namespace, cr.Name)
-		if secret.Data == nil {
-			secret.Data = map[string][]byte{}
-		}
+
+		secret.Data = map[string][]byte{}
+
 		for key, value := range secretDataFrom(ovirtCreds) {
 			secret.Data[key] = value
 		}

pkg/vsphere/actuator/actuator.go

@@ -294,9 +294,9 @@ func (a *VSphereActuator) syncTargetSecret(ctx context.Context, cr *minterv1.Cre
 			secret.Annotations = map[string]string{}
 		}
 		secret.Annotations[minterv1.AnnotationCredentialsRequest] = fmt.Sprintf("%s/%s", cr.Namespace, cr.Name)
-		if secret.Data == nil {
-			secret.Data = map[string][]byte{}
-		}
+
+		secret.Data = map[string][]byte{}
+
 		for key, value := range secretData {
 			secret.Data[key] = value
 		}