Bug 1896918: add new credentials field for AWS Secrets #264

joelddiaz · 2020-11-02T19:47:14Z

Start storing a usable AWS credentials config file in the 'credentials' field of the Secret. This should allow a consumer of the credentials to just point to the config stored in that field when setting up an AWS client.

Also make sure we are re-queuing CredentialsRequest objects every 1hr10min (so that we are at least periodically doing a full reconcile to restore any lost credentials).

joelddiaz · 2020-11-02T19:48:34Z

/assign @dgoodwin
/cc @sjenning

dgoodwin

Looking great just a few nits and questions.

dgoodwin · 2020-11-03T15:27:28Z

pkg/aws/actuator/actuator.go

+
+	// Make sure we update old Secrets that don't have the new "credentials" field
+	if credentialsKey == "" || credentialsKey != string(generateAWSCredentialsConfig(accessKey, secretKey)) {
+		logger.Debugf("Secret %s key needs updating, will update Secret contents", secretDataCredentialsKey)


Infof as I think this is low occurrence high value.

pkg/aws/actuator/actuator.go

dgoodwin · 2020-11-03T16:07:26Z

pkg/aws/actuator/actuator_test.go

+			require.NoError(t, err, "unexpected error creating/updating Secret")
+
+			secret := &corev1.Secret{}
+			secretKey := types.NamespacedName{Name: cr.Spec.SecretRef.Name, Namespace: cr.Spec.SecretRef.Namespace}


Suggest secretNSN or similar, key might be a little misleading here. I'm thinking Data[key] when I see that var.

dgoodwin · 2020-11-03T16:07:49Z

pkg/aws/actuator/actuator_test.go

+			err = fakeClient.Get(context.TODO(), secretKey, secret)
+			require.NoError(t, err, "unexpected error retriving Secret")
+
+			require.Contains(t, secret.Data, "credentials")


Can we be pedantic and also check the old keys are there as expected as well.

dgoodwin · 2020-11-03T16:09:05Z

pkg/operator/credentialsrequest/credentialsrequest_controller.go

@@ -71,6 +71,8 @@ const (
 	credentialsRequestInfraMismatch = "InfrastructureMismatch"
 )

+var defaultRequeueTime = time.Hour + time.Minute*10


An hour is conceptually easier to explain to people, is the 10 minute buying us anything? I could see a random jitter like we do in hive but really not a big concern for the scale CCO works at.

Also please add a comment on why we're doing a requeue instead of just waiting for events.

Since we explicitly don't re-reconcile more than once every hour, I was just thinking if there is a small difference between when the object is requeued and the lastSync values (where it requeues just before 1 hour so the lastSync is still less than 1 hour ago), then we could effectively slip out to reconciling to every 2 hours. Not a huge deal, but it is double the intended reconcile rate.

dgoodwin · 2020-11-03T18:10:20Z

Good to squash.

Start storing a usable AWS credentials config file in the 'credentials' field of the Secret. This should allow a consumer of the credentials to just point to the config stored in that field when setting up an AWS client. Also make sure we are re-queueing CredentialsRequest objects every 1hr10min (so that we are at least periodically doing a full reconcile to reestore any lost credentials).

sjenning · 2020-11-03T20:23:04Z

/test e2e-aws

sjenning · 2020-11-04T16:53:59Z

seems e2e-aws is failing because CCO clusteroperator is not reporting it's version

                "versions": [
                    {
                        "name": "operator",
                        "version": ""
                    }
                ]

even though the operator is Progressing=False and Available=True

dgoodwin · 2020-11-05T11:52:53Z

I think all e2e is broken because of https://bugzilla.redhat.com/show_bug.cgi?id=1891759. @akhil-rane is working on it over in #263, and I think they're actually going to be reverting the OpenShift change entirely, though that will take a little longer to make it to the build clusters.

sjenning · 2020-11-06T14:33:33Z

/retest

dgoodwin · 2020-11-10T11:44:32Z

/lgtm

openshift-ci-robot · 2020-11-10T11:44:51Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dgoodwin, joelddiaz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [dgoodwin,joelddiaz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-bot · 2020-11-10T13:18:26Z

/retest