Skip to content
This repository has been archived by the owner on Jul 12, 2023. It is now read-only.

Commit

Permalink
minor fixes to be less confusing
Browse files Browse the repository at this point in the history
  • Loading branch information
honnix committed May 4, 2017
1 parent 16001e8 commit 6ead180
Showing 1 changed file with 6 additions and 8 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -101,7 +101,7 @@ class KubernetesDockerRunner implements DockerRunner {
static final String TRIGGER_TYPE = "STYX_TRIGGER_TYPE";
private static final int DEFAULT_POLL_PODS_INTERVAL_SECONDS = 60;
static final String STYX_WORKFLOW_SA_ENV_VARIABLE = "GOOGLE_APPLICATION_CREDENTIALS";
private static final String STYX_WORKFLOW_SA_SECRET_ANNOTATION = "styx-wf-sa";
private static final String STYX_WORKFLOW_SA_ID_ANNOTATION = "styx-wf-sa";
private static final String STYX_WORKFLOW_SA_JSON_KEY_NAME_ANNOTATION = "styx-wf-sa-json-key-name";
private static final String STYX_WORKFLOW_SA_P12_KEY_NAME_ANNOTATION = "styx-wf-sa-p12-key-name";
static final String STYX_WORKFLOW_SA_SECRET_NAME = "styx-wf-sa-keys";
Expand Down Expand Up @@ -206,21 +206,20 @@ private void ensureServiceAccountKeySecret(WorkflowInstance workflowInstance, Ru

final String secretName = buildSecretName(serviceAccount);

LOG.info("[AUDIT] Workflow {} refers to secret {} of {}", workflowInstance.workflowId(), secretName,
serviceAccount);
LOG.info("[AUDIT] Workflow {} refers to secret {} storing keys of {}",
workflowInstance.workflowId(), secretName, serviceAccount);

// TODO: shard locking to regain concurrency
synchronized (secretMutationLock) {

// Check if we have a valid service account key secret already
final Secret existingSecret = client.secrets().withName(secretName).get();
if (existingSecret != null) {

if (serviceAccountKeysExist(existingSecret)) {
return;
}

LOG.warn("[AUDIT] Service account keys have been deleted for {}, recreating",
LOG.info("[AUDIT] Service account keys have been deleted for {}, recreating",
serviceAccount);

// Need to delete this secret before creating a new one
Expand All @@ -246,7 +245,7 @@ private void ensureServiceAccountKeySecret(WorkflowInstance workflowInstance, Ru
final Map<String, String> annotations = ImmutableMap.of(
STYX_WORKFLOW_SA_JSON_KEY_NAME_ANNOTATION, jsonKey.getName(),
STYX_WORKFLOW_SA_P12_KEY_NAME_ANNOTATION, p12Key.getName(),
STYX_WORKFLOW_SA_SECRET_ANNOTATION, serviceAccount
STYX_WORKFLOW_SA_ID_ANNOTATION, serviceAccount
);

final Secret newSecret = new SecretBuilder()
Expand All @@ -259,12 +258,11 @@ private void ensureServiceAccountKeySecret(WorkflowInstance workflowInstance, Ru

client.secrets().create(newSecret);

LOG.info("[AUDIT] Secret {} created for {} referred to by workflow {}",
LOG.info("[AUDIT] Secret {} created to store keys of {} referred by workflow {}",
secretName, serviceAccount, workflowInstance.workflowId());
}
}


private boolean serviceAccountKeysExist(Secret secret) {
final Map<String, String> annotations = secret.getMetadata().getAnnotations();
final String jsonKeyName = annotations.get(STYX_WORKFLOW_SA_JSON_KEY_NAME_ANNOTATION);
Expand Down

0 comments on commit 6ead180

Please sign in to comment.