Skip to content

Commit 43163cf

Browse files
FxKuFxKu
authored
allow using both infrastructure_roles_options (zalando#1090)
* allow using both infrastructure_roles_options * new default values for user and role definition * use robot_zmon as parent role * add operator log to debug * right name for old secret * only extract if rolesDefs is empty * set password1 in old infrastructure role * fix new infra rile secret * choose different role key for new secret * set memberof everywhere * reenable all tests * reflect feedback * remove condition for rolesDefs
1 parent 7cf2fae commit 43163cf

File tree

10 files changed

+646
-539
lines changed

10 files changed

+646
-539
lines changed

‎charts/postgres-operator/crds/operatorconfigurations.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,10 @@ spec:
149149
type: string
150150
rolekey:
151151
type: string
152+
defaultuservalue:
153+
type: string
154+
defaultrolevalue:
155+
type: string
152156
details:
153157
type: string
154158
template:

‎e2e/tests/test_e2e.py‎

Lines changed: 504 additions & 503 deletions
Large diffs are not rendered by default.

‎manifests/infrastructure-roles-new.yaml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,6 @@ data:
33
# infrastructure role definition in the new format
44
# robot_zmon_acid_monitoring_new
55
user: cm9ib3Rfem1vbl9hY2lkX21vbml0b3JpbmdfbmV3
6-
# robot_zmon_new
7-
role: cm9ib3Rfem1vbl9uZXc=
86
# foobar_new
97
password: Zm9vYmFyX25ldw==
108
kind: Secret

‎manifests/infrastructure-roles.yaml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,14 @@ data:
77
# provide other options in the configmap.
88
# robot_zmon_acid_monitoring
99
user1: cm9ib3Rfem1vbl9hY2lkX21vbml0b3Jpbmc=
10+
# foobar
11+
password1: Zm9vYmFy
1012
# robot_zmon
1113
inrole1: cm9ib3Rfem1vbg==
1214
# testuser
1315
user2: dGVzdHVzZXI=
14-
# foobar
15-
password2: Zm9vYmFy
16+
# testpassword
17+
password2: dGVzdHBhc3N3b3Jk
1618
# user batman with the password justice
1719
# look for other fields in the infrastructure roles configmap
1820
batman: anVzdGljZQ==

‎manifests/operatorconfiguration.crd.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,10 @@ spec:
145145
type: string
146146
rolekey:
147147
type: string
148+
defaultuservalue:
149+
type: string
150+
defaultrolevalue:
151+
type: string
148152
details:
149153
type: string
150154
template:

‎pkg/apis/acid.zalan.do/v1/crds.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -930,6 +930,12 @@ var OperatorConfigCRDResourceValidation = apiextv1beta1.CustomResourceValidation
930930
"rolekey": {
931931
Type: "string",
932932
},
933+
"defaultuservalue": {
934+
Type: "string",
935+
},
936+
"defaultrolevalue": {
937+
Type: "string",
938+
},
933939
"details": {
934940
Type: "string",
935941
},

‎pkg/cluster/resources.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -207,7 +207,7 @@ func (c *Cluster) deleteConnectionPooler() (err error) {
207207
serviceName = service.Name
208208
}
209209

210-
// set delete propagation policy to foreground, so that all the dependant
210+
// set delete propagation policy to foreground, so that all the dependent
211211
// will be deleted.
212212
err = c.KubeClient.
213213
Services(c.Namespace).

‎pkg/controller/util.go‎

Lines changed: 21 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ import (
1515
acidv1 "github.com/zalando/postgres-operator/pkg/apis/acid.zalan.do/v1"
1616
"github.com/zalando/postgres-operator/pkg/cluster"
1717
"github.com/zalando/postgres-operator/pkg/spec"
18+
"github.com/zalando/postgres-operator/pkg/util"
1819
"github.com/zalando/postgres-operator/pkg/util/config"
1920
"github.com/zalando/postgres-operator/pkg/util/k8sutil"
2021
"gopkg.in/yaml.v2"
@@ -118,13 +119,9 @@ var emptyName = (spec.NamespacedName{})
118119
// configuration in ConfigMap & CRD.
119120
func (c *Controller) getInfrastructureRoleDefinitions() []*config.InfrastructureRole {
120121
var roleDef config.InfrastructureRole
121-
rolesDefs := c.opConfig.InfrastructureRoles
122122

123-
if c.opConfig.InfrastructureRolesSecretName == emptyName {
124-
// All the other possibilities require secret name to be present, so if
125-
// it is not, then nothing else to be done here.
126-
return rolesDefs
127-
}
123+
// take from CRD configuration
124+
rolesDefs := c.opConfig.InfrastructureRoles
128125

129126
// check if we can extract something from the configmap config option
130127
if c.opConfig.InfrastructureRolesDefs != "" {
@@ -163,27 +160,33 @@ func (c *Controller) getInfrastructureRoleDefinitions() []*config.Infrastructure
163160
roleDef.PasswordKey = value
164161
case "rolekey":
165162
roleDef.RoleKey = value
163+
case "defaultuservalue":
164+
roleDef.DefaultUserValue = value
165+
case "defaultrolevalue":
166+
roleDef.DefaultRoleValue = value
166167
default:
167168
c.logger.Warningf("Role description is not known: %s", properties)
168169
}
169170
}
170-
} else {
171+
172+
if roleDef.SecretName != emptyName &&
173+
(roleDef.UserKey != "" || roleDef.DefaultUserValue != "") &&
174+
roleDef.PasswordKey != "" {
175+
rolesDefs = append(rolesDefs, &roleDef)
176+
}
177+
}
178+
179+
if c.opConfig.InfrastructureRolesSecretName != emptyName {
171180
// At this point we deal with the old format, let's replicate it
172181
// via existing definition structure and remember that it's just a
173182
// template, the real values are in user1,password1,inrole1 etc.
174-
roleDef = config.InfrastructureRole{
183+
rolesDefs = append(rolesDefs, &config.InfrastructureRole{
175184
SecretName: c.opConfig.InfrastructureRolesSecretName,
176185
UserKey: "user",
177186
PasswordKey: "password",
178187
RoleKey: "inrole",
179188
Template: true,
180-
}
181-
}
182-
183-
if roleDef.UserKey != "" &&
184-
roleDef.PasswordKey != "" &&
185-
roleDef.RoleKey != "" {
186-
rolesDefs = append(rolesDefs, &roleDef)
189+
})
187190
}
188191

189192
return rolesDefs
@@ -330,9 +333,10 @@ func (c *Controller) getInfrastructureRole(
330333
return nil, fmt.Errorf("could not decode yaml role: %v", err)
331334
}
332335
} else {
333-
roleDescr.Name = string(secretData[infraRole.UserKey])
336+
roleDescr.Name = util.Coalesce(string(secretData[infraRole.UserKey]), infraRole.DefaultUserValue)
334337
roleDescr.Password = string(secretData[infraRole.PasswordKey])
335-
roleDescr.MemberOf = append(roleDescr.MemberOf, string(secretData[infraRole.RoleKey]))
338+
roleDescr.MemberOf = append(roleDescr.MemberOf,
339+
util.Coalesce(string(secretData[infraRole.RoleKey]), infraRole.DefaultRoleValue))
336340
}
337341

338342
if roleDescr.Valid() {

‎pkg/controller/util_test.go‎

Lines changed: 99 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -279,17 +279,17 @@ func TestInfrastructureRoleDefinitions(t *testing.T) {
279279
roleSecrets string
280280
expectedDefs []*config.InfrastructureRole
281281
}{
282-
// only new format
282+
// only new CRD format
283283
{
284284
[]*config.InfrastructureRole{
285285
&config.InfrastructureRole{
286286
SecretName: spec.NamespacedName{
287287
Namespace: v1.NamespaceDefault,
288288
Name: testInfrastructureRolesNewSecretName,
289289
},
290-
UserKey: "user",
291-
PasswordKey: "password",
292-
RoleKey: "inrole",
290+
UserKey: "test-user",
291+
PasswordKey: "test-password",
292+
RoleKey: "test-role",
293293
Template: false,
294294
},
295295
},
@@ -301,14 +301,50 @@ func TestInfrastructureRoleDefinitions(t *testing.T) {
301301
Namespace: v1.NamespaceDefault,
302302
Name: testInfrastructureRolesNewSecretName,
303303
},
304-
UserKey: "user",
305-
PasswordKey: "password",
306-
RoleKey: "inrole",
304+
UserKey: "test-user",
305+
PasswordKey: "test-password",
306+
RoleKey: "test-role",
307307
Template: false,
308308
},
309309
},
310310
},
311-
// only old format
311+
// only new configmap format
312+
{
313+
[]*config.InfrastructureRole{},
314+
spec.NamespacedName{},
315+
"secretname: infrastructureroles-new-test, userkey: test-user, passwordkey: test-password, rolekey: test-role",
316+
[]*config.InfrastructureRole{
317+
&config.InfrastructureRole{
318+
SecretName: spec.NamespacedName{
319+
Namespace: v1.NamespaceDefault,
320+
Name: testInfrastructureRolesNewSecretName,
321+
},
322+
UserKey: "test-user",
323+
PasswordKey: "test-password",
324+
RoleKey: "test-role",
325+
Template: false,
326+
},
327+
},
328+
},
329+
// new configmap format with defaultRoleValue
330+
{
331+
[]*config.InfrastructureRole{},
332+
spec.NamespacedName{},
333+
"secretname: infrastructureroles-new-test, userkey: test-user, passwordkey: test-password, defaultrolevalue: test-role",
334+
[]*config.InfrastructureRole{
335+
&config.InfrastructureRole{
336+
SecretName: spec.NamespacedName{
337+
Namespace: v1.NamespaceDefault,
338+
Name: testInfrastructureRolesNewSecretName,
339+
},
340+
UserKey: "test-user",
341+
PasswordKey: "test-password",
342+
DefaultRoleValue: "test-role",
343+
Template: false,
344+
},
345+
},
346+
},
347+
// only old CRD and configmap format
312348
{
313349
[]*config.InfrastructureRole{},
314350
spec.NamespacedName{
@@ -329,42 +365,91 @@ func TestInfrastructureRoleDefinitions(t *testing.T) {
329365
},
330366
},
331367
},
332-
// only configmap format
368+
// both formats for CRD
333369
{
334-
[]*config.InfrastructureRole{},
370+
[]*config.InfrastructureRole{
371+
&config.InfrastructureRole{
372+
SecretName: spec.NamespacedName{
373+
Namespace: v1.NamespaceDefault,
374+
Name: testInfrastructureRolesNewSecretName,
375+
},
376+
UserKey: "test-user",
377+
PasswordKey: "test-password",
378+
RoleKey: "test-role",
379+
Template: false,
380+
},
381+
},
335382
spec.NamespacedName{
336383
Namespace: v1.NamespaceDefault,
337384
Name: testInfrastructureRolesOldSecretName,
338385
},
339-
"secretname: infrastructureroles-old-test, userkey: test-user, passwordkey: test-password, rolekey: test-role, template: false",
386+
"",
340387
[]*config.InfrastructureRole{
341388
&config.InfrastructureRole{
342389
SecretName: spec.NamespacedName{
343390
Namespace: v1.NamespaceDefault,
344-
Name: testInfrastructureRolesOldSecretName,
391+
Name: testInfrastructureRolesNewSecretName,
345392
},
346393
UserKey: "test-user",
347394
PasswordKey: "test-password",
348395
RoleKey: "test-role",
349396
Template: false,
350397
},
398+
&config.InfrastructureRole{
399+
SecretName: spec.NamespacedName{
400+
Namespace: v1.NamespaceDefault,
401+
Name: testInfrastructureRolesOldSecretName,
402+
},
403+
UserKey: "user",
404+
PasswordKey: "password",
405+
RoleKey: "inrole",
406+
Template: true,
407+
},
351408
},
352409
},
353-
// incorrect configmap format
410+
// both formats for configmap
354411
{
355412
[]*config.InfrastructureRole{},
356413
spec.NamespacedName{
357414
Namespace: v1.NamespaceDefault,
358415
Name: testInfrastructureRolesOldSecretName,
359416
},
417+
"secretname: infrastructureroles-new-test, userkey: test-user, passwordkey: test-password, rolekey: test-role",
418+
[]*config.InfrastructureRole{
419+
&config.InfrastructureRole{
420+
SecretName: spec.NamespacedName{
421+
Namespace: v1.NamespaceDefault,
422+
Name: testInfrastructureRolesNewSecretName,
423+
},
424+
UserKey: "test-user",
425+
PasswordKey: "test-password",
426+
RoleKey: "test-role",
427+
Template: false,
428+
},
429+
&config.InfrastructureRole{
430+
SecretName: spec.NamespacedName{
431+
Namespace: v1.NamespaceDefault,
432+
Name: testInfrastructureRolesOldSecretName,
433+
},
434+
UserKey: "user",
435+
PasswordKey: "password",
436+
RoleKey: "inrole",
437+
Template: true,
438+
},
439+
},
440+
},
441+
// incorrect configmap format
442+
{
443+
[]*config.InfrastructureRole{},
444+
spec.NamespacedName{},
360445
"wrong-format",
361446
[]*config.InfrastructureRole{},
362447
},
363448
// configmap without a secret
364449
{
365450
[]*config.InfrastructureRole{},
366451
spec.NamespacedName{},
367-
"userkey: test-user, passwordkey: test-password, rolekey: test-role, template: false",
452+
"userkey: test-user, passwordkey: test-password, rolekey: test-role",
368453
[]*config.InfrastructureRole{},
369454
},
370455
}

‎pkg/util/config/config.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,9 @@ type InfrastructureRole struct {
6161
PasswordKey string
6262
RoleKey string
6363

64+
DefaultUserValue string
65+
DefaultRoleValue string
66+
6467
// This field point out the detailed yaml definition of the role, if exists
6568
Details string
6669

0 commit comments

Comments
 (0)