Adding changes to extend secret stores scope to global

pkg/corerp/frontend/controller/secretstores/kubernetes.go

@@ -32,6 +32,7 @@ import (
 	"github.com/radius-project/radius/pkg/ucp/resources"
 	resources_kubernetes "github.com/radius-project/radius/pkg/ucp/resources/kubernetes"
 	"github.com/radius-project/radius/pkg/ucp/store"
+	"github.com/radius-project/radius/pkg/ucp/ucplog"
 	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -179,11 +180,14 @@ func fromResourceID(id string) (ns string, name string, err error) {
 // UpsertSecret creates or updates a Kubernetes secret based on the incoming request and returns the secret's location in
 // the output resource.
 func UpsertSecret(ctx context.Context, newResource, old *datamodel.SecretStore, options *controller.Options) (rest.Response, error) {
+	logger := ucplog.FromContextOrDiscard(ctx)
 	ref := newResource.Properties.Resource
 	if ref == "" && old != nil {
 		ref = old.Properties.Resource
 	}
-
+	if newResource.Properties.Application == "" && newResource.Properties.Resource == "" {
+		return rest.NewBadRequestResponse("$.properties.resource cannot be \"\" for global scoped resource."), nil
+	}
 	ns, name, err := fromResourceID(ref)
 	if err != nil {
 		return nil, err
@@ -194,6 +198,14 @@ func UpsertSecret(ctx context.Context, newResource, old *datamodel.SecretStore,
 			return nil, err
 		}
 	}
+	err = options.KubeClient.Create(ctx, &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: ns}})
+	if apierrors.IsAlreadyExists(err) {
+		logger.Info("Using existing namespace", "namespace", ns)
+	} else if err != nil {
+		return nil, err
+	} else {
+		logger.Info("Created the namespace", "namespace", ns)
+	}
 
 	if name == "" {
 		name = newResource.Name
@@ -209,7 +221,7 @@ func UpsertSecret(ctx context.Context, newResource, old *datamodel.SecretStore,
 	err = options.KubeClient.Get(ctx, runtimeclient.ObjectKey{Namespace: ns, Name: name}, ksecret)
 	if apierrors.IsNotFound(err) {
 		// If resource in incoming request references resource, then the resource must exist.
-		if ref != "" {
+		if ref != "" && newResource.Properties.Application != "" {
 			return rest.NewBadRequestResponse(fmt.Sprintf("'%s' referenced resource does not exist.", ref)), nil
 		}
 		app, _ := resources.ParseResource(newResource.Properties.Application)

pkg/corerp/frontend/controller/secretstores/kubernetes_test.go

@@ -45,9 +45,10 @@ const (
 	testEnvID     = testRootScope + "/Applications.Core/environments/env0"
 	testAppID     = testRootScope + "/Applications.Core/applications/app0"
 
-	testFileCertValueFrom = "secretstores_datamodel_cert_valuefrom.json"
-	testFileCertValue     = "secretstores_datamodel_cert_value.json"
-	testFileGenericValue  = "secretstores_datamodel_generic.json"
+	testFileCertValueFrom           = "secretstores_datamodel_cert_valuefrom.json"
+	testFileCertValue               = "secretstores_datamodel_cert_value.json"
+	testFileGenericValue            = "secretstores_datamodel_generic.json"
+	testFileGenericValueGlobalScope = "secretstores_datamodel_global_scope.json"
 )
 
 func TestGetNamespace(t *testing.T) {
@@ -466,6 +467,43 @@ func TestUpsertSecret(t *testing.T) {
 		require.Equal(t, "'app0-ns/secret1' of $.properties.resource must be same as 'app0-ns/secret0'.", r.Body.Error.Message)
 	})
 
+	t.Run("create a new secret resource with global scope", func(t *testing.T) {
+		ctrl := gomock.NewController(t)
+		sc := store.NewMockStorageClient(ctrl)
+
+		newResource := testutil.MustGetTestData[datamodel.SecretStore](testFileGenericValueGlobalScope)
+
+		opt := &controller.Options{
+			StorageClient: sc,
+			KubeClient:    k8sutil.NewFakeKubeClient(nil),
+		}
+
+		_, err := ValidateAndMutateRequest(context.TODO(), newResource, nil, opt)
+		require.NoError(t, err)
+		_, err = UpsertSecret(context.TODO(), newResource, nil, opt)
+		require.NoError(t, err)
+
+		// assert
+		require.Equal(t, "test-namespace/secret0", newResource.Properties.Resource)
+		ksecret := &corev1.Secret{}
+
+		err = opt.KubeClient.Get(context.TODO(), runtimeclient.ObjectKey{Namespace: "test-namespace", Name: "secret0"}, ksecret)
+		require.NoError(t, err)
+
+		require.Equal(t, "dGxzLmNydA==", string(ksecret.Data["tls.crt"]))
+		require.Equal(t, "dGxzLmNlcnQK", string(ksecret.Data["tls.key"]))
+		require.Equal(t, "MTAwMDAwMDAtMTAwMC0xMDAwLTAwMDAtMDAwMDAwMDAwMDAw", string(ksecret.Data["servicePrincipalPassword"]))
+		require.Equal(t, rpv1.OutputResource{
+			LocalID: "Secret",
+			ID: resources_kubernetes.IDFromParts(
+				resources_kubernetes.PlaneNameTODO,
+				"",
+				resources_kubernetes.KindSecret,
+				"test-namespace",
+				"secret0"),
+		}, newResource.Properties.Status.OutputResources[0])
+	})
+
 }
 
 func TestDeleteSecret(t *testing.T) {

pkg/corerp/frontend/controller/secretstores/testdata/secretstores_datamodel_global_scope.json

@@ -0,0 +1,37 @@
+{
+    "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/testGroup/providers/Applications.Core/secretStores/secret0",
+    "name": "secret0",
+    "type": "applications.core/secretstores",
+    "location": "global",
+    "systemData": {
+      "createdAt": "2022-03-22T18:54:52.6857175Z",
+      "createdBy": "[email protected]",
+      "createdByType": "User",
+      "lastModifiedAt": "2022-03-22T18:57:52.6857175Z",
+      "lastModifiedBy": "[email protected]",
+      "lastModifiedByType": "User"
+    },
+    "provisioningState": "Succeeded",
+    "properties": {
+      "resource": "test-namespace/secret0",
+      "type": "generic",
+      "data": {
+        "tls.crt": {
+          "encoding": "raw",
+          "value": "tls.crt"
+        },
+        "tls.key": {
+          "encoding": "base64",
+          "value": "dGxzLmNlcnQK"
+        },
+        "servicePrincipalPassword": {
+          "value": "10000000-1000-1000-0000-000000000000"
+        }
+      }
+    },
+    "tenantId": "00000000-0000-0000-0000-000000000000",
+    "subscriptionId": "00000000-0000-0000-0000-000000000000",
+    "resourceGroup": "testGroup",
+    "createdApiVersion": "2023-10-01-preview",
+    "updatedApiVersion": "2023-10-01-preview"
+  }

swagger/specification/applications/resource-manager/Applications.Core/preview/2023-10-01-preview/openapi.json

@@ -5077,7 +5077,6 @@
         }
       },
       "required": [
-        "application",
         "data"
       ]
     },

typespec/Applications.Core/secretstores.tsp

@@ -47,7 +47,7 @@ model SecretStoreResource is TrackedResourceRequired<SecretStoreProperties, "sec
 
 @doc("The properties of SecretStore")
 model SecretStoreProperties {
-  ...ApplicationScopedResource;
+  ...GlobalScopedResource;
 
   #suppress "@azure-tools/typespec-azure-resource-manager/arm-resource-duplicate-property"
   @doc("The type of secret store data")

typespec/radius/v1/resources.tsp

@@ -62,6 +62,23 @@ model ApplicationScopedResource {
   status?: ResourceStatus;
 }
 
+@doc("Base properties of a Global-scoped resource")
+model GlobalScopedResource {
+  @doc("Fully qualified resource ID for the environment that the application is linked to")
+  environment?: string;
+
+  @doc("Fully qualified resource ID for the application")
+  application?: string;
+
+  @doc("The status of the asynchronous operation.")
+  @visibility("read")
+  provisioningState?: ProvisioningState;
+
+  @doc("Status of a resource.")
+  @visibility("read")
+  status?: ResourceStatus;
+}
+
 @doc("IdentitySettings is the external identity setting.")
 model IdentitySettings {
   @doc("kind of identity setting")