Skip to content

Commit

Permalink
Honor SecretKeySelector Optional in v1a2 bootstrap
Browse files Browse the repository at this point in the history
  • Loading branch information
@bryanv
bryanv committed Dec 7, 2023
1 parent 8987579 commit 0e24695
Show file tree
Hide file tree
Showing 2 changed files with 135 additions and 8 deletions.
48 changes: 40 additions & 8 deletions pkg/vmprovider/providers/vsphere2/vmprovider_vm_utils.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -108,25 +108,38 @@ func GetVirtualMachineImageSpecAndStatus(

func getSecretData(
vmCtx context.VirtualMachineContextA2,
name string,
selector *corev1.SecretKeySelector,
cmFallback bool,
k8sClient ctrlclient.Client) (map[string]string, error) {

var data map[string]string

key := ctrlclient.ObjectKey{Name: name, Namespace: vmCtx.VM.Namespace}
key := ctrlclient.ObjectKey{Name: selector.Name, Namespace: vmCtx.VM.Namespace}
secret := &corev1.Secret{}
if err := k8sClient.Get(vmCtx, key, secret); err != nil {
configMap := &corev1.ConfigMap{}

// If Optional is non-nil, then we know this VM was created as v1a2 since that field does not
// exist in v1a1 so don't fall back to a ConfigMap, because v1a2+ is Secret only.
if selector.Optional != nil {
cmFallback = false
}

// For backwards compat if we cannot find the Secret, fallback to a ConfigMap. In v1a1, either a
// Secret and ConfigMap was supported for metadata (bootstrap) as separate fields, but v1a2 only
// supports Secrets.
if cmFallback && apierrors.IsNotFound(err) {
err = k8sClient.Get(vmCtx, key, configMap)
// Use the Secret error since the error message isn't misleading.
if k8sClient.Get(vmCtx, key, configMap) == nil {
err = nil
}
}

if err != nil {
if selector.Optional != nil && *selector.Optional && apierrors.IsNotFound(err) {
return nil, nil
}

reason, msg := errToConditionReasonAndMessage(err)
conditions.MarkFalse(vmCtx.VM, vmopv1.VirtualMachineConditionBootstrapReady, reason, msg)
return nil, err
Expand All @@ -141,6 +154,14 @@ func getSecretData(
}
}

if selector.Key != "" && selector.Optional != nil && !*selector.Optional {
if _, ok := data[selector.Key]; !ok {
err := fmt.Errorf("required key %q not found in Secret %s", selector.Key, selector.Name)
conditions.MarkFalse(vmCtx.VM, vmopv1.VirtualMachineConditionBootstrapReady, "RequiredKeyNotFound", err.Error())
return nil, err
}
}

return data, nil
}

Expand All @@ -167,7 +188,7 @@ func GetVirtualMachineBootstrap(
if secretSelector != nil {
var err error

data, err = getSecretData(vmCtx, secretSelector.Name, true, k8sClient)
data, err = getSecretData(vmCtx, secretSelector, true, k8sClient)
if err != nil {
reason, msg := errToConditionReasonAndMessage(err)
conditions.MarkFalse(vmCtx.VM, vmopv1.VirtualMachineConditionBootstrapReady, reason, msg)
Expand All @@ -181,7 +202,13 @@ func GetVirtualMachineBootstrap(
if vApp.RawProperties != "" {
var err error

vAppData, err = getSecretData(vmCtx, vApp.RawProperties, true, k8sClient)
selector := corev1.SecretKeySelector{
LocalObjectReference: corev1.LocalObjectReference{
Name: vApp.RawProperties,
},
}

vAppData, err = getSecretData(vmCtx, &selector, true, k8sClient)
if err != nil {
reason, msg := errToConditionReasonAndMessage(err)
conditions.MarkFalse(vmCtx.VM, vmopv1.VirtualMachineConditionBootstrapReady, reason, msg)
Expand All @@ -195,11 +222,10 @@ func GetVirtualMachineBootstrap(
continue
}

if _, ok := vAppExData[from.Name]; !ok {
if data, ok := vAppExData[from.Name]; !ok {
// Do the easy thing here and carry along each Secret's entire data. We could instead
// shoehorn this in the vAppData with a concat key using an invalid k8s name delimiter.
// TODO: Check that key exists, and/or deal with from.Optional. Too many options.
fromData, err := getSecretData(vmCtx, from.Name, false, k8sClient)
fromData, err := getSecretData(vmCtx, from, false, k8sClient)
if err != nil {
reason, msg := errToConditionReasonAndMessage(err)
conditions.MarkFalse(vmCtx.VM, vmopv1.VirtualMachineConditionBootstrapReady, reason, msg)
Expand All @@ -210,6 +236,12 @@ func GetVirtualMachineBootstrap(
vAppExData = make(map[string]map[string]string)
}
vAppExData[from.Name] = fromData
} else if from.Key != "" && from.Optional != nil && !*from.Optional {
if _, ok := data[from.Key]; !ok {
err := fmt.Errorf("required key %q not found in vApp Properties Secret %s", from.Key, from.Name)
conditions.MarkFalse(vmCtx.VM, vmopv1.VirtualMachineConditionBootstrapReady, "RequiredKeyNotFound", err.Error())
return nil, nil, nil, err
}
}
}
}
Expand Down
95 changes: 95 additions & 0 deletions pkg/vmprovider/providers/vsphere2/vmprovider_vm_utils_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ import (
"github.com/vmware/govmomi/vim25/types"
corev1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/utils/pointer"
"sigs.k8s.io/controller-runtime/pkg/client"

vmopv1 "github.com/vmware-tanzu/vm-operator/api/v1alpha2"
Expand Down Expand Up @@ -345,6 +346,71 @@ func vmUtilTests() {
})
})
})

When("Optional is set", func() {
Context("Secret does not exist", func() {
Context("Optional is true", func() {
BeforeEach(func() {
vmCtx.VM.Spec.Bootstrap.CloudInit.RawCloudConfig.Optional = pointer.Bool(true)
})

It("returns success", func() {
data, _, _, err := vsphere.GetVirtualMachineBootstrap(vmCtx, k8sClient)
Expect(err).ToNot(HaveOccurred())
Expect(data).To(BeEmpty())
Expect(conditions.IsTrue(vmCtx.VM, vmopv1.VirtualMachineConditionBootstrapReady)).To(BeTrue())
})
})

Context("Optional is false", func() {
BeforeEach(func() {
vmCtx.VM.Spec.Bootstrap.CloudInit.RawCloudConfig.Optional = pointer.Bool(false)
})

It("returns error", func() {
_, _, _, err := vsphere.GetVirtualMachineBootstrap(vmCtx, k8sClient)
Expect(err).To(HaveOccurred())
Expect(err.Error()).To(Equal(`secrets "dummy-vm-bootstrap-data" not found`))
Expect(conditions.IsFalse(vmCtx.VM, vmopv1.VirtualMachineConditionBootstrapReady)).To(BeTrue())
})
})
})

Context("Key in Secret does not exist", func() {
BeforeEach(func() {
initObjects = append(initObjects, bootstrapSecret)

vmCtx.VM.Spec.Bootstrap.CloudInit.RawCloudConfig.Key = "secret-key-that-does-not-exist"
})

Context("Optional is true", func() {
BeforeEach(func() {
vmCtx.VM.Spec.Bootstrap.CloudInit.RawCloudConfig.Optional = pointer.Bool(true)
})

It("returns success", func() {
data, _, _, err := vsphere.GetVirtualMachineBootstrap(vmCtx, k8sClient)
Expect(err).ToNot(HaveOccurred())
Expect(data).ToNot(BeEmpty())
Expect(conditions.IsTrue(vmCtx.VM, vmopv1.VirtualMachineConditionBootstrapReady)).To(BeTrue())
})
})

Context("Optional is false", func() {
BeforeEach(func() {
vmCtx.VM.Spec.Bootstrap.CloudInit.RawCloudConfig.Optional = pointer.Bool(false)
})

It("returns an error", func() {
_, _, _, err := vsphere.GetVirtualMachineBootstrap(vmCtx, k8sClient)
Expect(err).To(HaveOccurred())
Expect(err.Error()).To(Equal(`required key "secret-key-that-does-not-exist" not found in Secret dummy-vm-bootstrap-data`))
Expect(conditions.IsFalse(vmCtx.VM, vmopv1.VirtualMachineConditionBootstrapReady)).To(BeTrue())
})
})

})
})
})

When("Bootstrap via Sysprep", func() {
Expand Down Expand Up @@ -441,6 +507,35 @@ func vmUtilTests() {
data := exData[vAppDataName]
Expect(data).To(HaveKeyWithValue("foo-vapp", "bar-vapp"))
})

Context("Optional is set", func() {
Context("Secret does not exist", func() {
BeforeEach(func() {
vmCtx.VM.Spec.Bootstrap.VAppConfig.Properties[0].Value.From.Name = "secret-does-exist"
vmCtx.VM.Spec.Bootstrap.VAppConfig.Properties[0].Value.From.Optional = pointer.Bool(true)
})

It("returns success when optional is true", func() {
_, _, exData, err := vsphere.GetVirtualMachineBootstrap(vmCtx, k8sClient)
Expect(err).ToNot(HaveOccurred())
Expect(exData).To(BeEmpty())
Expect(conditions.IsTrue(vmCtx.VM, vmopv1.VirtualMachineConditionBootstrapReady)).To(BeTrue())
})
})

Context("Key in Secret does not exist", func() {
BeforeEach(func() {
vmCtx.VM.Spec.Bootstrap.VAppConfig.Properties[0].Value.From.Key = "bogus-vapp-prop-key"
vmCtx.VM.Spec.Bootstrap.VAppConfig.Properties[0].Value.From.Optional = pointer.Bool(true)
})

It("returns error when Optional is false", func() {
_, _, _, err := vsphere.GetVirtualMachineBootstrap(vmCtx, k8sClient)
Expect(err).To(HaveOccurred())
Expect(conditions.IsFalse(vmCtx.VM, vmopv1.VirtualMachineConditionBootstrapReady)).To(BeTrue())
})
})
})
})
})
})
Expand Down

0 comments on commit 0e24695

Please sign in to comment.