Skip to content

Split appcred finalizer management #901

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Deydra71 wants to merge 1 commit into
base: main
Choose a base branch
from
+63 −9
Open

Split appcred finalizer management #901

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 21 additions & 3 deletions internal/controller/autoscaling_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -335,10 +335,13 @@ func (r *AutoscalingReconciler) reconcileNormal(
return rbacResult, nil
}

if instance.Spec.Aodh.Auth.ApplicationCredentialSecret != "" || instance.Status.ApplicationCredentialSecret != "" {
// Early phase of the AC split pattern: only add finalizer to the new
// secret. Old secret finalizer removal is deferred until all
// sub-conditions are true (see late phase below).
if instance.Spec.Aodh.Auth.ApplicationCredentialSecret != "" {
if err := keystonev1.ManageACSecretFinalizer(ctx, helper, instance.Namespace,
instance.Spec.Aodh.Auth.ApplicationCredentialSecret,
instance.Status.ApplicationCredentialSecret,
"",
autoscaling.ACConsumerFinalizer); err != nil {
instance.Status.Conditions.Set(condition.FalseCondition(
condition.ServiceConfigReadyCondition,
Expand All @@ -349,7 +352,6 @@ func (r *AutoscalingReconciler) reconcileNormal(
return ctrl.Result{}, err
}
}
instance.Status.ApplicationCredentialSecret = instance.Spec.Aodh.Auth.ApplicationCredentialSecret

instance.Status.Conditions.MarkTrue(condition.ServiceConfigReadyCondition, condition.ServiceConfigReadyMessage)

Expand Down Expand Up @@ -727,6 +729,22 @@ func (r *AutoscalingReconciler) reconcileNormal(
return ctrlResult, err
}

// Late phase of the AC split pattern: remove the old AC secret's
// finalizer and update status only after all sub-conditions are true.
isACRotation := instance.Status.ApplicationCredentialSecret != "" &&
instance.Status.ApplicationCredentialSecret != instance.Spec.Aodh.Auth.ApplicationCredentialSecret
if isACRotation {
if instance.Status.Conditions.AllSubConditionIsTrue() {
if err := keystonev1.RemoveACSecretConsumerFinalizer(ctx, helper, instance.Namespace,
instance.Status.ApplicationCredentialSecret, autoscaling.ACConsumerFinalizer); err != nil {
return ctrl.Result{}, err
}
instance.Status.ApplicationCredentialSecret = instance.Spec.Aodh.Auth.ApplicationCredentialSecret
}
} else {
instance.Status.ApplicationCredentialSecret = instance.Spec.Aodh.Auth.ApplicationCredentialSecret
}

if instance.Status.Conditions.AllSubConditionIsTrue() {
instance.Status.Conditions.MarkTrue(
condition.ReadyCondition, condition.ReadyMessage)
Expand Down
24 changes: 21 additions & 3 deletions internal/controller/ceilometer_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -762,10 +762,13 @@ func (r *CeilometerReconciler) reconcileCeilometer(

instance.Status.Hash[common.InputHashName] = inputHash

if instance.Spec.Auth.ApplicationCredentialSecret != "" || instance.Status.ApplicationCredentialSecret != "" {
// Early phase of the AC split pattern: only add finalizer to the new
// secret. Old secret finalizer removal is deferred until all
// sub-conditions are true (see late phase below).
if instance.Spec.Auth.ApplicationCredentialSecret != "" {
if err := keystonev1.ManageACSecretFinalizer(ctx, helper, instance.Namespace,
instance.Spec.Auth.ApplicationCredentialSecret,
instance.Status.ApplicationCredentialSecret,
"",
ceilometer.ACConsumerFinalizer); err != nil {
instance.Status.Conditions.Set(condition.FalseCondition(
condition.ServiceConfigReadyCondition,
Expand All @@ -776,7 +779,6 @@ func (r *CeilometerReconciler) reconcileCeilometer(
return ctrl.Result{}, err
}
}
instance.Status.ApplicationCredentialSecret = instance.Spec.Auth.ApplicationCredentialSecret

instance.Status.Conditions.MarkTrue(condition.ServiceConfigReadyCondition, condition.ServiceConfigReadyMessage)

Expand Down Expand Up @@ -853,6 +855,22 @@ func (r *CeilometerReconciler) reconcileCeilometer(
if instance.Status.ReadyCount > 0 {
instance.Status.Conditions.MarkTrue(condition.DeploymentReadyCondition, condition.DeploymentReadyMessage)
}
// Late phase of the AC split pattern: remove the old AC secret's
// finalizer and update status only after all sub-conditions are true.
isACRotation := instance.Status.ApplicationCredentialSecret != "" &&
instance.Status.ApplicationCredentialSecret != instance.Spec.Auth.ApplicationCredentialSecret
if isACRotation {
if instance.Status.Conditions.AllSubConditionIsTrue() {
if err := keystonev1.RemoveACSecretConsumerFinalizer(ctx, helper, instance.Namespace,
instance.Status.ApplicationCredentialSecret, ceilometer.ACConsumerFinalizer); err != nil {
return ctrl.Result{}, err
}
instance.Status.ApplicationCredentialSecret = instance.Spec.Auth.ApplicationCredentialSecret
}
} else {
instance.Status.ApplicationCredentialSecret = instance.Spec.Auth.ApplicationCredentialSecret
}

if instance.Status.Conditions.AllSubConditionIsTrue() {
instance.Status.Conditions.MarkTrue(
condition.ReadyCondition, condition.ReadyMessage)
Expand Down
24 changes: 21 additions & 3 deletions internal/controller/cloudkitty_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1037,10 +1037,13 @@ func (r *CloudKittyReconciler) reconcileNormal(ctx context.Context, instance *te
return ctrl.Result{}, nil
}

if instance.Spec.Auth.ApplicationCredentialSecret != "" || instance.Status.ApplicationCredentialSecret != "" {
// Early phase of the AC split pattern: only add finalizer to the new
// secret. Old secret finalizer removal is deferred until all
// sub-conditions are true (see late phase below).
if instance.Spec.Auth.ApplicationCredentialSecret != "" {
if err := keystonev1.ManageACSecretFinalizer(ctx, helper, instance.Namespace,
instance.Spec.Auth.ApplicationCredentialSecret,
instance.Status.ApplicationCredentialSecret,
"",
cloudkitty.ACConsumerFinalizer); err != nil {
instance.Status.Conditions.Set(condition.FalseCondition(
condition.ServiceConfigReadyCondition,
Expand All @@ -1051,7 +1054,6 @@ func (r *CloudKittyReconciler) reconcileNormal(ctx context.Context, instance *te
return ctrl.Result{}, err
}
}
instance.Status.ApplicationCredentialSecret = instance.Spec.Auth.ApplicationCredentialSecret

instance.Status.Conditions.MarkTrue(condition.ServiceConfigReadyCondition, condition.ServiceConfigReadyMessage)

Expand Down Expand Up @@ -1171,6 +1173,22 @@ func (r *CloudKittyReconciler) reconcileNormal(ctx context.Context, instance *te
return ctrl.Result{}, err
}

// Late phase of the AC split pattern: remove the old AC secret's
// finalizer and update status only after all sub-conditions are true.
isACRotation := instance.Status.ApplicationCredentialSecret != "" &&
instance.Status.ApplicationCredentialSecret != instance.Spec.Auth.ApplicationCredentialSecret
if isACRotation {
if instance.Status.Conditions.AllSubConditionIsTrue() {
if err := keystonev1.RemoveACSecretConsumerFinalizer(ctx, helper, instance.Namespace,
instance.Status.ApplicationCredentialSecret, cloudkitty.ACConsumerFinalizer); err != nil {
return ctrl.Result{}, err
}
instance.Status.ApplicationCredentialSecret = instance.Spec.Auth.ApplicationCredentialSecret
}
} else {
instance.Status.ApplicationCredentialSecret = instance.Spec.Auth.ApplicationCredentialSecret
}

Log.Info(fmt.Sprintf("Reconciled Service '%s' successfully", instance.Name))
// update the overall status condition if service is ready
if instance.IsReady() {
Expand Down