Skip to content

Commit ae090e8

Browse files
brandondbrandond
committed
Use patch helper for secrets-encryption labels and annotations
Signed-off-by: Brad Davidson <[email protected]>
1 parent f7b5335 commit ae090e8

File tree

3 files changed

+42
-91
lines changed

3 files changed

+42
-91
lines changed

‎pkg/secretsencrypt/config.go‎

Lines changed: 14 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -221,31 +221,35 @@ func getEncryptionHashFile(runtime *config.ControlRuntime) (string, error) {
221221
return string(curEncryptionByte), nil
222222
}
223223

224-
func BootstrapEncryptionHashAnnotation(node *corev1.Node, runtime *config.ControlRuntime) error {
224+
func BootstrapEncryptionHashAnnotation(ctx context.Context, runtime *config.ControlRuntime, nodeName string) error {
225225
existingAnn, err := getEncryptionHashFile(runtime)
226226
if err != nil {
227227
return err
228228
}
229-
node.Annotations[EncryptionHashAnnotation] = existingAnn
230-
return nil
229+
patch := util.NewPatchList()
230+
patcher := util.NewPatcher[*corev1.Node](runtime.Core.Core().V1().Node())
231+
patch.Add(existingAnn, "metadata", "annotations", EncryptionHashAnnotation)
232+
233+
_, err = patcher.Patch(ctx, patch, nodeName)
234+
return err
231235
}
232236

233237
// WriteEncryptionHashAnnotation writes the encryption hash to the node annotation and optionally to a file.
234238
// The file is used to track the last stage of the reencryption process.
235-
func WriteEncryptionHashAnnotation(runtime *config.ControlRuntime, node *corev1.Node, skipFile bool, stage string) error {
239+
func WriteEncryptionHashAnnotation(ctx context.Context, runtime *config.ControlRuntime, nodeName string, skipFile bool, stage string) error {
236240
encryptionConfigHash, err := GenEncryptionConfigHash(runtime)
237241
if err != nil {
238242
return err
239243
}
240-
if node.Annotations == nil {
241-
return fmt.Errorf("node annotations do not exist for %s", node.ObjectMeta.Name)
242-
}
243244
ann := stage + "-" + encryptionConfigHash
244-
node.Annotations[EncryptionHashAnnotation] = ann
245-
if _, err = runtime.Core.Core().V1().Node().Update(node); err != nil {
245+
246+
patch := util.NewPatchList()
247+
patcher := util.NewPatcher[*corev1.Node](runtime.Core.Core().V1().Node())
248+
patch.Add(ann, "metadata", "annotations", EncryptionHashAnnotation)
249+
if _, err = patcher.Patch(ctx, patch, nodeName); err != nil {
246250
return err
247251
}
248-
logrus.Debugf("encryption hash annotation set successfully on node: %s\n", node.ObjectMeta.Name)
252+
logrus.Debugf("encryption hash annotation set successfully on node: %s\n", nodeName)
249253
if skipFile {
250254
return nil
251255
}

‎pkg/server/handlers/secrets-encrypt.go‎

Lines changed: 12 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,6 @@ import (
2828
"k8s.io/apimachinery/pkg/types"
2929
apiserverconfigv1 "k8s.io/apiserver/pkg/apis/apiserver/v1"
3030
"k8s.io/client-go/tools/pager"
31-
"k8s.io/client-go/util/retry"
3231
"k8s.io/utils/ptr"
3332
)
3433

@@ -252,17 +251,12 @@ func encryptionPrepare(ctx context.Context, control *config.Control, force bool)
252251
if err := secretsencrypt.WriteEncryptionConfig(control.Runtime, curKeys, control.EncryptProvider, true); err != nil {
253252
return err
254253
}
254+
255255
nodeName := os.Getenv("NODE_NAME")
256-
err = retry.RetryOnConflict(retry.DefaultRetry, func() error {
257-
node, err := control.Runtime.Core.Core().V1().Node().Get(nodeName, metav1.GetOptions{})
258-
if err != nil {
259-
return err
260-
}
261-
return secretsencrypt.WriteEncryptionHashAnnotation(control.Runtime, node, false, secretsencrypt.EncryptionPrepare)
262-
})
263-
if err != nil {
256+
if err := secretsencrypt.WriteEncryptionHashAnnotation(ctx, control.Runtime, nodeName, false, secretsencrypt.EncryptionPrepare); err != nil {
264257
return err
265258
}
259+
266260
return cluster.Save(ctx, control, true)
267261
}
268262

@@ -289,21 +283,16 @@ func encryptionRotate(ctx context.Context, control *config.Control, force bool)
289283
curKeys.SBKeys = rotatedKeys
290284
}
291285

292-
if err = secretsencrypt.WriteEncryptionConfig(control.Runtime, curKeys, control.EncryptProvider, true); err != nil {
286+
if err := secretsencrypt.WriteEncryptionConfig(control.Runtime, curKeys, control.EncryptProvider, true); err != nil {
293287
return err
294288
}
295289
logrus.Infof("Encryption %s keys right rotated\n", control.EncryptProvider)
290+
296291
nodeName := os.Getenv("NODE_NAME")
297-
err = retry.RetryOnConflict(retry.DefaultRetry, func() error {
298-
node, err := control.Runtime.Core.Core().V1().Node().Get(nodeName, metav1.GetOptions{})
299-
if err != nil {
300-
return err
301-
}
302-
return secretsencrypt.WriteEncryptionHashAnnotation(control.Runtime, node, false, secretsencrypt.EncryptionRotate)
303-
})
304-
if err != nil {
292+
if err := secretsencrypt.WriteEncryptionHashAnnotation(ctx, control.Runtime, nodeName, false, secretsencrypt.EncryptionRotate); err != nil {
305293
return err
306294
}
295+
307296
return cluster.Save(ctx, control, true)
308297
}
309298

@@ -318,13 +307,7 @@ func encryptionReencrypt(ctx context.Context, control *config.Control, force boo
318307
// Set the reencrypt-active annotation so other nodes know we are in the process of reencrypting.
319308
// As this stage is not persisted, we do not write the annotation to file
320309
nodeName := os.Getenv("NODE_NAME")
321-
if err := retry.RetryOnConflict(retry.DefaultRetry, func() error {
322-
node, err := control.Runtime.Core.Core().V1().Node().Get(nodeName, metav1.GetOptions{})
323-
if err != nil {
324-
return err
325-
}
326-
return secretsencrypt.WriteEncryptionHashAnnotation(control.Runtime, node, true, secretsencrypt.EncryptionReencryptActive)
327-
}); err != nil {
310+
if err := secretsencrypt.WriteEncryptionHashAnnotation(ctx, control.Runtime, nodeName, true, secretsencrypt.EncryptionReencryptActive); err != nil {
328311
return err
329312
}
330313

@@ -380,13 +363,7 @@ func encryptionRotateKeys(ctx context.Context, control *config.Control) error {
380363
// Set the reencrypt-active annotation so other nodes know we are in the process of reencrypting.
381364
// As this stage is not persisted, we do not write the annotation to file
382365
nodeName := os.Getenv("NODE_NAME")
383-
if err = retry.RetryOnConflict(retry.DefaultRetry, func() error {
384-
node, err := control.Runtime.Core.Core().V1().Node().Get(nodeName, metav1.GetOptions{})
385-
if err != nil {
386-
return err
387-
}
388-
return secretsencrypt.WriteEncryptionHashAnnotation(control.Runtime, node, true, secretsencrypt.EncryptionReencryptActive)
389-
}); err != nil {
366+
if err := secretsencrypt.WriteEncryptionHashAnnotation(ctx, control.Runtime, nodeName, true, secretsencrypt.EncryptionReencryptActive); err != nil {
390367
return err
391368
}
392369

@@ -408,16 +385,7 @@ func reencryptAndRemoveKey(ctx context.Context, control *config.Control, skip bo
408385

409386
// If skipping, revert back to the previous stage and do not remove the key
410387
if skip {
411-
err := retry.RetryOnConflict(retry.DefaultRetry, func() error {
412-
node, err := control.Runtime.Core.Core().V1().Node().Get(nodeName, metav1.GetOptions{})
413-
if err != nil {
414-
return err
415-
}
416-
secretsencrypt.BootstrapEncryptionHashAnnotation(node, control.Runtime)
417-
_, err = control.Runtime.Core.Core().V1().Node().Update(node)
418-
return err
419-
})
420-
return err
388+
return secretsencrypt.BootstrapEncryptionHashAnnotation(ctx, control.Runtime, nodeName)
421389
}
422390

423391
// Remove old key. If there is only one of that key type, the cluster just
@@ -446,17 +414,11 @@ func reencryptAndRemoveKey(ctx context.Context, control *config.Control, skip bo
446414
}
447415
}
448416

449-
if err = secretsencrypt.WriteEncryptionConfig(control.Runtime, curKeys, control.EncryptProvider, true); err != nil {
417+
if err := secretsencrypt.WriteEncryptionConfig(control.Runtime, curKeys, control.EncryptProvider, true); err != nil {
450418
return err
451419
}
452420

453-
if err = retry.RetryOnConflict(retry.DefaultRetry, func() error {
454-
node, err := control.Runtime.Core.Core().V1().Node().Get(nodeName, metav1.GetOptions{})
455-
if err != nil {
456-
return err
457-
}
458-
return secretsencrypt.WriteEncryptionHashAnnotation(control.Runtime, node, false, secretsencrypt.EncryptionReencryptFinished)
459-
}); err != nil {
421+
if err := secretsencrypt.WriteEncryptionHashAnnotation(ctx, control.Runtime, nodeName, false, secretsencrypt.EncryptionReencryptFinished); err != nil {
460422
return err
461423
}
462424

‎pkg/server/server.go‎

Lines changed: 16 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ import (
3737
"github.com/sirupsen/logrus"
3838
corev1 "k8s.io/api/core/v1"
3939
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
40+
"k8s.io/apimachinery/pkg/util/wait"
4041
clientset "k8s.io/client-go/kubernetes"
4142
)
4243

@@ -549,46 +550,30 @@ func setNodeLabelsAndAnnotations(ctx context.Context, nodes v1.NodeClient, confi
549550
if config.DisableAgent || config.ControlConfig.DisableAPIServer {
550551
return nil
551552
}
552-
for {
553+
554+
patcher := util.NewPatcher[*corev1.Node](nodes)
555+
return wait.PollUntilContextCancel(ctx, time.Second, true, func(ctx context.Context) (bool, error) {
553556
nodeName := os.Getenv("NODE_NAME")
554557
if nodeName == "" {
555558
logrus.Info("Waiting for control-plane node agent startup")
556-
time.Sleep(1 * time.Second)
557-
continue
558-
}
559-
node, err := nodes.Get(nodeName, metav1.GetOptions{})
560-
if err != nil {
561-
logrus.Infof("Waiting for control-plane node %s startup: %v", nodeName, err)
562-
time.Sleep(1 * time.Second)
563-
continue
564-
}
565-
if node.Labels == nil {
566-
node.Labels = make(map[string]string)
559+
return false, nil
567560
}
568-
v, ok := node.Labels[util.ControlPlaneRoleLabelKey]
569-
if !ok || v != "true" {
570-
node.Labels[util.ControlPlaneRoleLabelKey] = "true"
561+
562+
patch := util.NewPatchList().Add("true", "metadata", "labels", util.ControlPlaneRoleLabelKey)
563+
if _, err := patcher.Patch(ctx, patch, nodeName); err != nil {
564+
logrus.Infof("Unable to set control-plane role label: %v", err)
565+
return false, nil
571566
}
572567

573568
if config.ControlConfig.EncryptSecrets {
574-
if err = secretsencrypt.BootstrapEncryptionHashAnnotation(node, config.ControlConfig.Runtime); err != nil {
575-
logrus.Infof("Unable to set encryption hash annotation %s", err.Error())
576-
break
569+
if err := secretsencrypt.BootstrapEncryptionHashAnnotation(ctx, config.ControlConfig.Runtime, nodeName); err != nil {
570+
logrus.Infof("Unable to set encryption hash annotation %v", err)
571+
return false, nil
577572
}
578573
}
579-
580-
_, err = nodes.Update(node)
581-
if err == nil {
582-
logrus.Infof("Labels and annotations have been set successfully on node: %s", nodeName)
583-
break
584-
}
585-
select {
586-
case <-ctx.Done():
587-
return ctx.Err()
588-
case <-time.After(time.Second):
589-
}
590-
}
591-
return nil
574+
logrus.Infof("Labels and annotations have been set successfully on node: %s", nodeName)
575+
return true, nil
576+
})
592577
}
593578

594579
func setClusterDNSConfig(ctx context.Context, config *Config, configMap v1.ConfigMapClient) error {

0 commit comments

Comments
 (0)