fixes · evan.jarrett.net/hsm-secrets-operator@664d910

+1 -1

Makefile

··· 3 3 # To re-generate a bundle for another specific version without changing the standard setup, you can: 4 4 # - use the VERSION as arg of the bundle target (e.g make bundle VERSION=0.0.2) 5 5 # - use environment variables to overwrite this value (e.g export VERSION=0.0.2) 6 - VERSION ?= 0.5.24 6 + VERSION ?= 0.5.25 7 7 8 8 # CHANNELS define the bundle channels used in the bundle. 9 9 # Add a new line here if you would like to change its default config. (E.g CHANNELS = "candidate,fast,stable")

+2 -2

helm/hsm-secrets-operator/Chart.yaml

··· 2 2 name: hsm-secrets-operator 3 3 description: A Kubernetes operator that bridges Pico HSM binary data storage with Kubernetes Secrets 4 4 type: application 5 - version: 0.5.24 6 - appVersion: v0.5.24 5 + version: 0.5.25 6 + appVersion: v0.5.25 7 7 icon: https://raw.githubusercontent.com/cncf/artwork/master/projects/kubernetes/icon/color/kubernetes-icon-color.svg 8 8 home: https://github.com/evanjarrett/hsm-secrets-operator 9 9 sources:

+1 -1

internal/agent/manager.go

··· 156 156 workItems = append(workItems, deviceWork{ 157 157 device: aggregatedDevice, 158 158 agentName: fmt.Sprintf("%s-%d", m.generateAgentName(hsmPool), i), 159 - agentKey: aggregatedDevice.SerialNumber, 159 + agentKey: fmt.Sprintf("%s-%s", hsmPool.OwnerReferences[0].Name, aggregatedDevice.SerialNumber), 160 160 index: i, 161 161 }) 162 162 }

+16 -2

internal/controller/hsmsecret_controller.go

··· 45 45 46 46 // DefaultSyncInterval is the default sync interval in seconds 47 47 DefaultSyncInterval = 30 48 + 49 + // StartupGracePeriod is the duration during which "no agents available" is logged at Info level 50 + StartupGracePeriod = 2 * time.Minute 48 51 ) 49 52 50 53 // HSMSecretReconciler reconciles a HSMSecret object ··· 54 57 AgentManager *agent.Manager 55 58 OperatorNamespace string 56 59 OperatorName string 60 + StartupTime time.Time 57 61 } 58 62 59 63 // HSMDeviceClients holds multiple HSM devices and their clients ··· 139 143 // Find available devices via AgentManager 140 144 devices, err := r.AgentManager.GetAvailableDevices(ctx, r.OperatorNamespace) 141 145 if err != nil { 142 - logger.Error(err, "Failed to get available devices") 146 + // During startup grace period, log at Info level to reduce noise 147 + if time.Since(r.StartupTime) < StartupGracePeriod { 148 + logger.Info("No HSM agents available yet (startup grace period)", "error", err.Error(), "elapsed", time.Since(r.StartupTime).Round(time.Second)) 149 + } else { 150 + logger.Error(err, "Failed to get available devices") 151 + } 143 152 return ctrl.Result{RequeueAfter: time.Minute * 2}, nil 144 153 } 145 154 if len(devices) == 0 { 146 - logger.Info("No HSM devices available") 155 + // During startup grace period, log at Info level to reduce noise 156 + if time.Since(r.StartupTime) < StartupGracePeriod { 157 + logger.Info("No HSM devices available yet (startup grace period)", "elapsed", time.Since(r.StartupTime).Round(time.Second)) 158 + } else { 159 + logger.Info("No HSM devices available") 160 + } 147 161 return ctrl.Result{RequeueAfter: time.Minute * 2}, nil 148 162 } 149 163

+7 -7

internal/mirror/manager.go

··· 611 611 return nil 612 612 } 613 613 614 - // getAvailableDevices gets list of available physical HSM device instances from HSMPools in the operator namespace 615 - func (mm *MirrorManager) getAvailableDevices(ctx context.Context, operatorNamespace string) ([]string, error) { 614 + // getAvailableDevices gets list of available physical HSM device instances from HSMPools cluster-wide 615 + func (mm *MirrorManager) getAvailableDevices(ctx context.Context) ([]string, error) { 616 616 var hsmPoolList hsmv1alpha1.HSMPoolList 617 - // HSMPools are always in the operator namespace (where controller-manager runs) 618 - if err := mm.client.List(ctx, &hsmPoolList, client.InNamespace(operatorNamespace)); err != nil { 619 - return nil, fmt.Errorf("failed to list HSM pools in operator namespace %s: %w", operatorNamespace, err) 617 + // List HSMPools cluster-wide since they exist in the same namespace as their HSMDevices 618 + if err := mm.client.List(ctx, &hsmPoolList); err != nil { 619 + return nil, fmt.Errorf("failed to list HSM pools cluster-wide: %w", err) 620 620 } 621 621 622 622 var devices = []string{} ··· 645 645 logger.Info("Starting device-scoped mirroring of all HSM secrets") 646 646 647 647 // Get all available HSM devices 648 - devices, err := mm.getAvailableDevices(ctx, mm.operatorNamespace) 648 + devices, err := mm.getAvailableDevices(ctx) 649 649 if err != nil { 650 650 return nil, fmt.Errorf("failed to get available devices: %w", err) 651 651 } ··· 758 758 return false, ctx.Err() 759 759 760 760 case <-ticker.C: 761 - devices, err := mm.getAvailableDevices(ctx, mm.operatorNamespace) 761 + devices, err := mm.getAvailableDevices(ctx) 762 762 if err != nil { 763 763 logger.V(1).Info("Failed to check available devices", "error", err) 764 764 continue

+1 -1

internal/mirror/manager_test.go

··· 642 642 mockAgentManager := NewMockAgentManager() 643 643 mirrorManager := NewMirrorManager(client, mockAgentManager, logr.Discard(), "test-namespace") 644 644 645 - devices, err := mirrorManager.getAvailableDevices(context.Background(), "test-namespace") 645 + devices, err := mirrorManager.getAvailableDevices(context.Background()) 646 646 647 647 require.NoError(t, err) 648 648 assert.ElementsMatch(t, []string{"pico-hsm-0", "pico-hsm-1"}, devices)

+1

internal/modes/manager/manager.go

··· 286 286 AgentManager: agentManager, 287 287 OperatorNamespace: operatorNamespace, 288 288 OperatorName: operatorName, 289 + StartupTime: time.Now(), 289 290 }).SetupWithManager(mgr); err != nil { 290 291 setupLog.Error(err, "unable to create controller", "controller", "HSMSecret") 291 292 return err

Configure Feed

Configure Feed