A Kubernetes operator that bridges Hardware Security Module (HSM) data storage with Kubernetes Secrets, providing true secret portability th
fix startup errors
+65
-3
+1
-1
internal/agent/deployment.go
+1
-1
internal/agent/deployment.go
···
245
245
246
246
if needsUpdate {
247
247
// Delete existing deployment to trigger recreation
248
-
if err := m.Delete(ctx, &deployment); err != nil {
248
+
if err := m.Delete(ctx, &deployment); err != nil && !errors.IsNotFound(err) {
249
249
return fmt.Errorf("failed to delete outdated agent deployment %s: %w", work.agentName, err)
250
250
}
251
251
} else {
+53
internal/mirror/manager.go
+53
internal/mirror/manager.go
···
747
747
return fmt.Sprintf("%x", h.Sum(nil))
748
748
}
749
749
750
+
// WaitForAgentsReady waits for at least one HSM device to have ready agents
751
+
// Returns true when agents are ready, false on timeout
752
+
func (mm *MirrorManager) WaitForAgentsReady(ctx context.Context, timeout time.Duration) (bool, error) {
753
+
logger := mm.logger.WithValues("operation", "wait-for-agents")
754
+
logger.Info("Waiting for HSM agents to be ready", "timeout", timeout)
755
+
756
+
ctx, cancel := context.WithTimeout(ctx, timeout)
757
+
defer cancel()
758
+
759
+
ticker := time.NewTicker(5 * time.Second)
760
+
defer ticker.Stop()
761
+
762
+
for {
763
+
select {
764
+
case <-ctx.Done():
765
+
logger.Info("Timeout waiting for agents to be ready")
766
+
return false, ctx.Err()
767
+
768
+
case <-ticker.C:
769
+
devices, err := mm.getAvailableDevices(ctx, mm.operatorNamespace)
770
+
if err != nil {
771
+
logger.V(1).Info("Failed to check available devices", "error", err)
772
+
continue
773
+
}
774
+
775
+
if len(devices) > 0 {
776
+
// Try to connect to at least one device to verify agents are actually ready
777
+
for _, deviceName := range devices {
778
+
grpcClient, err := mm.agentManager.CreateSingleGRPCClient(ctx, deviceName, mm.operatorNamespace, logger)
779
+
if err != nil {
780
+
logger.V(1).Info("Agent not ready yet", "device", deviceName, "error", err)
781
+
continue
782
+
}
783
+
784
+
// Test connection
785
+
if grpcClient.IsConnected() {
786
+
if closeErr := grpcClient.Close(); closeErr != nil {
787
+
logger.V(1).Info("Failed to close gRPC client", "error", closeErr)
788
+
}
789
+
logger.Info("HSM agents are ready", "readyDevices", len(devices))
790
+
return true, nil
791
+
}
792
+
if closeErr := grpcClient.Close(); closeErr != nil {
793
+
logger.V(1).Info("Failed to close gRPC client", "error", closeErr)
794
+
}
795
+
}
796
+
}
797
+
798
+
logger.V(1).Info("Still waiting for agents", "availableDevices", len(devices))
799
+
}
800
+
}
801
+
}
802
+
750
803
// Helper function to parse version string
751
804
func parseVersion(versionStr string) (int64, error) {
752
805
var version int64
+11
-2
internal/modes/manager/manager.go
+11
-2
internal/modes/manager/manager.go
···
350
350
351
351
setupLog.Info("starting device-scoped HSM mirroring", "interval", "30s")
352
352
353
-
// Initial mirror attempt after 30 seconds to allow agents to start
354
-
time.Sleep(30 * time.Second)
353
+
// Wait for agents to be ready before starting mirroring
354
+
ctx := context.Background()
355
+
ready, err := mirrorManager.WaitForAgentsReady(ctx, 5*time.Minute)
356
+
if err != nil {
357
+
setupLog.Error(err, "failed to wait for agents to be ready")
358
+
return
359
+
}
360
+
if !ready {
361
+
setupLog.Info("no agents became ready within timeout, disabling mirroring")
362
+
return
363
+
}
355
364
356
365
for range mirrorTicker.C {
357
366
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)