Skip to content

Commit 13d6594

Browse files
dmotteFxKu
dmotte
and
FxKu
authored
Secrets deletion config (zalando#2582)
* Secrets deletion config * Update e2e/tests/test_e2e.py Co-authored-by: Felix Kunde <felix-kunde@gmx.de> --------- Co-authored-by: Felix Kunde <felix-kunde@gmx.de>
1 parent 8ee5231 commit 13d6594

File tree

13 files changed

+35
-5
lines changed

13 files changed

+35
-5
lines changed

‎charts/postgres-operator/crds/operatorconfigurations.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -211,6 +211,9 @@ spec:
211211
enable_init_containers:
212212
type: boolean
213213
default: true
214+
enable_secrets_deletion:
215+
type: boolean
216+
default: true
214217
enable_persistent_volume_claim_deletion:
215218
type: boolean
216219
default: true

‎charts/postgres-operator/values.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,8 @@ configKubernetes:
129129
enable_finalizers: false
130130
# enables initContainers to run actions before Spilo is started
131131
enable_init_containers: true
132+
# toggles if operator should delete secrets on cluster deletion
133+
enable_secrets_deletion: true
132134
# toggles if operator should delete PVCs on cluster deletion
133135
enable_persistent_volume_claim_deletion: true
134136
# toggles pod anti affinity on the Postgres pods

‎docs/reference/operator_parameters.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -360,6 +360,10 @@ configuration they are grouped under the `kubernetes` key.
360360
`"retain"` - or `when_scaled` - default is also `"retain"`. The other possible
361361
option is `delete`.
362362

363+
* **enable_secrets_deletion**
364+
By default, the operator deletes secrets when removing the Postgres cluster
365+
manifest. To keep secrets, set this option to `false`. The default is `true`.
366+
363367
* **enable_persistent_volume_claim_deletion**
364368
By default, the operator deletes PersistentVolumeClaims when removing the
365369
Postgres cluster manifest, no matter if `persistent_volume_claim_retention_policy`

‎e2e/tests/test_e2e.py

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2049,6 +2049,7 @@ def test_zz_cluster_deletion(self):
20492049
"data": {
20502050
"delete_annotation_date_key": "delete-date",
20512051
"delete_annotation_name_key": "delete-clustername",
2052+
"enable_secrets_deletion": "false",
20522053
"enable_persistent_volume_claim_deletion": "false"
20532054
}
20542055
}
@@ -2109,7 +2110,7 @@ def test_zz_cluster_deletion(self):
21092110
self.eventuallyEqual(lambda: k8s.count_statefulsets_with_label(cluster_label), 0, "Statefulset not deleted")
21102111
self.eventuallyEqual(lambda: k8s.count_deployments_with_label(cluster_label), 0, "Deployments not deleted")
21112112
self.eventuallyEqual(lambda: k8s.count_pdbs_with_label(cluster_label), 0, "Pod disruption budget not deleted")
2112-
self.eventuallyEqual(lambda: k8s.count_secrets_with_label(cluster_label), 0, "Secrets not deleted")
2113+
self.eventuallyEqual(lambda: k8s.count_secrets_with_label(cluster_label), 7, "Secrets were deleted although disabled in config")
21132114
self.eventuallyEqual(lambda: k8s.count_pvcs_with_label(cluster_label), 3, "PVCs were deleted although disabled in config")
21142115

21152116
except timeout_decorator.TimeoutError:

‎manifests/configmap.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@ data:
4949
enable_master_pooler_load_balancer: "false"
5050
enable_password_rotation: "false"
5151
enable_patroni_failsafe_mode: "false"
52+
enable_secrets_deletion: "true"
5253
enable_persistent_volume_claim_deletion: "true"
5354
enable_pgversion_env_var: "true"
5455
# enable_pod_antiaffinity: "false"

‎manifests/operatorconfiguration.crd.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -209,6 +209,9 @@ spec:
209209
enable_init_containers:
210210
type: boolean
211211
default: true
212+
enable_secrets_deletion:
213+
type: boolean
214+
default: true
212215
enable_persistent_volume_claim_deletion:
213216
type: boolean
214217
default: true

‎manifests/postgresql-operator-default-configuration.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,7 @@ configuration:
5959
# enable_cross_namespace_secret: "false"
6060
enable_finalizers: false
6161
enable_init_containers: true
62+
enable_secrets_deletion: true
6263
enable_persistent_volume_claim_deletion: true
6364
enable_pod_antiaffinity: false
6465
enable_pod_disruption_budget: true

‎pkg/apis/acid.zalan.do/v1/crds.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1323,6 +1323,9 @@ var OperatorConfigCRDResourceValidation = apiextv1.CustomResourceValidation{
13231323
"enable_init_containers": {
13241324
Type: "boolean",
13251325
},
1326+
"enable_secrets_deletion": {
1327+
Type: "boolean",
1328+
},
13261329
"enable_persistent_volume_claim_deletion": {
13271330
Type: "boolean",
13281331
},

‎pkg/apis/acid.zalan.do/v1/operator_configuration_type.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,7 @@ type KubernetesMetaConfiguration struct {
102102
PodAntiAffinityTopologyKey string `json:"pod_antiaffinity_topology_key,omitempty"`
103103
PodManagementPolicy string `json:"pod_management_policy,omitempty"`
104104
PersistentVolumeClaimRetentionPolicy map[string]string `json:"persistent_volume_claim_retention_policy,omitempty"`
105+
EnableSecretsDeletion *bool `json:"enable_secrets_deletion,omitempty"`
105106
EnablePersistentVolumeClaimDeletion *bool `json:"enable_persistent_volume_claim_deletion,omitempty"`
106107
EnableReadinessProbe bool `json:"enable_readiness_probe,omitempty"`
107108
EnableCrossNamespaceSecret bool `json:"enable_cross_namespace_secret,omitempty"`

‎pkg/apis/acid.zalan.do/v1/zz_generated.deepcopy.go

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/cluster/cluster.go

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1154,10 +1154,14 @@ func (c *Cluster) Delete() error {
11541154
c.eventRecorder.Eventf(c.GetReference(), v1.EventTypeWarning, "Delete", "could not delete statefulset: %v", err)
11551155
}
11561156

1157-
if err := c.deleteSecrets(); err != nil {
1158-
anyErrors = true
1159-
c.logger.Warningf("could not delete secrets: %v", err)
1160-
c.eventRecorder.Eventf(c.GetReference(), v1.EventTypeWarning, "Delete", "could not delete secrets: %v", err)
1157+
if c.OpConfig.EnableSecretsDeletion != nil && *c.OpConfig.EnableSecretsDeletion {
1158+
if err := c.deleteSecrets(); err != nil {
1159+
anyErrors = true
1160+
c.logger.Warningf("could not delete secrets: %v", err)
1161+
c.eventRecorder.Eventf(c.GetReference(), v1.EventTypeWarning, "Delete", "could not delete secrets: %v", err)
1162+
}
1163+
} else {
1164+
c.logger.Info("not deleting secrets because disabled in configuration")
11611165
}
11621166

11631167
if err := c.deletePodDisruptionBudget(); err != nil {

‎pkg/controller/operator_config.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -122,6 +122,7 @@ func (c *Controller) importConfigurationFromCRD(fromCRD *acidv1.OperatorConfigur
122122
result.PodPriorityClassName = fromCRD.Kubernetes.PodPriorityClassName
123123
result.PodManagementPolicy = util.Coalesce(fromCRD.Kubernetes.PodManagementPolicy, "ordered_ready")
124124
result.PersistentVolumeClaimRetentionPolicy = fromCRD.Kubernetes.PersistentVolumeClaimRetentionPolicy
125+
result.EnableSecretsDeletion = util.CoalesceBool(fromCRD.Kubernetes.EnableSecretsDeletion, util.True())
125126
result.EnablePersistentVolumeClaimDeletion = util.CoalesceBool(fromCRD.Kubernetes.EnablePersistentVolumeClaimDeletion, util.True())
126127
result.EnableReadinessProbe = fromCRD.Kubernetes.EnableReadinessProbe
127128
result.MasterPodMoveTimeout = util.CoalesceDuration(time.Duration(fromCRD.Kubernetes.MasterPodMoveTimeout), "10m")

‎pkg/util/config/config.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -250,6 +250,7 @@ type Config struct {
250250
PatroniAPICheckInterval time.Duration `name:"patroni_api_check_interval" default:"1s"`
251251
PatroniAPICheckTimeout time.Duration `name:"patroni_api_check_timeout" default:"5s"`
252252
EnablePatroniFailsafeMode *bool `name:"enable_patroni_failsafe_mode" default:"false"`
253+
EnableSecretsDeletion *bool `name:"enable_secrets_deletion" default:"true"`
253254
EnablePersistentVolumeClaimDeletion *bool `name:"enable_persistent_volume_claim_deletion" default:"true"`
254255
PersistentVolumeClaimRetentionPolicy map[string]string `name:"persistent_volume_claim_retention_policy" default:"when_deleted:retain,when_scaled:retain"`
255256
}

0 commit comments

Comments
 (0)