Skip to content

Commit 0508266

Browse files
authored
Remove all secrets on delete incl. pooler (zalando#1091)
* fix syncSecrets and remove pooler secret * update log for deleteSecret * use c.credentialSecretName(username) * minor fix
1 parent 43163cf commit 0508266

File tree

5 files changed

+39
-11
lines changed

5 files changed

+39
-11
lines changed

go.mod

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,8 @@ require (
1010
github.com/sirupsen/logrus v1.6.0
1111
github.com/stretchr/testify v1.5.1
1212
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9
13-
golang.org/x/tools v0.0.0-20200729041821-df70183b1872 // indirect
13+
golang.org/x/tools v0.0.0-20200809012840-6f4f008689da // indirect
14+
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
1415
gopkg.in/yaml.v2 v2.2.8
1516
k8s.io/api v0.18.6
1617
k8s.io/apiextensions-apiserver v0.18.6

go.sum

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -395,12 +395,14 @@ golang.org/x/tools v0.0.0-20190614205625-5aca471b1d59/go.mod h1:/rFqwRUd4F7ZHNgw
395395
golang.org/x/tools v0.0.0-20190617190820-da514acc4774/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
396396
golang.org/x/tools v0.0.0-20190920225731-5eefd052ad72/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
397397
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
398-
golang.org/x/tools v0.0.0-20200729041821-df70183b1872 h1:/U95VAvB4ZsR91rpZX2MwiKpejhWr+UxJ+N2VlJuESk=
399-
golang.org/x/tools v0.0.0-20200729041821-df70183b1872/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
398+
golang.org/x/tools v0.0.0-20200809012840-6f4f008689da h1:ml5G98G4/tdKT1XNq+ky5iSRdKKux0TANlLAzmXT/hg=
399+
golang.org/x/tools v0.0.0-20200809012840-6f4f008689da/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
400400
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
401401
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
402402
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
403403
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
404+
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
405+
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
404406
google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
405407
google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
406408
google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=

pkg/cluster/cluster.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -124,7 +124,7 @@ func New(cfg Config, kubeClient k8sutil.KubernetesClient, pgSpec acidv1.Postgres
124124

125125
return fmt.Sprintf("%s-%s", e.PodName, e.ResourceVersion), nil
126126
})
127-
password_encryption, ok := pgSpec.Spec.PostgresqlParam.Parameters["password_encryption"]
127+
password_encryption, ok := pgSpec.Spec.PostgresqlParam.Parameters["password_encryption"]
128128
if !ok {
129129
password_encryption = "md5"
130130
}

pkg/cluster/resources.go

Lines changed: 31 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -207,8 +207,6 @@ func (c *Cluster) deleteConnectionPooler() (err error) {
207207
serviceName = service.Name
208208
}
209209

210-
// set delete propagation policy to foreground, so that all the dependent
211-
// will be deleted.
212210
err = c.KubeClient.
213211
Services(c.Namespace).
214212
Delete(context.TODO(), serviceName, options)
@@ -221,6 +219,21 @@ func (c *Cluster) deleteConnectionPooler() (err error) {
221219

222220
c.logger.Infof("Connection pooler service %q has been deleted", serviceName)
223221

222+
// Repeat the same for the secret object
223+
secretName := c.credentialSecretName(c.OpConfig.ConnectionPooler.User)
224+
225+
secret, err := c.KubeClient.
226+
Secrets(c.Namespace).
227+
Get(context.TODO(), secretName, metav1.GetOptions{})
228+
229+
if err != nil {
230+
c.logger.Debugf("could not get connection pooler secret %q: %v", secretName, err)
231+
} else {
232+
if err = c.deleteSecret(secret.UID, *secret); err != nil {
233+
return fmt.Errorf("could not delete pooler secret: %v", err)
234+
}
235+
}
236+
224237
c.ConnectionPooler = nil
225238
return nil
226239
}
@@ -730,14 +743,11 @@ func (c *Cluster) deleteSecrets() error {
730743
var errors []string
731744
errorCount := 0
732745
for uid, secret := range c.Secrets {
733-
c.logger.Debugf("deleting secret %q", util.NameFromMeta(secret.ObjectMeta))
734-
err := c.KubeClient.Secrets(secret.Namespace).Delete(context.TODO(), secret.Name, c.deleteOptions)
746+
err := c.deleteSecret(uid, *secret)
735747
if err != nil {
736-
errors = append(errors, fmt.Sprintf("could not delete secret %q: %v", util.NameFromMeta(secret.ObjectMeta), err))
748+
errors = append(errors, fmt.Sprintf("%v", err))
737749
errorCount++
738750
}
739-
c.logger.Infof("secret %q has been deleted", util.NameFromMeta(secret.ObjectMeta))
740-
c.Secrets[uid] = nil
741751
}
742752

743753
if errorCount > 0 {
@@ -747,6 +757,20 @@ func (c *Cluster) deleteSecrets() error {
747757
return nil
748758
}
749759

760+
func (c *Cluster) deleteSecret(uid types.UID, secret v1.Secret) error {
761+
c.setProcessName("deleting secret")
762+
secretName := util.NameFromMeta(secret.ObjectMeta)
763+
c.logger.Debugf("deleting secret %q", secretName)
764+
err := c.KubeClient.Secrets(secret.Namespace).Delete(context.TODO(), secret.Name, c.deleteOptions)
765+
if err != nil {
766+
return fmt.Errorf("could not delete secret %q: %v", secretName, err)
767+
}
768+
c.logger.Infof("secret %q has been deleted", secretName)
769+
c.Secrets[uid] = nil
770+
771+
return nil
772+
}
773+
750774
func (c *Cluster) createRoles() (err error) {
751775
// TODO: figure out what to do with duplicate names (humans and robots) among pgUsers
752776
return c.syncRoles()

pkg/cluster/sync.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -500,6 +500,7 @@ func (c *Cluster) syncSecrets() error {
500500
c.logger.Warningf("secret %q does not contain the role %q", secretSpec.Name, secretUsername)
501501
continue
502502
}
503+
c.Secrets[secret.UID] = secret
503504
c.logger.Debugf("secret %q already exists, fetching its password", util.NameFromMeta(secret.ObjectMeta))
504505
if secretUsername == c.systemUsers[constants.SuperuserKeyName].Name {
505506
secretUsername = constants.SuperuserKeyName

0 commit comments

Comments
 (0)