Skip to content

Commit c5be519

Browse files
author
Jeff McCormick
committed
fix bug where secrets where getting deleted if --delete-data was not specified, this prevented a new cluster with the same name from being able to auth into the original pg
1 parent 78d8f03 commit c5be519

File tree

5 files changed

+149
-108
lines changed

5 files changed

+149
-108
lines changed

‎apiserver/clusterservice/clusterimpl.go

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,7 @@ func DeleteCluster(name, selector string, deleteData, deleteBackups bool) msgs.D
7373
for _, cluster := range clusterList.Items {
7474

7575
if deleteData {
76+
deleteDatabaseSecrets(cluster.Spec.Name)
7677
createDeleteDataTasks(cluster.Spec.Name, cluster.Spec.PrimaryStorage, deleteBackups)
7778
}
7879

@@ -1014,3 +1015,17 @@ func validateBackrestConfig(labels map[string]string) error {
10141015
return err
10151016

10161017
}
1018+
1019+
// deleteDatabaseSecrets delete secrets that match pg-database=somecluster
1020+
func deleteDatabaseSecrets(db string) {
1021+
//get all that match pg-database=db
1022+
selector := util.LABEL_PG_DATABASE + "=" + db
1023+
secrets, err := kubeapi.GetSecrets(apiserver.Clientset, selector, apiserver.Namespace)
1024+
if err != nil {
1025+
return
1026+
}
1027+
1028+
for _, s := range secrets.Items {
1029+
kubeapi.DeleteSecret(apiserver.Clientset, s.ObjectMeta.Name, apiserver.Namespace)
1030+
}
1031+
}

‎apiserver/userservice/userimpl.go

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ import (
2626
"github.com/crunchydata/postgres-operator/kubeapi"
2727
"github.com/crunchydata/postgres-operator/util"
2828
_ "github.com/lib/pq"
29+
"k8s.io/client-go/kubernetes"
2930
"strconv"
3031
"time"
3132
)
@@ -414,7 +415,9 @@ func deleteUser(namespace, clusterName string, info connInfo, user string, manag
414415
}()
415416

416417
if managed {
417-
err = util.DeleteUserSecret(apiserver.Clientset, clusterName, user, namespace)
418+
//delete current secret
419+
secretName := clusterName + "-" + user + "-secret"
420+
err := kubeapi.DeleteSecret(apiserver.Clientset, secretName, namespace)
418421
if err != nil {
419422
log.Error(err.Error())
420423
return err
@@ -597,3 +600,11 @@ func ShowUser(name, selector string) msgs.ShowUserResponse {
597600
return response
598601

599602
}
603+
604+
func deleteUserSecret(clientset *kubernetes.Clientset, clustername, username, namespace string) error {
605+
//delete current secret
606+
secretName := clustername + "-" + username + "-secret"
607+
608+
err := kubeapi.DeleteSecret(clientset, secretName, namespace)
609+
return err
610+
}

‎operator/cluster/cluster.go

Lines changed: 93 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -178,7 +178,7 @@ func AddClusterBase(clientset *kubernetes.Clientset, client *rest.RESTClient, cl
178178
}
179179

180180
var testPassword string
181-
_, _, testPassword, err = util.CreateDatabaseSecrets(clientset, client, cl, namespace)
181+
_, _, testPassword, err = createDatabaseSecrets(clientset, client, cl, namespace)
182182
if err != nil {
183183
log.Error("error in create secrets " + err.Error())
184184
return
@@ -198,9 +198,9 @@ func AddClusterBase(clientset *kubernetes.Clientset, client *rest.RESTClient, cl
198198
}
199199

200200
//add pgpool deployment if requested
201-
if cl.Spec.UserLabels["crunchy-pgpool"] == "true" {
201+
if cl.Spec.UserLabels[util.LABEL_PGPOOL_SECRET] == "true" {
202202
//generate a secret for pgpool using the testuser credential
203-
secretName := cl.Spec.Name + "-pgpool-secret"
203+
secretName := cl.Spec.Name + "-" + util.LABEL_PGPOOL_SECRET
204204
primaryName := cl.Spec.Name
205205
replicaName := cl.Spec.Name + "-replica"
206206
err = CreatePgpoolSecret(clientset, primaryName, replicaName, primaryName, secretName, "testuser", testPassword, namespace)
@@ -248,8 +248,6 @@ func DeleteClusterBase(clientset *kubernetes.Clientset, client *rest.RESTClient,
248248
return
249249
}
250250

251-
util.DeleteDatabaseSecrets(clientset, cl.Spec.Name, namespace)
252-
253251
strategy.DeleteCluster(clientset, client, cl, namespace)
254252

255253
err := kubeapi.Deletepgupgrade(client, cl.Spec.Name, namespace)
@@ -423,3 +421,93 @@ func ScaleDownBase(clientset *kubernetes.Clientset, client *rest.RESTClient, rep
423421
strategy.DeleteReplica(clientset, replica, namespace)
424422

425423
}
424+
425+
/**
426+
import (
427+
log "github.com/Sirupsen/logrus"
428+
crv1 "github.com/crunchydata/postgres-operator/apis/cr/v1"
429+
msgs "github.com/crunchydata/postgres-operator/apiservermsgs"
430+
"github.com/crunchydata/postgres-operator/kubeapi"
431+
"k8s.io/api/core/v1"
432+
"k8s.io/client-go/kubernetes"
433+
//"k8s.io/client-go/rest"
434+
"math/rand"
435+
"strings"
436+
"time"
437+
)
438+
439+
*/
440+
// createDatabaseSecrets create pgroot, pgprimary, and pguser secrets
441+
func createDatabaseSecrets(clientset *kubernetes.Clientset, restclient *rest.RESTClient, cl *crv1.Pgcluster, namespace string) (string, string, string, error) {
442+
443+
//pgroot
444+
username := "postgres"
445+
suffix := crv1.RootSecretSuffix
446+
447+
var secretName string
448+
var err error
449+
450+
secretName = cl.Spec.Name + suffix
451+
pgPassword := util.GeneratePassword(10)
452+
if cl.Spec.RootPassword != "" {
453+
log.Debug("using user specified password for secret " + secretName)
454+
pgPassword = cl.Spec.RootPassword
455+
}
456+
457+
err = util.CreateSecret(clientset, cl.Spec.Name, secretName, username, pgPassword, namespace)
458+
if err != nil {
459+
log.Error("error creating secret" + err.Error())
460+
}
461+
462+
cl.Spec.RootSecretName = secretName
463+
err = util.Patch(restclient, "/spec/rootsecretname", secretName, crv1.PgclusterResourcePlural, cl.Spec.Name, namespace)
464+
if err != nil {
465+
log.Error("error patching cluster" + err.Error())
466+
}
467+
468+
///primary
469+
username = "primaryuser"
470+
suffix = crv1.PrimarySecretSuffix
471+
472+
secretName = cl.Spec.Name + suffix
473+
primaryPassword := util.GeneratePassword(10)
474+
if cl.Spec.PrimaryPassword != "" {
475+
log.Debug("using user specified password for secret " + secretName)
476+
primaryPassword = cl.Spec.PrimaryPassword
477+
}
478+
479+
err = util.CreateSecret(clientset, cl.Spec.Name, secretName, username, primaryPassword, namespace)
480+
if err != nil {
481+
log.Error("error creating secret2" + err.Error())
482+
}
483+
484+
cl.Spec.PrimarySecretName = secretName
485+
err = util.Patch(restclient, "/spec/primarysecretname", secretName, crv1.PgclusterResourcePlural, cl.Spec.Name, namespace)
486+
if err != nil {
487+
log.Error("error patching cluster " + err.Error())
488+
}
489+
490+
///pguser
491+
username = "testuser"
492+
suffix = crv1.UserSecretSuffix
493+
494+
secretName = cl.Spec.Name + suffix
495+
testPassword := util.GeneratePassword(10)
496+
if cl.Spec.Password != "" {
497+
log.Debug("using user specified password for secret " + secretName)
498+
testPassword = cl.Spec.Password
499+
}
500+
501+
err = util.CreateSecret(clientset, cl.Spec.Name, secretName, username, testPassword, namespace)
502+
if err != nil {
503+
log.Error("error creating secret " + err.Error())
504+
}
505+
506+
cl.Spec.UserSecretName = secretName
507+
err = util.Patch(restclient, "/spec/usersecretname", secretName, crv1.PgclusterResourcePlural, cl.Spec.Name, namespace)
508+
if err != nil {
509+
log.Error("error patching cluster " + err.Error())
510+
}
511+
512+
return pgPassword, primaryPassword, testPassword, err
513+
}

‎util/failover.go

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -154,7 +154,7 @@ func GetRepStatus(restclient *rest.RESTClient, clientset *kubernetes.Clientset,
154154

155155
//get the postgres secret for this dep
156156
var secretInfo []msgs.ShowUserSecret
157-
secretInfo, err = GetSecrets(clientset, &cluster, namespace)
157+
secretInfo, err = getSecrets(clientset, &cluster, namespace)
158158
var pgSecret msgs.ShowUserSecret
159159
var found bool
160160
for _, si := range secretInfo {
@@ -260,3 +260,26 @@ func GetReplicationInfo(target string) (*ReplicationInfo, error) {
260260

261261
return &ReplicationInfo{recvLocation, replayLocation}, nil
262262
}
263+
264+
func getSecrets(clientset *kubernetes.Clientset, cluster *crv1.Pgcluster, namespace string) ([]msgs.ShowUserSecret, error) {
265+
266+
output := make([]msgs.ShowUserSecret, 0)
267+
selector := "pgpool!=true," + LABEL_PG_DATABASE + "=" + cluster.Spec.Name
268+
269+
secrets, err := kubeapi.GetSecrets(clientset, selector, namespace)
270+
if err != nil {
271+
return output, err
272+
}
273+
274+
log.Debugf("got %d secrets for %s\n", len(secrets.Items), cluster.Spec.Name)
275+
for _, s := range secrets.Items {
276+
d := msgs.ShowUserSecret{}
277+
d.Name = s.Name
278+
d.Username = string(s.Data["username"][:])
279+
d.Password = string(s.Data["password"][:])
280+
output = append(output, d)
281+
282+
}
283+
284+
return output, err
285+
}

‎util/secrets.go

Lines changed: 5 additions & 101 deletions
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,12 @@ package util
1717

1818
import (
1919
log "github.com/Sirupsen/logrus"
20-
crv1 "github.com/crunchydata/postgres-operator/apis/cr/v1"
21-
msgs "github.com/crunchydata/postgres-operator/apiservermsgs"
20+
//crv1 "github.com/crunchydata/postgres-operator/apis/cr/v1"
21+
//msgs "github.com/crunchydata/postgres-operator/apiservermsgs"
2222
"github.com/crunchydata/postgres-operator/kubeapi"
2323
"k8s.io/api/core/v1"
2424
"k8s.io/client-go/kubernetes"
25-
"k8s.io/client-go/rest"
25+
//"k8s.io/client-go/rest"
2626
"math/rand"
2727
"strings"
2828
"time"
@@ -36,81 +36,6 @@ const charset = "abcdefghijklmnopqrstuvwxyz" +
3636
var seededRand = rand.New(
3737
rand.NewSource(time.Now().UnixNano()))
3838

39-
// CreateDatabaseSecrets create pgroot, pgprimary, and pguser secrets
40-
func CreateDatabaseSecrets(clientset *kubernetes.Clientset, restclient *rest.RESTClient, cl *crv1.Pgcluster, namespace string) (string, string, string, error) {
41-
42-
//pgroot
43-
username := "postgres"
44-
suffix := crv1.RootSecretSuffix
45-
46-
var secretName string
47-
var err error
48-
49-
secretName = cl.Spec.Name + suffix
50-
pgPassword := GeneratePassword(10)
51-
if cl.Spec.RootPassword != "" {
52-
log.Debug("using user specified password for secret " + secretName)
53-
pgPassword = cl.Spec.RootPassword
54-
}
55-
56-
err = CreateSecret(clientset, cl.Spec.Name, secretName, username, pgPassword, namespace)
57-
if err != nil {
58-
log.Error("error creating secret" + err.Error())
59-
}
60-
61-
cl.Spec.RootSecretName = secretName
62-
err = Patch(restclient, "/spec/rootsecretname", secretName, crv1.PgclusterResourcePlural, cl.Spec.Name, namespace)
63-
if err != nil {
64-
log.Error("error patching cluster" + err.Error())
65-
}
66-
67-
///primary
68-
username = "primaryuser"
69-
suffix = crv1.PrimarySecretSuffix
70-
71-
secretName = cl.Spec.Name + suffix
72-
primaryPassword := GeneratePassword(10)
73-
if cl.Spec.PrimaryPassword != "" {
74-
log.Debug("using user specified password for secret " + secretName)
75-
primaryPassword = cl.Spec.PrimaryPassword
76-
}
77-
78-
err = CreateSecret(clientset, cl.Spec.Name, secretName, username, primaryPassword, namespace)
79-
if err != nil {
80-
log.Error("error creating secret2" + err.Error())
81-
}
82-
83-
cl.Spec.PrimarySecretName = secretName
84-
err = Patch(restclient, "/spec/primarysecretname", secretName, crv1.PgclusterResourcePlural, cl.Spec.Name, namespace)
85-
if err != nil {
86-
log.Error("error patching cluster " + err.Error())
87-
}
88-
89-
///pguser
90-
username = "testuser"
91-
suffix = crv1.UserSecretSuffix
92-
93-
secretName = cl.Spec.Name + suffix
94-
testPassword := GeneratePassword(10)
95-
if cl.Spec.Password != "" {
96-
log.Debug("using user specified password for secret " + secretName)
97-
testPassword = cl.Spec.Password
98-
}
99-
100-
err = CreateSecret(clientset, cl.Spec.Name, secretName, username, testPassword, namespace)
101-
if err != nil {
102-
log.Error("error creating secret " + err.Error())
103-
}
104-
105-
cl.Spec.UserSecretName = secretName
106-
err = Patch(restclient, "/spec/usersecretname", secretName, crv1.PgclusterResourcePlural, cl.Spec.Name, namespace)
107-
if err != nil {
108-
log.Error("error patching cluster " + err.Error())
109-
}
110-
111-
return pgPassword, primaryPassword, testPassword, err
112-
}
113-
11439
// CreateSecret create the secret, user, and primary secrets
11540
func CreateSecret(clientset *kubernetes.Clientset, db, secretName, username, password, namespace string) error {
11641

@@ -150,20 +75,6 @@ func GenerateRandString(length int) string {
15075
return stringWithCharset(length, lowercharset)
15176
}
15277

153-
// DeleteDatabaseSecrets delete secrets that match pg-database=somecluster
154-
func DeleteDatabaseSecrets(clientset *kubernetes.Clientset, db, namespace string) {
155-
//get all that match pg-database=db
156-
selector := "pg-database=" + db
157-
secrets, err := kubeapi.GetSecrets(clientset, selector, namespace)
158-
if err != nil {
159-
return
160-
}
161-
162-
for _, s := range secrets.Items {
163-
kubeapi.DeleteSecret(clientset, s.ObjectMeta.Name, namespace)
164-
}
165-
}
166-
16778
// GetPasswordFromSecret will fetch the username, password from a user secret
16879
func GetPasswordFromSecret(clientset *kubernetes.Clientset, namespace string, secretName string) (string, string, error) {
16980

@@ -251,15 +162,7 @@ func UpdateUserSecret(clientset *kubernetes.Clientset, clustername, username, pa
251162
return err
252163
}
253164

254-
// DeleteUserSecret will delete a user secret
255-
func DeleteUserSecret(clientset *kubernetes.Clientset, clustername, username, namespace string) error {
256-
//delete current secret
257-
secretName := clustername + "-" + username + "-secret"
258-
259-
err := kubeapi.DeleteSecret(clientset, secretName, namespace)
260-
return err
261-
}
262-
165+
/**
263166
func GetSecrets(clientset *kubernetes.Clientset, cluster *crv1.Pgcluster, namespace string) ([]msgs.ShowUserSecret, error) {
264167
265168
output := make([]msgs.ShowUserSecret, 0)
@@ -282,3 +185,4 @@ func GetSecrets(clientset *kubernetes.Clientset, cluster *crv1.Pgcluster, namesp
282185
283186
return output, err
284187
}
188+
*/

0 commit comments

Comments
 (0)