allow annotations and honor gc

charts/bitwarden-crd-operator/Chart.yaml

@@ -32,22 +32,22 @@ annotations:
       url: https://github.com/Lerentis/bitwarden-crd-operator
   artifacthub.io/crds: |
     - kind: BitwardenSecret
-      version: v1beta5
+      version: v1beta6
       name: bitwarden-secret
       displayName: Bitwarden Secret
       description: Management Object to create secrets from bitwarden
     - kind: RegistryCredential
-      version: v1beta5
+      version: v1beta6
       name: registry-credential
       displayName: Regestry Credentials
       description: Management Object to create regestry secrets from bitwarden
     - kind: BitwardenTemplate
-      version: v1beta5
+      version: v1beta6
       name: bitwarden-template
       displayName: Bitwarden Template
       description: Management Object to create secrets from a jinja template with a bitwarden lookup
   artifacthub.io/crdsExamples: |
-    - apiVersion: lerentis.uploadfilter24.eu/v1beta5
+    - apiVersion: lerentis.uploadfilter24.eu/v1beta6
       kind: BitwardenSecret
       metadata:
         name: test
@@ -64,7 +64,9 @@ annotations:
         namespace: "default"
         labels:
           key: value
-    - apiVersion: lerentis.uploadfilter24.eu/v1beta5
+        annotations:
+          key: value
+    - apiVersion: lerentis.uploadfilter24.eu/v1beta6
       kind: RegistryCredential
       metadata:
         name: test
@@ -77,7 +79,9 @@ annotations:
         namespace: "default"
         labels:
           key: value
-    - apiVersion: "lerentis.uploadfilter24.eu/v1beta5"
+        annotations:
+          key: value
+    - apiVersion: "lerentis.uploadfilter24.eu/v1beta6"
       kind: BitwardenTemplate
       metadata:
         name: test
@@ -87,6 +91,8 @@ annotations:
         namespace: "default"
         labels:
           key: value
+        annotations:
+          key: value
         template: |
           ---
           api:
@@ -116,7 +122,7 @@ annotations:
     - kind: added
       description: "Allow custom annotations to generated secrets"
     - kind: added
-      description: "Set ownership of generated secrets"
+      description: "Set ownership of generated secrets if CRD is in the same namespace"
   artifacthub.io/images: |
     - name: bitwarden-crd-operator
       image: ghcr.io/lerentis/bitwarden-crd-operator:0.11.0

charts/bitwarden-crd-operator/crds/bitwarden-secrets.yaml

@@ -52,7 +52,8 @@ spec:
                 - name
     - name: v1beta5
       served: true
-      storage: true
+      storage: false
+      deprecated: true
       schema:
         openAPIV3Schema:
           type: object
@@ -89,3 +90,45 @@ spec:
                 - id
                 - namespace
                 - name
+    - name: v1beta6
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          properties:
+            spec:
+              type: object
+              properties:
+                content:
+                  type: array
+                  items:
+                    type: object
+                    properties:
+                      element:
+                        type: object
+                        properties:
+                          secretName:
+                            type: string
+                          secretRef:
+                            type: string
+                          secretScope:
+                            type: string
+                        required:
+                          - secretName
+                id:
+                  type: string
+                namespace:
+                  type: string
+                name:
+                  type: string
+                labels:
+                  type: object
+                  x-kubernetes-preserve-unknown-fields: true
+                annotations:
+                  type: object
+                  x-kubernetes-preserve-unknown-fields: true
+              required:
+                - id
+                - namespace
+                - name

charts/bitwarden-crd-operator/crds/bitwarden-templates.yaml

@@ -39,7 +39,8 @@ spec:
                 - name
     - name: v1beta5
       served: true
-      storage: true
+      storage: false
+      deprecated: true
       schema:
         openAPIV3Schema:
           type: object
@@ -63,3 +64,32 @@ spec:
                 - template
                 - namespace
                 - name
+    - name: v1beta6
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          properties:
+            spec:
+              type: object
+              properties:
+                filename:
+                  type: string
+                template:
+                  type: string
+                namespace:
+                  type: string
+                name:
+                  type: string
+                labels:
+                  type: object
+                  x-kubernetes-preserve-unknown-fields: true
+                annotations:
+                  type: object
+                  x-kubernetes-preserve-unknown-fields: true
+              required:
+                - filename
+                - template
+                - namespace
+                - name

charts/bitwarden-crd-operator/crds/registry-credentials.yaml

@@ -45,7 +45,8 @@ spec:
                 - registry
     - name: v1beta5
       served: true
-      storage: true
+      storage: false
+      deprecated: true
       schema:
         openAPIV3Schema:
           type: object
@@ -75,3 +76,38 @@ spec:
                 - usernameRef
                 - passwordRef
                 - registry
+    - name: v1beta6
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          properties:
+            spec:
+              type: object
+              properties:
+                usernameRef:
+                  type: string
+                passwordRef:
+                  type: string
+                registry:
+                  type: string
+                id:
+                  type: string
+                namespace:
+                  type: string
+                name:
+                  type: string
+                labels:
+                  type: object
+                  x-kubernetes-preserve-unknown-fields: true
+                annotations:
+                  type: object
+                  x-kubernetes-preserve-unknown-fields: true
+              required:
+                - id
+                - namespace
+                - name
+                - usernameRef
+                - passwordRef
+                - registry

charts/bitwarden-crd-operator/templates/deployment.yaml

@@ -8,6 +8,8 @@ spec:
   {{- if not .Values.autoscaling.enabled }}
   replicas: {{ .Values.replicaCount }}
   {{- end }}
+  strategy: 
+    type: {{ .Values.deploymentStrategy }}
   selector:
     matchLabels:
       {{- include "bitwarden-crd-operator.selectorLabels" . | nindent 6 }}

charts/bitwarden-crd-operator/values.yaml

@@ -14,6 +14,8 @@ imagePullSecrets: []
 nameOverride: ""
 fullnameOverride: ""
 
+deploymentStrategy: "Recreate"
+
 # env:
 #   - name: BW_FORCE_SYNC
 #     value: "false"

example.yaml

@@ -1,8 +1,9 @@
 ---
-apiVersion: "lerentis.uploadfilter24.eu/v1beta5"
+apiVersion: "lerentis.uploadfilter24.eu/v1beta6"
 kind: BitwardenSecret
 metadata:
   name: test
+  namespace: default
 spec:
   content:
     - element:
@@ -19,8 +20,10 @@ spec:
   labels:
     key: value
     app: example-app
+  annotations:
+    custom.annotation: is-used
 ---
-apiVersion: "lerentis.uploadfilter24.eu/v1beta5"
+apiVersion: "lerentis.uploadfilter24.eu/v1beta6"
 kind: BitwardenSecret
 metadata:
   name: test-scope

example_dockerlogin.yaml

@@ -1,5 +1,5 @@
 ---
-apiVersion: "lerentis.uploadfilter24.eu/v1beta5"
+apiVersion: "lerentis.uploadfilter24.eu/v1beta6"
 kind: RegistryCredential
 metadata:
   name: test
@@ -13,3 +13,5 @@ spec:
   labels:
     namespace: default
     tenant: example-team
+  annotations:
+    custom.annotation: is-used

example_template.yaml

@@ -1,5 +1,5 @@
 ---
-apiVersion: "lerentis.uploadfilter24.eu/v1beta5"
+apiVersion: "lerentis.uploadfilter24.eu/v1beta6"
 kind: BitwardenTemplate
 metadata:
   name: test
@@ -10,6 +10,8 @@ spec:
   labels:
     key: value
     app: example-app
+  annotations:
+    custom.annotation: is-used
   template: |
     ---
     api:

src/dockerlogin.py

@@ -45,6 +45,7 @@ def create_managed_registry_secret(spec, name, namespace, logger, **kwargs):
     secret_name = spec.get('name')
     secret_namespace = spec.get('namespace')
     labels = spec.get('labels')
+    custom_annotations = spec.get('annotations')
 
     unlock_bw(logger)
     logger.info(f"Locking up secret with ID: {id}")
@@ -57,6 +58,9 @@ def create_managed_registry_secret(spec, name, namespace, logger, **kwargs):
         "managedObject": f"{namespace}/{name}"
     }
 
+    if custom_annotations:
+        annotations.update(custom_annotations)
+
     if not labels:
         labels = {}
 
@@ -71,7 +75,10 @@ def create_managed_registry_secret(spec, name, namespace, logger, **kwargs):
         password_ref,
         registry)
     
-    kopf.append_owner_reference(secret)
+    # Garbage collection will delete the generated secret if the owner
+    # Is not in the same namespace as the generated secret
+    if secret_namespace == namespace:
+        kopf.append_owner_reference(secret)
 
     api.create_namespaced_secret(
         secret_namespace, secret
@@ -99,6 +106,7 @@ def update_managed_registry_secret(
     secret_name = spec.get('name')
     secret_namespace = spec.get('namespace')
     labels = spec.get('labels')
+    custom_annotations = spec.get('annotations')
 
     old_config = None
     old_secret_name = None
@@ -136,6 +144,9 @@ def update_managed_registry_secret(
         "managedObject": f"{namespace}/{name}"
     }
 
+    if custom_annotations:
+        annotations.update(custom_annotations)
+
     if not labels:
         labels = {}
 
@@ -150,7 +161,10 @@ def update_managed_registry_secret(
         password_ref,
         registry)
     
-    kopf.append_owner_reference(secret)
+    # Garbage collection will delete the generated secret if the owner
+    # Is not in the same namespace as the generated secret
+    if secret_namespace == namespace:
+        kopf.append_owner_reference(secret)
 
     try:
         api.replace_namespaced_secret(
@@ -159,9 +173,12 @@ def update_managed_registry_secret(
             namespace="{}".format(secret_namespace))
         logger.info(
             f"Secret {secret_namespace}/{secret_name} has been updated")
-    except BaseException:
+    except BaseException as e:
         logger.warn(
             f"Could not update secret {secret_namespace}/{secret_name}!")
+        logger.warn(
+            f"Exception: {e}"
+        )
 
 
 @kopf.on.delete('registry-credential.lerentis.uploadfilter24.eu')

src/kv.py

@@ -42,6 +42,7 @@ def create_managed_secret(spec, name, namespace, logger, body, **kwargs):
     secret_name = spec.get('name')
     secret_namespace = spec.get('namespace')
     labels = spec.get('labels')
+    custom_annotations = spec.get('annotations')
 
     unlock_bw(logger)
     logger.info(f"Locking up secret with ID: {id}")
@@ -54,6 +55,9 @@ def create_managed_secret(spec, name, namespace, logger, body, **kwargs):
         "managedObject": f"{namespace}/{name}"
     }
 
+    if custom_annotations:
+        annotations.update(custom_annotations)
+
     if not labels:
         labels = {}
 
@@ -62,7 +66,10 @@ def create_managed_secret(spec, name, namespace, logger, body, **kwargs):
         name=secret_name, annotations=annotations, labels=labels)
     secret = create_kv(secret, secret_json_object, content_def)
 
-    kopf.append_owner_reference(secret)
+    # Garbage collection will delete the generated secret if the owner
+    # Is not in the same namespace as the generated secret
+    if secret_namespace == namespace:
+        kopf.append_owner_reference(secret)
 
     api.create_namespaced_secret(
         namespace="{}".format(secret_namespace),
@@ -96,6 +103,7 @@ def update_managed_secret(
     secret_name = spec.get('name')
     secret_namespace = spec.get('namespace')
     labels = spec.get('labels')
+    custom_annotations = spec.get('annotations')
 
     if old_config is not None and (
             old_secret_name != secret_name or old_secret_namespace != secret_namespace):
@@ -122,6 +130,9 @@ def update_managed_secret(
         "managedObject": f"{namespace}/{name}"
     }
 
+    if custom_annotations:
+        annotations.update(custom_annotations)
+
     if not labels:
         labels = {}
 
@@ -130,7 +141,10 @@ def update_managed_secret(
         name=secret_name, annotations=annotations, labels=labels)
     secret = create_kv(secret, secret_json_object, content_def)
 
-    kopf.append_owner_reference(secret)
+    # Garbage collection will delete the generated secret if the owner
+    # Is not in the same namespace as the generated secret
+    if secret_namespace == namespace:
+        kopf.append_owner_reference(secret)
 
     try:
         api.replace_namespaced_secret(
@@ -139,9 +153,12 @@ def update_managed_secret(
             namespace="{}".format(secret_namespace))
         logger.info(
             f"Secret {secret_namespace}/{secret_name} has been updated")
-    except BaseException:
+    except BaseException as e:
         logger.warn(
             f"Could not update secret {secret_namespace}/{secret_name}!")
+        logger.warn(
+            f"Exception: {e}"
+        )
 
 
 @kopf.on.delete('bitwarden-secret.lerentis.uploadfilter24.eu')

src/template.py

@@ -34,6 +34,7 @@ def create_managed_secret(spec, name, namespace, logger, body, **kwargs):
     secret_name = spec.get('name')
     secret_namespace = spec.get('namespace')
     labels = spec.get('labels')
+    custom_annotations = spec.get('annotations')
 
     unlock_bw(logger)
 
@@ -44,6 +45,9 @@ def create_managed_secret(spec, name, namespace, logger, body, **kwargs):
         "managedObject": f"{namespace}/{name}"
     }
 
+    if custom_annotations:
+        annotations.update(custom_annotations)
+
     if not labels:
         labels = {}
 
@@ -52,7 +56,10 @@ def create_managed_secret(spec, name, namespace, logger, body, **kwargs):
         name=secret_name, annotations=annotations, labels=labels)
     secret = create_template_secret(logger, secret, filename, template)
 
-    kopf.append_owner_reference(secret)
+    # Garbage collection will delete the generated secret if the owner
+    # Is not in the same namespace as the generated secret
+    if secret_namespace == namespace:
+        kopf.append_owner_reference(secret)
 
     api.create_namespaced_secret(
         secret_namespace, secret
@@ -77,6 +84,7 @@ def update_managed_secret(
     secret_name = spec.get('name')
     secret_namespace = spec.get('namespace')
     labels = spec.get('labels')
+    custom_annotations = spec.get('annotations')
 
     old_config = None
     old_secret_name = None
@@ -112,6 +120,9 @@ def update_managed_secret(
         "managedObject": f"{namespace}/{name}"
     }
 
+    if custom_annotations:
+        annotations.update(custom_annotations)
+
     if not labels:
         labels = {}
 
@@ -120,7 +131,10 @@ def update_managed_secret(
         name=secret_name, annotations=annotations, labels=labels)
     secret = create_template_secret(logger, secret, filename, template)
 
-    kopf.append_owner_reference(secret)
+    # Garbage collection will delete the generated secret if the owner
+    # Is not in the same namespace as the generated secret
+    if secret_namespace == namespace:
+        kopf.append_owner_reference(secret)
 
     try:
         api.replace_namespaced_secret(
@@ -129,9 +143,12 @@ def update_managed_secret(
             namespace="{}".format(secret_namespace))
         logger.info(
             f"Secret {secret_namespace}/{secret_name} has been updated")
-    except BaseException:
+    except BaseException as e:
         logger.warn(
             f"Could not update secret {secret_namespace}/{secret_name}!")
+        logger.warn(
+            f"Exception: {e}"
+        )
 
 
 @kopf.on.delete('bitwarden-template.lerentis.uploadfilter24.eu')