Skip to content

fix: Place internal secrets in mutable Kubernetes Secrets#876

Open
sbernauer wants to merge 4 commits intomainfrom
fix/immutable-secrets
Open

fix: Place internal secrets in mutable Kubernetes Secrets#876
sbernauer wants to merge 4 commits intomainfrom
fix/immutable-secrets

Conversation

@sbernauer
Copy link
Copy Markdown
Member

@sbernauer sbernauer commented Apr 2, 2026

Description

Part of stackabletech/issues#843

This PR also

  • Improves the code logic, as it is a bit silly to always generate random Secret contains and throw them away most of the time
  • Thus improves CPU usage
  • Adds tracing messages
  • Adds documentation

Testing

Tested from-scratch install:

INFO reconciling object{object.ref=TrinoCluster.v1alpha1.trino.stackable.tech/simple-trino.default object.reason=object updated}: stackable_trino_operator::controller: Random Secret missing, creating it k8s.secret.name="simple-trino-internal-secret" k8s.secret.namespace="default"
INFO reconciling object{object.ref=TrinoCluster.v1alpha1.trino.stackable.tech/simple-trino.default object.reason=object updated}: stackable_trino_operator::controller: Random Secret missing, creating it k8s.secret.name="simple-trino-spooling-secret" k8s.secret.namespace="default"

As well as and update from 0.0.0-dev:

INFO reconciling object{object.ref=TrinoCluster.v1alpha1.trino.stackable.tech/simple-trino.default object.reason=object updated}: stackable_trino_operator::controller: Old (immutable) Secret detected, re-creating it to be able to make it mutable. The contents will stay the same. k8s.secret.name="simple-trino-internal-secret" k8s.secret.namespace="default"
INFO reconciling object{object.ref=TrinoCluster.v1alpha1.trino.stackable.tech/simple-trino.default object.reason=object updated}: stackable_trino_operator::controller: Old (immutable) Secret detected, re-creating it to be able to make it mutable. The contents will stay the same. k8s.secret.name="simple-trino-spooling-secret" k8s.secret.namespace="default"

Follow-up

It seems a bit silly to-copy paste this to airflow, IMHO we should put something like this into operator-rs

Definition of Done Checklist

  • Not all of these items are applicable to all PRs, the author should update this template to only leave the boxes in that are relevant
  • Please make sure all these things are done and tick the boxes

Author

  • Changes are OpenShift compatible
  • CRD changes approved
  • CRD documentation for all fields, following the style guide.
  • Helm chart can be installed and deployed operator works
  • Integration tests passed (for non trivial changes)
  • Changes need to be "offline" compatible
  • Links to generated (nightly) docs added
  • Release note snippet added

Reviewer

  • Code contains useful comments
  • Code contains useful logging statements
  • (Integration-)Test cases added
  • Documentation added or updated. Follows the style guide.
  • Changelog updated
  • Cargo.toml only contains references to git tags (not specific commits or branches)

Acceptance

  • Feature Tracker has been updated
  • Proper release label has been added
  • Links to generated (nightly) docs added
  • Release note snippet added
  • Add type/deprecation label & add to the deprecation schedule
  • Add type/experimental label & add to the experimental features tracker

@sbernauer sbernauer moved this to Development: Waiting for Review in Stackable Engineering Apr 2, 2026
@sbernauer sbernauer self-assigned this Apr 2, 2026
Copy link
Copy Markdown
Member

@razvan razvan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

small remark, otherwise it lgtm

secret_key.to_string(),
get_random_base64(secret_byte_size),
)])),
..Secret::default()
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would prefer to make immutable: false explicit here too.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

Status: Development: Waiting for Review

Development

Successfully merging this pull request may close these issues.

2 participants