added secret reconcile and fix configmap reconcile

Author: Uburro

cmd/main.go

@@ -43,11 +43,12 @@ import (
 	"uburro.github.com/fluxcd-trigger-operator/internal/controller"
 
 	helmv2 "github.com/fluxcd/helm-controller/api/v2"
+
+	"go.uber.org/zap/zapcore"
 )
 
 var (
-	scheme   = runtime.NewScheme()
-	setupLog = ctrl.Log.WithName("setup")
+	scheme = runtime.NewScheme()
 )
 
 type Config struct {
@@ -56,11 +57,14 @@ type Config struct {
 	metricsAddr                                      string
 	metricsCertPath, metricsCertName, metricsCertKey string
 	webhookCertPath, webhookCertName, webhookCertKey string
-	enableLeaderElection                             bool
+	logFormat                                        string
+	logLevel                                         string
 	probeAddr                                        string
+	enableLeaderElection                             bool
 	secureMetrics                                    bool
 	enableHTTP2                                      bool
-	tlsOpts                                          []func(*tls.Config)
+
+	tlsOpts []func(*tls.Config)
 }
 
 func init() {
@@ -70,6 +74,40 @@ func init() {
 	// +kubebuilder:scaffold:scheme
 }
 
+func getZapOpts(logFormat, logLevel string) []zap.Opts {
+	var zapOpts []zap.Opts
+
+	// Configure log format
+	if logFormat == "json" {
+		zapOpts = append(zapOpts, zap.UseDevMode(false))
+	} else {
+		zapOpts = append(zapOpts, zap.UseDevMode(true))
+	}
+
+	// Configure log level
+	var level zapcore.Level
+	switch logLevel {
+	case "debug":
+		level = zapcore.DebugLevel
+	case "info":
+		level = zapcore.InfoLevel
+	case "warn":
+		level = zapcore.WarnLevel
+	case "error":
+		level = zapcore.ErrorLevel
+	case "dpanic":
+		level = zapcore.DPanicLevel
+	case "panic":
+		level = zapcore.PanicLevel
+	case "fatal":
+		level = zapcore.FatalLevel
+	default:
+		level = zapcore.InfoLevel
+	}
+	zapOpts = append(zapOpts, zap.Level(level))
+	return zapOpts
+}
+
 // nolint:gocyclo
 func main() {
 	config := Config{
@@ -101,13 +139,12 @@ func main() {
 		"The name of the metrics server key file.")
 	flag.BoolVar(&config.enableHTTP2, "enable-http2", false,
 		"If set, HTTP/2 will be enabled for the metrics and webhook servers")
-	opts := zap.Options{
-		Development: true,
-	}
-	opts.BindFlags(flag.CommandLine)
+	flag.StringVar(&config.logFormat, "log-format", "plain", "Log format: plain or json")
+	flag.StringVar(&config.logLevel, "log-level", "info", "Log level: debug, info, warn, error, dpanic, panic, fatal")
 	flag.Parse()
-
-	ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts)))
+	opts := getZapOpts(config.logFormat, config.logLevel)
+	ctrl.SetLogger(zap.New(opts...))
+	setupLog := ctrl.Log.WithName("setup")
 
 	// if the enable-http2 flag is false (the default), http/2 should be disabled
 	// due to its vulnerabilities. More specifically, disabling http/2 will
@@ -258,6 +295,14 @@ func main() {
 		os.Exit(1)
 	}
 
+	if err = controller.NewSecretReconciler(
+		mgr.GetClient(),
+		mgr.GetScheme(),
+	).SetupWithManager(mgr, config.MaxConcurrency, config.CacheSyncTimeout); err != nil {
+		setupLog.Error(err, "unable to create controller", "controller", controller.ConfigMapReconcilerName)
+		os.Exit(1)
+	}
+
 	if err := mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil {
 		setupLog.Error(err, "unable to set up health check")
 		os.Exit(1)

go.mod

@@ -11,6 +11,7 @@ require (
 	k8s.io/api v0.33.0
 	k8s.io/apimachinery v0.33.0
 	k8s.io/client-go v0.33.0
+	k8s.io/kubernetes v1.33.2
 	sigs.k8s.io/controller-runtime v0.21.0
 )
 

go.sum

@@ -245,6 +245,8 @@ k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
 k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff h1:/usPimJzUKKu+m+TE36gUyGcf03XZEP0ZIKgKj35LS4=
 k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff/go.mod h1:5jIi+8yX4RIb8wk3XwBo5Pq2ccx4FP10ohkbSKCZoK8=
+k8s.io/kubernetes v1.33.2 h1:Vk3hsCaazyMQ6CXhu029AEPlBoYsEnD8oEIC0bP2pWQ=
+k8s.io/kubernetes v1.33.2/go.mod h1:nrt8sldmckKz2fCZhgRX3SKfS2e+CzXATPv6ITNkU00=
 k8s.io/utils v0.0.0-20250321185631-1f6e0b77f77e h1:KqK5c/ghOm8xkHYhlodbp6i6+r+ChV2vuAuVRdFbLro=
 k8s.io/utils v0.0.0-20250321185631-1f6e0b77f77e/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 h1:jpcvIRr3GLoUoEKRkHKSmGjxb6lWwrBlJsXc+eUYQHM=

internal/controller/common.go

@@ -0,0 +1,50 @@
+package controller
+
+import (
+	"fmt"
+	"hash/adler32"
+	"sync"
+	"time"
+
+	"k8s.io/client-go/util/workqueue"
+	"k8s.io/kubernetes/pkg/util/hash"
+	"sigs.k8s.io/controller-runtime/pkg/controller"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+)
+
+const (
+	LabelReconcilerNameSourceKey = "uburro.github.com/fluxcd-trigger-operator"
+	HRAnnotation                 = "uburro.github.com/helmreleases-name"
+	NSAnnotation                 = "uburro.github.com/helmreleases-namespace"
+	HashAnnotation               = "uburro.github.com/config-digest"
+	DefaultFluxcdNamespace       = "flux-system"
+)
+
+var (
+	optionsInit    sync.Once
+	defaultOptions *controller.Options
+)
+
+func ControllerOptions(maxConcurrency int, cacheSyncTimeout time.Duration) controller.Options {
+	rateLimiters := workqueue.NewTypedItemExponentialFailureRateLimiter[reconcile.Request](30*time.Second, 5*time.Minute)
+	optionsInit.Do(func() {
+		defaultOptions = &controller.Options{
+			RateLimiter:             rateLimiters,
+			CacheSyncTimeout:        cacheSyncTimeout,
+			MaxConcurrentReconciles: maxConcurrency,
+		}
+	})
+	return *defaultOptions
+}
+
+func getDataHashCM(data map[string]string) string {
+	hasher := adler32.New()
+	hash.DeepHashObject(hasher, data)
+	return fmt.Sprintf("%x", hasher.Sum32())
+}
+
+func getDataHashSecret(data map[string][]byte) string {
+	hasher := adler32.New()
+	hash.DeepHashObject(hasher, data)
+	return fmt.Sprintf("%x", hasher.Sum32())
+}

internal/controller/controller.go …ternal/controller/configmapcontroller.gointernal/controller/controller.go renamed to internal/controller/configmapcontroller.go internal/controller/controller.go renamed to internal/controller/configmapcontroller.go

@@ -2,31 +2,22 @@ package controller
 
 import (
 	"context"
-	"sync"
 	"time"
 
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/client-go/util/workqueue"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/builder"
 	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/controller"
 	"sigs.k8s.io/controller-runtime/pkg/event"
 	"sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
-	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
 	helmv2 "github.com/fluxcd/helm-controller/api/v2"
 )
 
 const (
-	ConfigMapReconcilerName               = "configmap-reconciler"
-	LabelConfigMapReconcilerNameSourceKey = "uburro.github.com/fluxcd-trigger-operator"
-	AnnotationHelmReleaseNameKey          = "uburro.github.com/helmreleases-name"
-	AnnotationHelmReleaseNamespaceKey     = "uburro.github.com/helmreleases-namespace"
-	AnnotationDigistKey                   = "uburro.github.com/config-digest"
-	DefaultFluxcdNamespace                = "flux-system"
+	ConfigMapReconcilerName = "configmap-reconciler"
 )
 
 // ConfigMapReconciler reconciles ConfigMap resources in a Kubernetes cluster.
@@ -56,8 +47,8 @@ func (r *ConfigMapReconciler) Reconcile(ctx context.Context, req ctrl.Request) (
 		return ctrl.Result{}, err
 	}
 
-	hrName := configMap.GetAnnotations()[AnnotationHelmReleaseNameKey]
-	hrNamespace := configMap.GetAnnotations()[AnnotationHelmReleaseNamespaceKey]
+	hrName := configMap.GetAnnotations()[HRAnnotation]
+	hrNamespace := configMap.GetAnnotations()[NSAnnotation]
 
 	if hrName == "" {
 		logger.V(1).Info("No HelmRelease name found in ConfigMap annotations", "configMap", req.Name)
@@ -73,32 +64,56 @@ func (r *ConfigMapReconciler) Reconcile(ctx context.Context, req ctrl.Request) (
 		Name:      hrName,
 		Namespace: hrNamespace,
 	}, hr); err != nil {
-		logger.V(1).Error(err, "Getting HelmRelease produced an error", "helmRelease", hrName, "namespace", hrNamespace)
+		logger.V(1).Error(err, "Getting HelmRelease produced an error",
+			"helmRelease", hrName, "namespace", hrNamespace)
 		return ctrl.Result{}, err
 	}
 
-	oldDigest := configMap.GetAnnotations()[AnnotationDigistKey]
-	newDigest := hr.Status.History[0].Digest
+	if len(hr.Status.History) == 0 {
+		logger.V(1).Info("No history found in HelmRelease, skipping helmRelease patch",
+			"helmRelease", hrName, "namespace", hrNamespace)
+		return ctrl.Result{}, nil
+	}
+
+	if hr.Status.History[0].Status != "deployed" {
+		logger.V(1).Info("HelmRelease is not deployed, skipping patch", "helmRelease",
+			hrName, "namespace", hrNamespace, "status", hr.Status.History[0].Status)
+		return ctrl.Result{}, nil
+	}
+
+	oldDigest := configMap.GetAnnotations()[HashAnnotation]
+	newDigest := getDataHashCM(configMap.Data)
+
+	logger.V(1).Info("old digest", "digest", oldDigest)
+	logger.V(1).Info("new digest", "digest", newDigest)
 
 	if oldDigest == newDigest {
 		logger.V(1).Info("No changes detected in ConfigMap, skipping HelmRelease patch", "configMap", req.Name)
 		return ctrl.Result{}, nil
 	}
 
-	patchTarget := hr.DeepCopy()
+	patchTargetHR := hr.DeepCopy()
 
 	ts := time.Now().Format(time.RFC3339Nano)
-	patchTarget.Annotations[AnnotationDigistKey] = newDigest
-	patchTarget.Annotations["reconcile.fluxcd.io/forceAt"] = ts
-	patchTarget.Annotations["reconcile.fluxcd.io/requestedAt"] = ts
+	patchTargetHR.Annotations["reconcile.fluxcd.io/forceAt"] = ts
+	patchTargetHR.Annotations["reconcile.fluxcd.io/requestedAt"] = ts
 
-	patch := client.MergeFrom(hr.DeepCopy())
+	patchHR := client.MergeFrom(hr.DeepCopy())
+	if err := r.Patch(ctx, patchTargetHR, patchHR); err != nil {
+		logger.Error(err, "failed to patch HelmRelease", "name", patchTargetHR.Name)
+	}
 
-	if err := r.Patch(ctx, patchTarget, patch); err != nil {
-		logger.Error(err, "failed to patch HelmRelease", "name", patchTarget.Name)
+	patchCM := client.MergeFrom(configMap.DeepCopy())
+	patchTargetCM := configMap.DeepCopy()
+	patchTargetCM.Annotations[HashAnnotation] = newDigest
+	if err := r.Patch(ctx, patchTargetCM, patchCM); err != nil {
+		logger.Error(err, "failed to patch HelmRelease", "name", patchTargetHR.Name)
 	}
 
-	logger.Info("patched HelmRelease with new digest", "name", patchTarget.Name, "digest", newDigest, "version", hr.Status.History[0].Version)
+	logger.Info("patched HelmRelease with new digest",
+		"name", patchTargetHR.Name,
+		"digest", newDigest,
+		"version", hr.Status.History[0].Version)
 
 	return ctrl.Result{}, nil
 }
@@ -116,13 +131,19 @@ func (r *ConfigMapReconciler) SetupWithManager(
 
 				return isValidConfigMap(configMap)
 			},
+
 			UpdateFunc: func(e event.UpdateEvent) bool {
-				configMap, ok := e.ObjectNew.(*corev1.ConfigMap)
-				if !ok {
+				configMapOld, okOld := e.ObjectOld.(*corev1.ConfigMap)
+				configMapNew, okNew := e.ObjectNew.(*corev1.ConfigMap)
+
+				if !okOld || !okNew || !isValidConfigMap(configMapNew) {
 					return false
 				}
 
-				return isValidConfigMap(configMap)
+				oldHash := getDataHashCM(configMapOld.Data)
+				newHash := getDataHashCM(configMapNew.Data)
+
+				return oldHash != newHash
 			},
 			DeleteFunc: func(e event.DeleteEvent) bool {
 				return false
@@ -141,25 +162,8 @@ func (r *ConfigMapReconciler) SetupWithManager(
 }
 
 func isValidConfigMap(cm *corev1.ConfigMap) bool {
-	if v, ok := cm.Labels[LabelConfigMapReconcilerNameSourceKey]; ok {
+	if v, ok := cm.Labels[LabelReconcilerNameSourceKey]; ok {
 		return v == "true"
 	}
 	return false
 }
-
-var (
-	optionsInit    sync.Once
-	defaultOptions *controller.Options
-)
-
-func ControllerOptions(maxConcurrency int, cacheSyncTimeout time.Duration) controller.Options {
-	rateLimiters := workqueue.NewTypedItemExponentialFailureRateLimiter[reconcile.Request](30*time.Second, 5*time.Minute)
-	optionsInit.Do(func() {
-		defaultOptions = &controller.Options{
-			RateLimiter:             rateLimiters,
-			CacheSyncTimeout:        cacheSyncTimeout,
-			MaxConcurrentReconciles: maxConcurrency,
-		}
-	})
-	return *defaultOptions
-}