fix(2582): added cluster level delete secrets config

Author: Gabriel Nobel

2

@@ -229,6 +229,8 @@ spec:
                   enable_secrets_deletion:
                     type: boolean
                     default: true
+                  enable_secrets_deletion_key:
+                    type: string
                   enable_sidecars:
                     type: boolean
                     default: true

charts/postgres-operator/crds/operatorconfigurations.yaml

@@ -141,6 +141,9 @@ configKubernetes:
   enable_readiness_probe: false
   # toggles if operator should delete secrets on cluster deletion
   enable_secrets_deletion: true
+  # key name for annotation that overrides enable_secrets_deletion on cluster level
+  # enable_secrets_deletion_key: "enable-secrets-deletion"
+
   # enables sidecar containers to run alongside Spilo in the same pod
   enable_sidecars: true
 

charts/postgres-operator/values.yaml

@@ -61,6 +61,7 @@ data:
   enable_replica_load_balancer: "false"
   enable_replica_pooler_load_balancer: "false"
   enable_secrets_deletion: "true"
+  # enable_secrets_deletion_key: enable-secrets-deletion
   enable_shm_volume: "true"
   enable_sidecars: "true"
   enable_spilo_wal_path_compat: "true"

manifests/configmap.yaml

@@ -227,6 +227,8 @@ spec:
                   enable_secrets_deletion:
                     type: boolean
                     default: true
+                  enable_secrets_deletion_key:
+                    type: string
                   enable_sidecars:
                     type: boolean
                     default: true

manifests/operatorconfiguration.crd.yaml

@@ -65,6 +65,7 @@ configuration:
     enable_pod_disruption_budget: true
     enable_readiness_probe: false
     enable_secrets_deletion: true
+    # enable_secrets_deletion_key: enable-secrets-deletion
     enable_sidecars: true
     # ignored_annotations:
     # - k8s.v1.cni.cncf.io/network-status

manifests/postgresql-operator-default-configuration.yaml

@@ -1344,6 +1344,9 @@ var OperatorConfigCRDResourceValidation = apiextv1.CustomResourceValidation{
 							"enable_secrets_deletion": {
 								Type: "boolean",
 							},
+							"enable_secrets_deletion_key": {
+								Type: "string",
+							},
 							"enable_sidecars": {
 								Type: "boolean",
 							},

pkg/apis/acid.zalan.do/v1/crds.go

@@ -104,6 +104,7 @@ type KubernetesMetaConfiguration struct {
 	PodManagementPolicy                      string              `json:"pod_management_policy,omitempty"`
 	PersistentVolumeClaimRetentionPolicy     map[string]string   `json:"persistent_volume_claim_retention_policy,omitempty"`
 	EnableSecretsDeletion                    *bool               `json:"enable_secrets_deletion,omitempty"`
+	EnableSecretsDeletionKey                 string              `json:"enable_secrets_deletion_key,omitempty"`
 	EnablePersistentVolumeClaimDeletion      *bool               `json:"enable_persistent_volume_claim_deletion,omitempty"`
 	EnableReadinessProbe                     bool                `json:"enable_readiness_probe,omitempty"`
 	EnableCrossNamespaceSecret               bool                `json:"enable_cross_namespace_secret,omitempty"`

pkg/apis/acid.zalan.do/v1/operator_configuration_type.go

@@ -1191,7 +1191,24 @@ func (c *Cluster) Delete() error {
 		c.eventRecorder.Eventf(c.GetReference(), v1.EventTypeWarning, "Delete", "could not delete statefulset: %v", err)
 	}
 
-	if c.OpConfig.EnableSecretsDeletion != nil && *c.OpConfig.EnableSecretsDeletion {
+	enable_secrets_deletion_cluster := c.OpConfig.EnableSecretsDeletion != nil && *c.OpConfig.EnableSecretsDeletion
+	c.logger.Info("TEST FEATURE START")
+	c.logger.Info(enable_secrets_deletion_cluster)
+	if c.OpConfig.EnableSecretsDeletionKey != "" {
+		key := c.OpConfig.EnableSecretsDeletionKey
+		c.logger.Info(key)
+		c.logger.Info(c.Postgresql.Annotations)
+		if value, ok := c.Postgresql.Annotations[key]; ok {
+			c.logger.Info("Test feature", value)
+			if value == "true" {
+				enable_secrets_deletion_cluster = true
+			} else if value == "false" {
+				enable_secrets_deletion_cluster = false
+			}
+		}
+	}
+	c.logger.Info(enable_secrets_deletion_cluster)
+	if enable_secrets_deletion_cluster {
 		if err := c.deleteSecrets(); err != nil {
 			anyErrors = true
 			c.logger.Warningf("could not delete secrets: %v", err)
@@ -1200,7 +1217,7 @@ func (c *Cluster) Delete() error {
 	} else {
 		c.logger.Info("not deleting secrets because disabled in configuration")
 	}
-
+	c.logger.Info("TEST FEATURE END")
 	if err := c.deletePodDisruptionBudget(); err != nil {
 		anyErrors = true
 		c.logger.Warningf("could not delete pod disruption budget: %v", err)

pkg/cluster/cluster.go

@@ -124,6 +124,7 @@ func (c *Controller) importConfigurationFromCRD(fromCRD *acidv1.OperatorConfigur
 	result.PodManagementPolicy = util.Coalesce(fromCRD.Kubernetes.PodManagementPolicy, "ordered_ready")
 	result.PersistentVolumeClaimRetentionPolicy = fromCRD.Kubernetes.PersistentVolumeClaimRetentionPolicy
 	result.EnableSecretsDeletion = util.CoalesceBool(fromCRD.Kubernetes.EnableSecretsDeletion, util.True())
+	result.EnableSecretsDeletionKey = fromCRD.Kubernetes.EnableSecretsDeletionKey
 	result.EnablePersistentVolumeClaimDeletion = util.CoalesceBool(fromCRD.Kubernetes.EnablePersistentVolumeClaimDeletion, util.True())
 	result.EnableReadinessProbe = fromCRD.Kubernetes.EnableReadinessProbe
 	result.MasterPodMoveTimeout = util.CoalesceDuration(time.Duration(fromCRD.Kubernetes.MasterPodMoveTimeout), "10m")

pkg/controller/operator_config.go

@@ -66,6 +66,7 @@ type Resources struct {
 	MaxInstances                      int32  `name:"max_instances" default:"-1"`
 	MinInstances                      int32  `name:"min_instances" default:"-1"`
 	IgnoreInstanceLimitsAnnotationKey string `name:"ignore_instance_limits_annotation_key"`
+	EnableSecretsDeletionKey          string `name:"enable_secrets_deletion_key"`
 }
 
 type InfrastructureRole struct {

pkg/util/config/config.go

@@ -0,0 +1,66 @@
+apiVersion: acid.zalan.do/v1
+kind: postgresql
+metadata:
+  annotations:
+    delete-clustername: "acid-minimal-cluster"
+  creationTimestamp: "2024-09-05T09:42:09Z"
+  generation: 1
+  managedFields:
+  - apiVersion: acid.zalan.do/v1
+    fieldsType: FieldsV1
+    fieldsV1:
+      f:spec:
+        .: {}
+        f:databases:
+          .: {}
+          f:foo: {}
+        f:numberOfInstances: {}
+        f:postgresql:
+          .: {}
+          f:version: {}
+        f:preparedDatabases:
+          .: {}
+          f:bar: {}
+        f:teamId: {}
+        f:users:
+          .: {}
+          f:foo_user: {}
+          f:zalando: {}
+        f:volume:
+          .: {}
+          f:size: {}
+    manager: kubectl-create
+    operation: Update
+    time: "2024-09-05T09:42:09Z"
+  - apiVersion: acid.zalan.do/v1
+    fieldsType: FieldsV1
+    fieldsV1:
+      f:status:
+        .: {}
+        f:PostgresClusterStatus: {}
+    manager: postgres-operator
+    operation: Update
+    subresource: status
+    time: "2024-09-05T09:44:08Z"
+  name: acid-minimal-cluster
+  namespace: default
+  resourceVersion: "643"
+  uid: 25f67ca6-eb04-4e2b-a9ee-2662423232a8
+spec:
+  databases:
+    foo: zalando
+  numberOfInstances: 0
+  postgresql:
+    version: "16"
+  preparedDatabases:
+    bar: {}
+  teamId: acid
+  users:
+    foo_user: []
+    zalando:
+    - superuser
+    - createdb
+  volume:
+    size: 1Gi
+status:
+  PostgresClusterStatus: Running