Iss25307 backport (#25435)

* fix: use name to find the admin secret closes: #25307 Signed-off-by: Steve Hawkins <[email protected]> * doc: adding a note about removing the closes: #25307 Signed-off-by: Steve Hawkins <[email protected]> --------- Signed-off-by: Steve Hawkins <[email protected]>
keycloak · Dec 12, 2023 · 2eba785 · 2eba785
1 parent 024bff1
commit 2eba785
Show file tree

Hide file tree

Showing 5 changed files with 33 additions and 14 deletions.
diff --git a/docs/documentation/upgrading/topics/keycloak/changes-23_0_2.adoc b/docs/documentation/upgrading/topics/keycloak/changes-23_0_2.adoc
@@ -4,4 +4,10 @@ Version 1.8.0 introduced a lower-case for the hostname and scheme when comparing
 
 For realms relying on the old behavior, the valid redirect URIs for their clients should now hold separate entries for each URI that should be recognized by the server.
 
-Although it introduces more steps and verbosity when configuring clients, the new behavior enables more secure deployments as pattern-based checks are frequently the cause of security issues. Not only due to how they are implemented but also how they are configured.
+Although it introduces more steps and verbosity when configuring clients, the new behavior enables more secure deployments as pattern-based checks are frequently the cause of security issues. Not only due to how they are implemented but also how they are configured.
+
+= Operator -secrets-store Secret
+
+Older versions of the operator created a Secret to track watched Secrets. Newer versions of the operator no longer use the -secrets-store Secret, so it may be deleted. 
+
+If you are on 23.0.0 or 23.0.1 and see "org.keycloak.operator.controllers.KeycloakAdminSecretDependentResource -> java.lang.IllegalStateException: More than 1 secondary resource related to      primary" in the operator log then either delete the -secrets-store Secret, or upgrade to 23.0.2 where this is no longer an issue.
diff --git a/operator/src/main/java/org/keycloak/operator/Utils.java b/operator/src/main/java/org/keycloak/operator/Utils.java
@@ -19,6 +19,11 @@
 
 import io.fabric8.kubernetes.api.model.HasMetadata;
 import io.fabric8.kubernetes.client.KubernetesClient;
+import io.javaoperatorsdk.operator.api.reconciler.Context;
+import io.javaoperatorsdk.operator.processing.event.ResourceID;
+import io.javaoperatorsdk.operator.processing.event.source.informer.InformerEventSource;
+
+import org.keycloak.operator.crds.v2alpha1.deployment.Keycloak;
 
 import java.nio.charset.StandardCharsets;
 import java.time.ZoneOffset;
@@ -27,6 +32,8 @@
 import java.util.Base64;
 import java.util.LinkedHashMap;
 import java.util.Map;
+import java.util.Optional;
+import java.util.function.Function;
 import java.util.stream.Collectors;
 
 /**
@@ -63,4 +70,11 @@ public static Map<String, String> allInstanceLabels(HasMetadata primary) {
         return labels;
     }
 
+    public static <T extends HasMetadata> Optional<T> getByName(Class<T> clazz, Function<Keycloak, String> nameFunction, Keycloak primary, Context<Keycloak> context) {
+        InformerEventSource<T, Keycloak> ies = (InformerEventSource<T, Keycloak>) context
+                .eventSourceRetriever().getResourceEventSourceFor(clazz);
+
+        return ies.get(new ResourceID(nameFunction.apply(primary), primary.getMetadata().getNamespace()));
+    }
+
 }
diff --git a/...src/main/java/org/keycloak/operator/controllers/KeycloakAdminSecretDependentResource.java b/...src/main/java/org/keycloak/operator/controllers/KeycloakAdminSecretDependentResource.java
@@ -4,6 +4,7 @@
 import io.fabric8.kubernetes.api.model.SecretBuilder;
 import io.fabric8.kubernetes.client.utils.KubernetesResourceUtil;
 import io.javaoperatorsdk.operator.api.reconciler.Context;
+import io.javaoperatorsdk.operator.api.reconciler.ResourceDiscriminator;
 import io.javaoperatorsdk.operator.api.reconciler.dependent.GarbageCollected;
 import io.javaoperatorsdk.operator.processing.dependent.Creator;
 import io.javaoperatorsdk.operator.processing.dependent.kubernetes.KubernetesDependent;
@@ -13,11 +14,19 @@
 import org.keycloak.operator.Utils;
 import org.keycloak.operator.crds.v2alpha1.deployment.Keycloak;
 
+import java.util.Optional;
 import java.util.UUID;
 
-@KubernetesDependent(labelSelector = Constants.DEFAULT_LABELS_AS_STRING)
+@KubernetesDependent(labelSelector = Constants.DEFAULT_LABELS_AS_STRING, resourceDiscriminator = KeycloakAdminSecretDependentResource.NameResourceDiscriminator.class)
 public class KeycloakAdminSecretDependentResource extends KubernetesDependentResource<Secret, Keycloak> implements Creator<Secret, Keycloak>, GarbageCollected<Keycloak> {
 
+    public static class NameResourceDiscriminator implements ResourceDiscriminator<Secret, Keycloak> {
+        @Override
+        public Optional<Secret> distinguish(Class<Secret> resource, Keycloak primary, Context<Keycloak> context) {
+            return Utils.getByName(Secret.class, KeycloakAdminSecretDependentResource::getName, primary, context);
+        }
+    }
+
     public KeycloakAdminSecretDependentResource() {
         super(Secret.class);
     }

diff --git a/...ain/java/org/keycloak/operator/controllers/KeycloakDiscoveryServiceDependentResource.java b/...ain/java/org/keycloak/operator/controllers/KeycloakDiscoveryServiceDependentResource.java
@@ -37,7 +37,7 @@ public class KeycloakDiscoveryServiceDependentResource extends CRUDKubernetesDep
     public static class NameResourceDiscriminator implements ResourceDiscriminator<Service, Keycloak> {
         @Override
         public Optional<Service> distinguish(Class<Service> resource, Keycloak primary, Context<Keycloak> context) {
-            return KeycloakServiceDependentResource.getService(KeycloakDiscoveryServiceDependentResource::getName, primary, context);
+            return Utils.getByName(Service.class, KeycloakDiscoveryServiceDependentResource::getName, primary, context);
         }
     }
 

diff --git a/...tor/src/main/java/org/keycloak/operator/controllers/KeycloakServiceDependentResource.java b/...tor/src/main/java/org/keycloak/operator/controllers/KeycloakServiceDependentResource.java
@@ -25,16 +25,13 @@
 import io.javaoperatorsdk.operator.api.reconciler.ResourceDiscriminator;
 import io.javaoperatorsdk.operator.processing.dependent.kubernetes.CRUDKubernetesDependentResource;
 import io.javaoperatorsdk.operator.processing.dependent.kubernetes.KubernetesDependent;
-import io.javaoperatorsdk.operator.processing.event.ResourceID;
-import io.javaoperatorsdk.operator.processing.event.source.informer.InformerEventSource;
 
 import org.keycloak.operator.Constants;
 import org.keycloak.operator.Utils;
 import org.keycloak.operator.crds.v2alpha1.deployment.Keycloak;
 import org.keycloak.operator.crds.v2alpha1.deployment.spec.HttpSpec;
 
 import java.util.Optional;
-import java.util.function.Function;
 
 import static org.keycloak.operator.crds.v2alpha1.CRDUtils.isTlsConfigured;
 
@@ -44,17 +41,10 @@ public class KeycloakServiceDependentResource extends CRUDKubernetesDependentRes
     public static class NameResourceDiscriminator implements ResourceDiscriminator<Service, Keycloak> {
         @Override
         public Optional<Service> distinguish(Class<Service> resource, Keycloak primary, Context<Keycloak> context) {
-            return getService(KeycloakServiceDependentResource::getServiceName, primary, context);
+            return Utils.getByName(Service.class, KeycloakServiceDependentResource::getServiceName, primary, context);
         }
     }
 
-    public static Optional<Service> getService(Function<Keycloak, String> nameFunction, Keycloak primary, Context<Keycloak> context) {
-        InformerEventSource<Service, Keycloak> ies = (InformerEventSource<Service, Keycloak>) context
-                .eventSourceRetriever().getResourceEventSourceFor(Service.class);
-
-        return ies.get(new ResourceID(nameFunction.apply(primary), primary.getMetadata().getNamespace()));
-    }
-
     public KeycloakServiceDependentResource() {
         super(Service.class);
     }