🌱 Update util functions for secret generation

util/kubeconfig/kubeconfig.go

@@ -143,6 +143,7 @@ func GenerateSecretWithOwner(clusterName client.ObjectKey, data []byte, owner me
 		Data: map[string][]byte{
 			secret.KubeconfigDataName: data,
 		},
+		Type: clusterv1.ClusterSecretType,
 	}
 }
 

util/kubeconfig/kubeconfig_test.go

@@ -74,6 +74,7 @@ users:
 		Data: map[string][]byte{
 			secret.KubeconfigDataName: []byte(validKubeConfig),
 		},
+		Type: clusterv1.ClusterSecretType,
 	}
 )
 
@@ -281,6 +282,7 @@ func TestCreateSecretWithOwner(t *testing.T) {
 	key := client.ObjectKey{Name: "test1-kubeconfig", Namespace: "test"}
 	g.Expect(c.Get(ctx, key, s)).To(Succeed())
 	g.Expect(s.OwnerReferences).To(ContainElement(owner))
+	g.Expect(s.Type).To(Equal(clusterv1.ClusterSecretType))
 
 	clientConfig, err := clientcmd.NewClientConfigFromBytes(s.Data[secret.KubeconfigDataName])
 	g.Expect(err).NotTo(HaveOccurred())
@@ -343,6 +345,7 @@ func TestCreateSecret(t *testing.T) {
 			APIVersion: clusterv1.GroupVersion.String(),
 		},
 	))
+	g.Expect(s.Type).To(Equal(clusterv1.ClusterSecretType))
 
 	clientConfig, err := clientcmd.NewClientConfigFromBytes(s.Data[secret.KubeconfigDataName])
 	g.Expect(err).NotTo(HaveOccurred())

util/secret/certificates.go

@@ -241,29 +241,14 @@ func (c Certificates) EnsureAllExist() error {
 	return nil
 }
 
-// TODO: consider moving a generating function into the Certificate object itself?
-type certGenerator func() (*certs.KeyPair, error)
-
 // Generate will generate any certificates that do not have KeyPair data.
 func (c Certificates) Generate() error {
 	for _, certificate := range c {
 		if certificate.KeyPair == nil {
-			var generator certGenerator
-			switch certificate.Purpose {
-			case APIServerEtcdClient: // Do not generate the APIServerEtcdClient key pair. It is user supplied
-				continue
-			case ServiceAccount:
-				generator = generateServiceAccountKeys
-			default:
-				generator = generateCACert
-			}
-
-			kp, err := generator()
+			err := certificate.Generate()
 			if err != nil {
 				return err
 			}
-			certificate.KeyPair = kp
-			certificate.Generated = true
 		}
 	}
 	return nil
@@ -345,6 +330,7 @@ func (c *Certificate) AsSecret(clusterName client.ObjectKey, owner metav1.OwnerR
 			TLSKeyDataName: c.KeyPair.Key,
 			TLSCrtDataName: c.KeyPair.Cert,
 		},
+		Type: clusterv1.ClusterSecretType,
 	}
 
 	if c.Generated {
@@ -375,6 +361,27 @@ func (c *Certificate) AsFiles() []bootstrapv1.File {
 	return out
 }
 
+func (c *Certificate) Generate() error {
+	// Do not generate the APIServerEtcdClient key pair. It is user supplied
+	if c.Purpose == APIServerEtcdClient {
+		return nil
+	}
+
+	generator := generateCACert
+	if c.Purpose == ServiceAccount {
+		generator = generateServiceAccountKeys
+	}
+
+	kp, err := generator()
+	if err != nil {
+		return err
+	}
+	c.KeyPair = kp
+	c.Generated = true
+
+	return nil
+}
+
 // AsFiles converts a slice of certificates into bootstrap files.
 func (c Certificates) AsFiles() []bootstrapv1.File {
 	clusterCA := c.GetByPurpose(ClusterCA)