-
-
Notifications
You must be signed in to change notification settings - Fork 38
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix: add ready condition to OAuth2ClientStatus #122
Conversation
99138a8
to
dc3c2c8
Compare
0e1c7d6
to
24d82f4
Compare
I'm not sure why the docker scan is failing, as the error message looks like
so I'm not sure what's wrong. |
cceddf6
to
b6d08a7
Compare
b6d08a7
to
b2e8fa7
Compare
Hello there! |
Thanks for helping with this @Demonsthere ! I rebased onto the commit to added to master this morning and that gave me enough info to know what versions to bump. CI seems happy now. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for the updates :) The addition of status condition makes perfect sense, and is a welcome addition.
Adds Ready condition to OAuth2ClientStatus. This allows k8s clients with support for status conditions to determine if the client has been synchronized with hydra and the corresponding secret for an OAuth2Client is ready to be read.
Related Issue
This change fixes an issue I was having when trying to use hydra-maester with OAuth2Clients in terraform. Since this is a custom resource I was using the
kubernetes_manifest
resource, and I was also using terraform to extract the client credentials from the k8s secret. However, this was not working because terraform attempts to read the secret immediately after it finishes creating the OAuth2Client, and when the secret doesn't exist yet (which happens like 75%) of the time, the terraform apply fails. Thekubernetes_manifest
has built in support for "conditions" which are a k8s concept that help controllers and clients communicate. I can tell terraform to wait for theReady
condition to beTrue
and this will stop terraform from trying to read the secret too early. Controllers like cert-manager use a similar technique.Checklist
If this pull request addresses a security vulnerability,
I confirm that I got approval (please contact [email protected]) from the maintainers to push the changes.
Further comments
I haven't worked on a kubebuilder k8s controller before, so if I did anything wrong in that regard, please let me know!