Fix reconcile loop break when central is not changed

fleetshard/pkg/central/reconciler/reconciler.go

@@ -817,15 +817,18 @@ func (r *CentralReconciler) collectReconciliationStatus(ctx context.Context, rem
 }
 
 func (r *CentralReconciler) areSecretsStored(secretsStored []string) bool {
+	secretsStoredSize := len(secretsStored)
 	expectedSecrets := k8s.GetWatchedSecrets()
-	if len(secretsStored) != len(expectedSecrets) {
+	if secretsStoredSize != len(expectedSecrets) {
 		return false
 	}
 
-	sort.Strings(secretsStored)
+	secretsStoredCopy := make([]string, secretsStoredSize)
+	copy(secretsStoredCopy, secretsStored)
+	sort.Strings(secretsStoredCopy)
 
-	for i := 0; i < len(secretsStored); i++ {
-		if secretsStored[i] != expectedSecrets[i] {
+	for i := 0; i < secretsStoredSize; i++ {
+		if secretsStoredCopy[i] != expectedSecrets[i] {
 			return false
 		}
 	}

fleetshard/pkg/central/reconciler/reconciler_test.go

@@ -420,6 +420,36 @@ func TestReconcileLastHashSetOnSuccess(t *testing.T) {
 	assert.Equal(t, "4", central.Annotations[util.RevisionAnnotationKey])
 }
 
+func TestReconcileLastHashSecretsOrderIndependent(t *testing.T) {
+	_, _, r := getClientTrackerAndReconciler(
+		t,
+		defaultCentralConfig,
+		nil,
+		defaultReconcilerOptions,
+		&v1alpha1.Central{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:        centralName,
+				Namespace:   centralNamespace,
+				Annotations: map[string]string{util.RevisionAnnotationKey: "3"},
+			},
+		},
+		centralDeploymentObject(),
+		centralTLSSecretObject(),
+		centralDBPasswordSecretObject(),
+	)
+
+	managedCentral := simpleManagedCentral
+	managedCentral.RequestStatus = centralConstants.CentralRequestStatusReady.String()
+	managedCentral.Metadata.SecretsStored = []string{"central-tls", "central-db-password"}
+
+	expectedHash, err := util.MD5SumFromJSONStruct(&managedCentral)
+	require.NoError(t, err)
+
+	_, err = r.Reconcile(context.TODO(), managedCentral)
+	require.NoError(t, err)
+	assert.Equal(t, expectedHash, r.lastCentralHash, "Order of stored secrets should not impact hash.")
+}
+
 func TestIgnoreCacheForCentralNotReady(t *testing.T) {
 	_, _, r := getClientTrackerAndReconciler(
 		t,

internal/dinosaur/pkg/presenters/managedcentral.go

@@ -3,6 +3,7 @@ package presenters
 import (
 	"encoding/json"
 	"fmt"
+	"sort"
 	"time"
 
 	"github.com/golang/glog"
@@ -199,5 +200,7 @@ func getSecretNames(from *dbapi.CentralRequest) []string {
 		i++
 	}
 
+	sort.Strings(secretNames)
+
 	return secretNames
 }