[DPE-3587] Old secret field translations (issue #140) #141
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
juditnovak
force-pushed
the
DPE-3587_old_secret_field_translations
branch
2 times, most recently
from
238018b
to
05bde73
Compare
juditnovak
force-pushed
the
DPE-3587_old_secret_field_translations
branch
from
05bde73
to
ba1c965
Compare
juditnovak
changed the title
juditnovak
commented
Feb 16, 2024
| return self._fetch_relation_data_with_secrets( | ||
| self.component, self.secret_fields, relation, fields | ||
| ) | ||
|
|
There was a problem hiding this comment.
This function is not needed for DataPeer, cleaning it up
juditnovak
commented
Feb 16, 2024
| secret_fields_passed = set(self.secret_fields) & set(fields) | ||
| for field in secret_fields_passed: | ||
| if self._fetch_relation_data_without_secrets(self.component, relation, [field]): | ||
| self._delete_relation_data_without_secrets(self.component, relation, [field]) |
There was a problem hiding this comment.
The above function got "re-grouped" to the suited block, with mild modifications
juditnovak
commented
Feb 16, 2024
| logger.error( | ||
| "Non-existing secret %s was attempted to be removed.", | ||
| ", ".join(non_existent), | ||
| ) |
There was a problem hiding this comment.
The checks above are now moved to aonther 'backwards compatiblity' (bc) function
juditnovak
commented
Feb 16, 2024
| self._secrets.pop(label) | ||
| else: | ||
| logging.error("Non-existing Juju Secret was attempted to be removed %s", label) | ||
|
|
||
|
|
There was a problem hiding this comment.
The two changes above are a small but important bugfix. Used at secret deletion below.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Problem
This PR is targeting the issue where we have to use different secret fields than what we had in the databag.
Typically
ca(short) orauth_cfg(_not permitted) are currently "manyally" translated on the charm's side.The difference between old/new names typically causes an issue for rolling upgrades. Currently PG charms and soon upcoming Zookeeper would be impacted by this issue.
After a LOT of thinking, the lib seemed to be the right place to hold this logic, as it's already handling the rest of the backwards compatibility functionalities (typically for rolling upgrades). The current code is already following through changes like moving sensitive data from databag to secrets, or to move from a secret URI (stored in databag) to secret labels. Since the translation problem is strongly related to the former, the logic should go to the lib. Even though I'm not happy about this extra complexity at all :-/
Implementation
I chose to take a mapping as a parameter, as this should cover existing use-cases. The other option would have been to add a user-defined translation function, however that feels a lot less safe (i.e. introducting bugs on secrets!!!) than a straightforward mapping. Note that the current scheme is easily extendible to take both options.
POC (Pgbouncer)
The POC of this working with Pgbouncer (one of the main requestors of the feature) can be found here: canonical/pgbouncer-operator#149
Let me know what you think.