Skip to content

Controller attempts to process a PushSecret managed by another store #2164

@Dev25

Description

@Dev25

ES controller does not respect the PushSecret's secretStore that belongs to another controller, instead of trying to skip processing it will attempt to process and spam error logs on a constant basis (multiple logs per second).

Expected single log like how controllers interact today with skipping unmanaged store as it points to a unmanaged controllerClass

Instead we have constant error spam like

{
  "level": "error",
  "ts": 1679579428.1318305,
  "msg": "Reconciler error",
  "controller": "pushsecret",
  "controllerGroup": "external-secrets.io",
  "controllerKind": "PushSecret",
  "PushSecret": {
    "name": "ps-test",
    "namespace": "istio-system"
  },
  "namespace": "istio-system",
  "name": "ps-test",
  "reconcileID": "d52f9157-479a-426e-aa92-1a624f2e3b18",
  "error": "could not get secrets client for store test-store: can not reference unmanaged store",
  "stacktrace": "sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.14.5/pkg/internal/controller/controller.go:329\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.14.5/pkg/internal/controller/controller.go:274\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.14.5/pkg/internal/controller/controller.go:235"
}

PushSecret should have similar logic to ExternalSecret where it skips unmanaged stores
https://github.com/external-secrets/external-secrets/blob/main/pkg/controllers/externalsecret/externalsecret_controller.go#LL125-L129

	// skip when pointing to an unmanaged store
	skip, err := shouldSkipUnmanagedStore(ctx, req.Namespace, r, externalSecret)
	if skip {
		log.Info("skipping unmanaged store as it points to a unmanaged controllerClass")
		return ctrl.Result{}, nil
	}

Metadata

Metadata

Assignees

No one assigned

    Labels

    StaleThis issue/Pull Request is stale and will be automatically closedgood first issueGood for newcomerskind/bugCategorizes issue or PR as related to a bug.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions