Skip to content

KMIP Upgrade - Fix for empty StringData after calling KubeUpdate#1654

Merged
jackyalbo merged 1 commit intonoobaa:masterfrom
jackyalbo:jacky-rotate-kmip
Jul 10, 2025
Merged

KMIP Upgrade - Fix for empty StringData after calling KubeUpdate#1654
jackyalbo merged 1 commit intonoobaa:masterfrom
jackyalbo:jacky-rotate-kmip

Conversation

@jackyalbo
Copy link
Contributor

@jackyalbo jackyalbo commented Jul 10, 2025

Explain the changes

  1. In Upgrade PutSecret is calling KubeUpdate which removes StringData from the secret. Later GetSecret failes to read any of the keys from the secret. Added KubeCheck which adds the missing StringData to the secret.

Issues: Fixed #xxx / Gap #xxx

  1. Fixed https://issues.redhat.com/browse/DFBUGS-2844

Testing Instructions:

  • Doc added/updated
  • Tests added

Summary by CodeRabbit

  • Bug Fixes
    • Improved validation when retrieving or deleting secrets to ensure proper checks are performed.
    • Enhanced error messages for missing unique identifiers in secrets, providing clearer diagnostic information.

Signed-off-by: jackyalbo <jacky.albo@gmail.com>
@coderabbitai
Copy link

coderabbitai bot commented Jul 10, 2025

Walkthrough

The update introduces explicit validation of the k.secret field using util.KubeCheck in both the GetSecret and DeleteSecret methods within the KMIP KMS storage utility. Additionally, error logging in DeleteSecret is improved to provide more detailed information when a unique identifier is missing.

Changes

File(s) Change Summary
pkg/util/kms/kms_kmip_storage.go Added util.KubeCheck(k.secret) validation in GetSecret and DeleteSecret; improved error logging for missing unique identifier.

Suggested labels

size/M

Suggested reviewers

  • liranmauda
✨ Finishing Touches
  • 📝 Generate Docstrings

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share
🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

  • Review comments: Directly reply to a review comment made by CodeRabbit. Example:
    • I pushed a fix in commit <commit_id>, please review it.
    • Explain this complex logic.
    • Open a follow-up GitHub issue for this discussion.
  • Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
    • @coderabbitai explain this code block.
    • @coderabbitai modularize this function.
  • PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
    • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
    • @coderabbitai read src/utils.ts and explain its main purpose.
    • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
    • @coderabbitai help me debug CodeRabbit configuration file.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

  • @coderabbitai pause to pause the reviews on a PR.
  • @coderabbitai resume to resume the paused reviews.
  • @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
  • @coderabbitai full review to do a full review from scratch and review all the files again.
  • @coderabbitai summary to regenerate the summary of the PR.
  • @coderabbitai generate docstrings to generate docstrings for this PR.
  • @coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
  • @coderabbitai resolve resolve all the CodeRabbit review comments.
  • @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
  • @coderabbitai help to get help.

Other keywords and placeholders

  • Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
  • Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
  • Add @coderabbitai anywhere in the PR title to generate the title automatically.

Documentation and Community

  • Visit our Documentation for detailed information on how to use CodeRabbit.
  • Join our Discord Community to get help, request features, and share feedback.
  • Follow us on X/Twitter for updates and announcements.

@jackyalbo jackyalbo changed the title KMIP - Fix for empty StringData after calling KubeUpdate KMIP Upgrade - Fix for empty StringData after calling KubeUpdate Jul 10, 2025
@jackyalbo jackyalbo requested a review from liranmauda July 10, 2025 12:19
Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

📜 Review details

Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between e0a3efa and d795a5d.

📒 Files selected for processing (1)
  • pkg/util/kms/kms_kmip_storage.go (2 hunks)
🧰 Additional context used
🧬 Code Graph Analysis (1)
pkg/util/kms/kms_kmip_storage.go (1)
pkg/util/util.go (1)
  • KubeCheck (562-583)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (14)
  • GitHub Check: run-kms-kmip-test
  • GitHub Check: run-cli-tests
  • GitHub Check: run-operator-tests
  • GitHub Check: run-azure-vault-test
  • GitHub Check: run-admission-test
  • GitHub Check: run-kms-tls-token-test
  • GitHub Check: run-kms-dev-test
  • GitHub Check: run-core-config-map-tests
  • GitHub Check: run-hac-test
  • GitHub Check: auto-update
  • GitHub Check: cnpg-deployment-test
  • GitHub Check: golangci-lint
  • GitHub Check: run-kms-tls-sa-test
  • GitHub Check: run-kms-key-rotate-test
🔇 Additional comments (2)
pkg/util/kms/kms_kmip_storage.go (2)

422-422: Good improvement to error logging.

The enhanced error message now includes both the missing key name (lookfor) and the secret name (k.secret.Name), providing much better diagnostic information compared to the previous version.


267-267: KMIP secret storage now calls KubeCheck before accessing StringData

All code paths in pkg/util/kms/kms_kmip_storage.go that read from k.secret.StringData after an update now invoke util.KubeCheck(k.secret), ensuring StringData is repopulated:

  • GetSecret (around line 267): added util.KubeCheck(k.secret) before reading activeKeyID/uniqueIdentifier
  • DeleteSecret (around line 419): added util.KubeCheck(k.secret) before locating the key ID

No other flows in this file read StringData post‐update, so the root cause is fully addressed.

lookfor = NewKMIPUniqueID
}
// Find the key ID
util.KubeCheck(k.secret)
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Consider handling KubeCheck return value for consistency.

Similar to the GetSecret method, the KubeCheck return value should be handled for better error handling and consistency.

Consider handling the KubeCheck return value:

-	util.KubeCheck(k.secret)
+	if !util.KubeCheck(k.secret) {
+		log.Errorf("KMIPSecretStorage.DeleteSecret() failed to validate secret %v", k.secret.Name)
+		return fmt.Errorf("failed to validate secret %v", k.secret.Name)
+	}
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
util.KubeCheck(k.secret)
- util.KubeCheck(k.secret)
+ if !util.KubeCheck(k.secret) {
+ log.Errorf("KMIPSecretStorage.DeleteSecret() failed to validate secret %v", k.secret.Name)
+ return fmt.Errorf("failed to validate secret %v", k.secret.Name)
+ }
🤖 Prompt for AI Agents
In pkg/util/kms/kms_kmip_storage.go at line 419, the call to
util.KubeCheck(k.secret) currently ignores its return value. To improve error
handling and maintain consistency with the GetSecret method, capture the return
value from KubeCheck and handle any error it returns appropriately, such as
returning the error or logging it, depending on the function context.


lookfor := KMIPUniqueID // Addition to upgrade
var activeKeyID string
util.KubeCheck(k.secret)
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Consider handling KubeCheck return value for robustness.

The KubeCheck call correctly addresses the StringData restoration issue described in the PR objectives. However, the return value (boolean) is not being checked, which could lead to proceeding with operations even if the secret validation fails.

Consider handling the KubeCheck return value:

-	util.KubeCheck(k.secret)
+	if !util.KubeCheck(k.secret) {
+		log.Errorf("KMIPSecretStorage.GetSecret() failed to validate secret %v", k.secret.Name)
+		return nil, secrets.NoVersion, fmt.Errorf("failed to validate secret %v", k.secret.Name)
+	}
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
util.KubeCheck(k.secret)
if !util.KubeCheck(k.secret) {
log.Errorf("KMIPSecretStorage.GetSecret() failed to validate secret %v", k.secret.Name)
return nil, secrets.NoVersion, fmt.Errorf("failed to validate secret %v", k.secret.Name)
}
🤖 Prompt for AI Agents
In pkg/util/kms/kms_kmip_storage.go at line 267, the call to
util.KubeCheck(k.secret) returns a boolean that indicates success or failure,
but this return value is currently ignored. Modify the code to check the boolean
result and handle the failure case appropriately, such as returning an error or
aborting further processing if the check fails, to ensure robustness and prevent
proceeding with invalid secrets.

@jackyalbo jackyalbo merged commit 8e7fe2d into noobaa:master Jul 10, 2025
16 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants