Pgadmin oauth secrets #4123
Open
Pgadmin oauth secrets #4123
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dsessler7
reviewed
Mar 7, 2025
Comment on lines
+143
to
+190
| // Determine if a rollout because Secrets and ConfigMaps have changed | ||
| checkOauthSecretsChange(oauthSecrets, sts) | ||
| checkConfigMapChange(configmap, sts) | ||
|
|
||
| return sts | ||
| } | ||
|
|
||
| func checkOauthSecretsChange(oauthSecrets []corev1.Secret, sts *appsv1.StatefulSet) { | ||
| var secretHash, currentHash string | ||
| var sb strings.Builder | ||
|
|
||
| for _, secret := range oauthSecrets { | ||
| hash := sha256.New() | ||
| for key, value := range secret.Data { | ||
| hash.Write([]byte(key)) | ||
| hash.Write(value) | ||
| } | ||
| encoding := hex.EncodeToString(hash.Sum(nil)) | ||
| sb.WriteString(encoding) | ||
| } | ||
| secretHash = sb.String() | ||
| currentHash = sts.Spec.Template.Annotations["oauthSecretsHash"] | ||
|
|
||
| if currentHash != secretHash { | ||
| if sts.Spec.Template.Annotations == nil { | ||
| sts.Spec.Template.Annotations = map[string]string{} | ||
| } | ||
| sts.Spec.Template.Annotations["oauthSecretsHash"] = secretHash | ||
| } | ||
| } | ||
|
|
||
| func checkConfigMapChange(configmap *corev1.ConfigMap, sts *appsv1.StatefulSet) { | ||
| var secretHash, currentHash string | ||
| hash := sha256.New() | ||
| for key, value := range configmap.Data { | ||
| hash.Write([]byte(key)) | ||
| hash.Write([]byte(value)) | ||
| } | ||
| secretHash = hex.EncodeToString(hash.Sum(nil)) | ||
| currentHash = sts.Spec.Template.Annotations["configMapHash"] | ||
|
|
||
| if currentHash != secretHash { | ||
| if sts.Spec.Template.Annotations == nil { | ||
| sts.Spec.Template.Annotations = map[string]string{} | ||
| } | ||
| sts.Spec.Template.Annotations["configMapHash"] = secretHash | ||
| } | ||
| } |
There was a problem hiding this comment.
I'm probably just missing something, but I don't understand the purpose of this code here... It seems like it's just updating the hash in the annotation if it is different from the current hash, but I don't see any references to either of these hash annotations in the codebase, so I'm wondering what their purpose is in the first place...
dsessler7
reviewed
Mar 7, 2025
Comment on lines
+46
to
+52
| // OauthConfigurations allows the user to reference one or more Secrets | ||
| // containing OAUTH2 configuration settings for pgAdmin. | ||
| // Each Secret shall contain a single data key called oauth-config.json | ||
| // whose value is a JSON object containing the OAUTH2 configuration settings. | ||
| // More info: https://www.pgadmin.org/docs/pgadmin4/latest/oauth2.html | ||
| // +optional | ||
| OauthConfigurations []corev1.LocalObjectReference `json:"oauthConfigurations,omitempty"` |
There was a problem hiding this comment.
I think it's probably fine to tell the user that they have to name the file a specific thing; however, if we wanted to allow the user to name it whatever they want, you could use SecretKeyRef found in pkg/apis/postgres-operator.crunchydata.com/v1beta1/config_types.go
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Checklist:
Type of Changes:
What is the current behavior (link to any open issues here)?
The PGAdmin API only allows users to specify OAUTH configuration data via plaintext in the manifest.
What is the new behavior (if this is a feature change)?
Users can now specify their OAUTH configuration via a Secret and pass that to the PGAdmin with an entry containing the secret name in
spec.config.oauthConfigurations.Other Information: