diff --git a/cmd/controller/main.go b/cmd/controller/main.go index 9da88ba72c..7ce7ddc42a 100644 --- a/cmd/controller/main.go +++ b/cmd/controller/main.go @@ -58,6 +58,8 @@ func bindControllerFlags(f *controller.Flags, fs *flag.FlagSet) { fs.DurationVar(&f.KeyRenewPeriod, "rotate-period", defaultKeyRenewPeriod, "") _ = fs.MarkDeprecated("rotate-period", "please use key-renew-period instead") + + fs.IntVar(&f.MaxRetries, "max-retries", 5, "Max retries.") } func bindFlags(f *controller.Flags, fs *flag.FlagSet, gofs *goflag.FlagSet) { diff --git a/helm/sealed-secrets/README.md b/helm/sealed-secrets/README.md index b273715ca6..6ba930fd1a 100644 --- a/helm/sealed-secrets/README.md +++ b/helm/sealed-secrets/README.md @@ -82,76 +82,77 @@ The command removes all the Kubernetes components associated with the chart and ### Sealed Secrets Parameters -| Name | Description | Value | -| ------------------------------------------------- | ----------------------------------------------------------------------------------------------------- | ----------------------------------- | -| `image.registry` | Sealed Secrets image registry | `docker.io` | -| `image.repository` | Sealed Secrets image repository | `bitnami/sealed-secrets-controller` | -| `image.tag` | Sealed Secrets image tag (immutable tags are recommended) | `0.27.2` | -| `image.pullPolicy` | Sealed Secrets image pull policy | `IfNotPresent` | -| `image.pullSecrets` | Sealed Secrets image pull secrets | `[]` | -| `revisionHistoryLimit` | Number of old history to retain to allow rollback (If not set, default Kubernetes value is set to 10) | `""` | -| `createController` | Specifies whether the Sealed Secrets controller should be created | `true` | -| `secretName` | The name of an existing TLS secret containing the key used to encrypt secrets | `sealed-secrets-key` | -| `updateStatus` | Specifies whether the Sealed Secrets controller should update the status subresource | `true` | -| `skipRecreate` | Specifies whether the Sealed Secrets controller should skip recreating removed secrets | `false` | -| `keyrenewperiod` | Specifies key renewal period. Default 30 days | `""` | -| `keyttl` | Specifies generated certificate validity duration. Default 10 years | `""` | -| `keycutofftime` | Specifies a date at which the controller must generate a new key. Useful in early renewal scenarios. | `""` | -| `rateLimit` | Number of allowed sustained request per second for verify endpoint | `""` | -| `rateLimitBurst` | Number of requests allowed to exceed the rate limit per second for verify endpoint | `""` | -| `additionalNamespaces` | List of namespaces used to manage the Sealed Secrets | `[]` | -| `privateKeyAnnotations` | Map of annotations to be set on the sealing keypairs | `{}` | -| `privateKeyLabels` | Map of labels to be set on the sealing keypairs | `{}` | -| `logInfoStdout` | Specifies whether the Sealed Secrets controller will log info to stdout | `false` | -| `logLevel` | Specifies log level of controller (INFO,ERROR) | `""` | -| `logFormat` | Specifies log format (text,json) | `""` | -| `command` | Override default container command | `[]` | -| `args` | Override default container args | `[]` | -| `livenessProbe.enabled` | Enable livenessProbe on Sealed Secret containers | `true` | -| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `0` | -| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | -| `livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `1` | -| `livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `3` | -| `livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | -| `readinessProbe.enabled` | Enable readinessProbe on Sealed Secret containers | `true` | -| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `0` | -| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | -| `readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` | -| `readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` | -| `readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | -| `startupProbe.enabled` | Enable startupProbe on Sealed Secret containers | `false` | -| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `0` | -| `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | -| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | -| `startupProbe.failureThreshold` | Failure threshold for startupProbe | `3` | -| `startupProbe.successThreshold` | Success threshold for startupProbe | `1` | -| `customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | -| `customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | -| `customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | -| `resources.limits` | The resources limits for the Sealed Secret containers | `{}` | -| `resources.requests` | The requested resources for the Sealed Secret containers | `{}` | -| `podSecurityContext.enabled` | Enabled Sealed Secret pods' Security Context | `true` | -| `podSecurityContext.fsGroup` | Set Sealed Secret pod's Security Context fsGroup | `65534` | -| `containerSecurityContext.enabled` | Enabled Sealed Secret containers' Security Context | `true` | -| `containerSecurityContext.readOnlyRootFilesystem` | Whether the Sealed Secret container has a read-only root filesystem | `true` | -| `containerSecurityContext.runAsNonRoot` | Indicates that the Sealed Secret container must run as a non-root user | `true` | -| `containerSecurityContext.runAsUser` | Set Sealed Secret containers' Security Context runAsUser | `1001` | -| `containerSecurityContext.capabilities` | Adds and removes POSIX capabilities from running containers (see `values.yaml`) | | -| `podLabels` | Extra labels for Sealed Secret pods | `{}` | -| `podAnnotations` | Annotations for Sealed Secret pods | `{}` | -| `priorityClassName` | Sealed Secret pods' priorityClassName | `""` | -| `runtimeClassName` | Sealed Secret pods' runtimeClassName | `""` | -| `affinity` | Affinity for Sealed Secret pods assignment | `{}` | -| `nodeSelector` | Node labels for Sealed Secret pods assignment | `{}` | -| `tolerations` | Tolerations for Sealed Secret pods assignment | `[]` | -| `additionalVolumes` | Extra Volumes for the Sealed Secrets Controller Deployment | `{}` | -| `additionalVolumeMounts` | Extra volumeMounts for the Sealed Secrets Controller container | `{}` | -| `hostNetwork` | Sealed Secrets pods' hostNetwork | `false` | -| `containerPorts.http` | Controller HTTP Port on the Host and Container | `8080` | -| `containerPorts.metrics` | Metrics HTTP Port on the Host and Container | `8081` | -| `hostPorts.http` | Controller HTTP Port on the Host | `""` | -| `hostPorts.metrics` | Metrics HTTP Port on the Host | `""` | -| `dnsPolicy` | Sealed Secrets pods' dnsPolicy | `""` | +| Name | Description | Value | +| ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ | ----------------------------------- | +| `image.registry` | Sealed Secrets image registry | `docker.io` | +| `image.repository` | Sealed Secrets image repository | `bitnami/sealed-secrets-controller` | +| `image.tag` | Sealed Secrets image tag (immutable tags are recommended) | `0.27.2` | +| `image.pullPolicy` | Sealed Secrets image pull policy | `IfNotPresent` | +| `image.pullSecrets` | Sealed Secrets image pull secrets | `[]` | +| `revisionHistoryLimit` | Number of old history to retain to allow rollback (If not set, default Kubernetes value is set to 10) | `""` | +| `createController` | Specifies whether the Sealed Secrets controller should be created | `true` | +| `secretName` | The name of an existing TLS secret containing the key used to encrypt secrets | `sealed-secrets-key` | +| `updateStatus` | Specifies whether the Sealed Secrets controller should update the status subresource | `true` | +| `skipRecreate` | Specifies whether the Sealed Secrets controller should skip recreating removed secrets | `false` | +| `keyrenewperiod` | Specifies key renewal period. Default 30 days | `""` | +| `keyttl` | Specifies the certificate validity duration. Default 10 years. | `""` | +| `keycutofftime` | Specifies a date at which the controller should generate a new certificate. Useful in early key renewal scenarios. | `""` | +| `rateLimit` | Number of allowed sustained request per second for verify endpoint | `""` | +| `rateLimitBurst` | Number of requests allowed to exceed the rate limit per second for verify endpoint | `""` | +| `additionalNamespaces` | List of namespaces used to manage the Sealed Secrets | `[]` | +| `privateKeyAnnotations` | Map of annotations to be set on the sealing keypairs | `{}` | +| `privateKeyLabels` | Map of labels to be set on the sealing keypairs | `{}` | +| `logInfoStdout` | Specifies whether the Sealed Secrets controller will log info to stdout | `false` | +| `logLevel` | Specifies log level of controller (INFO,ERROR) | `""` | +| `logFormat` | Specifies log format (text,json) | `""` | +| `maxRetries` | Number of maximum retries | `""` | +| `command` | Override default container command | `[]` | +| `args` | Override default container args | `[]` | +| `livenessProbe.enabled` | Enable livenessProbe on Sealed Secret containers | `true` | +| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `0` | +| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `1` | +| `livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `3` | +| `livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `readinessProbe.enabled` | Enable readinessProbe on Sealed Secret containers | `true` | +| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `0` | +| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` | +| `readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` | +| `readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `startupProbe.enabled` | Enable startupProbe on Sealed Secret containers | `false` | +| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `0` | +| `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `startupProbe.failureThreshold` | Failure threshold for startupProbe | `3` | +| `startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | +| `resources.limits` | The resources limits for the Sealed Secret containers | `{}` | +| `resources.requests` | The requested resources for the Sealed Secret containers | `{}` | +| `podSecurityContext.enabled` | Enabled Sealed Secret pods' Security Context | `true` | +| `podSecurityContext.fsGroup` | Set Sealed Secret pod's Security Context fsGroup | `65534` | +| `containerSecurityContext.enabled` | Enabled Sealed Secret containers' Security Context | `true` | +| `containerSecurityContext.readOnlyRootFilesystem` | Whether the Sealed Secret container has a read-only root filesystem | `true` | +| `containerSecurityContext.runAsNonRoot` | Indicates that the Sealed Secret container must run as a non-root user | `true` | +| `containerSecurityContext.runAsUser` | Set Sealed Secret containers' Security Context runAsUser | `1001` | +| `containerSecurityContext.capabilities` | Adds and removes POSIX capabilities from running containers (see `values.yaml`) | | +| `podLabels` | Extra labels for Sealed Secret pods | `{}` | +| `podAnnotations` | Annotations for Sealed Secret pods | `{}` | +| `priorityClassName` | Sealed Secret pods' priorityClassName | `""` | +| `runtimeClassName` | Sealed Secret pods' runtimeClassName | `""` | +| `affinity` | Affinity for Sealed Secret pods assignment | `{}` | +| `nodeSelector` | Node labels for Sealed Secret pods assignment | `{}` | +| `tolerations` | Tolerations for Sealed Secret pods assignment | `[]` | +| `additionalVolumes` | Extra Volumes for the Sealed Secrets Controller Deployment | `{}` | +| `additionalVolumeMounts` | Extra volumeMounts for the Sealed Secrets Controller container | `{}` | +| `hostNetwork` | Sealed Secrets pods' hostNetwork | `false` | +| `containerPorts.http` | Controller HTTP Port on the Host and Container | `8080` | +| `containerPorts.metrics` | Metrics HTTP Port on the Host and Container | `8081` | +| `hostPorts.http` | Controller HTTP Port on the Host | `""` | +| `hostPorts.metrics` | Metrics HTTP Port on the Host | `""` | +| `dnsPolicy` | Sealed Secrets pods' dnsPolicy | `""` | ### Traffic Exposure Parameters diff --git a/helm/sealed-secrets/templates/deployment.yaml b/helm/sealed-secrets/templates/deployment.yaml index c86e10ae54..49cc474a37 100644 --- a/helm/sealed-secrets/templates/deployment.yaml +++ b/helm/sealed-secrets/templates/deployment.yaml @@ -145,6 +145,10 @@ spec: - --listen-metrics-addr - {{ printf ":%s" (.Values.containerPorts.metrics | toString) }} {{- end }} + {{- if .Values.maxRetries }} + - --max-retries + - {{ .Values.maxRetries | quote }} + {{- end }} {{- end }} image: {{ printf "%s/%s:%s" .Values.image.registry .Values.image.repository .Values.image.tag }} imagePullPolicy: {{ .Values.image.pullPolicy }} diff --git a/helm/sealed-secrets/values.yaml b/helm/sealed-secrets/values.yaml index bde9c54300..2a2c9e45db 100644 --- a/helm/sealed-secrets/values.yaml +++ b/helm/sealed-secrets/values.yaml @@ -112,6 +112,9 @@ logLevel: "" ## @param logFormat Specifies log format (text,json) ## logFormat: "" +## @param maxRetries Number of maximum retries +## +maxRetries: "" ## @param command Override default container command ## command: [] diff --git a/pkg/controller/controller.go b/pkg/controller/controller.go index 7c42469b4f..8987ffadcc 100644 --- a/pkg/controller/controller.go +++ b/pkg/controller/controller.go @@ -38,8 +38,6 @@ import ( ) const ( - maxRetries = 5 - // SuccessUnsealed is used as part of the Event 'reason' when // a SealedSecret is unsealed successfully. SuccessUnsealed = "Unsealed" @@ -60,6 +58,8 @@ const ( var ( // ErrCast happens when a K8s any type cannot be casted to the expected type. ErrCast = errors.New("cast error") + + maxRetries = 5 ) // Controller implements the main sealed-secrets-controller loop. @@ -77,7 +77,7 @@ type Controller struct { } // NewController returns the main sealed-secrets controller loop. -func NewController(clientset kubernetes.Interface, ssclientset ssclientset.Interface, ssinformer ssinformer.SharedInformerFactory, sinformer informers.SharedInformerFactory, keyRegistry *KeyRegistry) (*Controller, error) { +func NewController(clientset kubernetes.Interface, ssclientset ssclientset.Interface, ssinformer ssinformer.SharedInformerFactory, sinformer informers.SharedInformerFactory, keyRegistry *KeyRegistry, maxRetriesConfig int) (*Controller, error) { queue := workqueue.NewRateLimitingQueue(workqueue.DefaultControllerRateLimiter()) utilruntime.Must(ssscheme.AddToScheme(scheme.Scheme)) @@ -102,6 +102,8 @@ func NewController(clientset kubernetes.Interface, ssclientset ssclientset.Inter } } + maxRetries = maxRetriesConfig + return &Controller{ ssInformer: ssInformer, sInformer: sInformer, diff --git a/pkg/controller/main.go b/pkg/controller/main.go index 84b15f2bc7..dd2f934957 100644 --- a/pkg/controller/main.go +++ b/pkg/controller/main.go @@ -55,6 +55,7 @@ type Flags struct { LogFormat string PrivateKeyAnnotations string PrivateKeyLabels string + MaxRetries int } func initKeyPrefix(keyPrefix string) (string, error) { @@ -267,7 +268,7 @@ func Main(f *Flags, version string) error { func prepareController(clientset kubernetes.Interface, namespace string, tweakopts func(*metav1.ListOptions), f *Flags, ssclientset versioned.Interface, keyRegistry *KeyRegistry) (*Controller, error) { sinformer := initSecretInformerFactory(clientset, namespace, tweakopts, f.SkipRecreate) ssinformer := ssinformers.NewFilteredSharedInformerFactory(ssclientset, 0, namespace, tweakopts) - controller, err := NewController(clientset, ssclientset, ssinformer, sinformer, keyRegistry) + controller, err := NewController(clientset, ssclientset, ssinformer, sinformer, keyRegistry, f.MaxRetries) return controller, err }