Delimiter annotation #664

Diliz · 2024-07-08T12:28:27Z

Rebased @cailtlinelfring annotations branch with delimiter annotations feature

rebased content of #226 instead of making my own (I was using leftdelim and rightdelim annotations in my version, nearly the same as @caitlinelfring version

hashicorp-cla-app · 2024-07-08T12:28:40Z

All committers have signed the CLA.

agent-inject/agent/annotations.go

Diliz · 2024-07-08T13:46:40Z

fix hashicorp/vault-helm#348 as well

Diliz · 2024-07-17T07:53:52Z

@tvoran @benashz How much time does it take for pull requests from outsiders to be checked and merged? (Just to know if this will be available soon or not on my side)

benashz · 2024-07-18T15:47:45Z

The original pull request talks a bit about handling templates included in a Helm chart. I wonder if we could recommend escaping the template instead of adding support for specifying alternate template delimiters? We are suggesting that approach here: hashicorp/vault-secrets-operator#619 (comment)

Diliz · 2024-07-22T06:29:00Z

The original pull request talks a bit about handling templates included in a Helm chart. I wonder if we could recommend escaping the template instead of adding support for specifying alternate template delimiters? We are suggesting that approach here: hashicorp/vault-secrets-operator#619 (comment)

Humm, this helm approache is a workaround, not something to fix the real issue, currently it's a hassle to use go templating inside vault templates in kubernetes, if you want to make templating over templating over termplating, it becomes impossible to use if you don't know beforehand how many times the template will be templated, so escaping it is not a solution in this case.

Why not simply adding this delim annotations to make it convenient and be able to differentiate the default go templating from the one for the vault agent?

tvoran

Thanks for updating this! It tested good locally for me; just left a couple thoughts.

Something else I think may be useful here is a way to set the default template delimiters for all the templates in a Pod, instead of per-template. Perhaps the delimiter annotations by themselves (without the secret suffix) could be used for this? Just something I was thinking about while reviewing this, but we can do it in a follow-up PR too.

agent-inject/agent/annotations.go

tvoran · 2024-07-30T21:33:50Z

agent-inject/agent/annotations.go

+		secret.LeftDelimiter = a.annotationsSecretValue(AnnotationAgentInjectTemplateLeftDelim, secret.RawName, "")
+		secret.RightDelimiter = a.annotationsSecretValue(AnnotationAgentInjectTemplateRightDelim, secret.RawName, "")


Seems like we might as well set the default delimiter here?

Suggested change

secret.LeftDelimiter = a.annotationsSecretValue(AnnotationAgentInjectTemplateLeftDelim, secret.RawName, "")

secret.RightDelimiter = a.annotationsSecretValue(AnnotationAgentInjectTemplateRightDelim, secret.RawName, "")

secret.LeftDelimiter = a.annotationsSecretValue(AnnotationAgentInjectTemplateLeftDelim, secret.RawName, DefaultLeftDelim)

secret.RightDelimiter = a.annotationsSecretValue(AnnotationAgentInjectTemplateRightDelim, secret.RawName, DefaultRightDelim)

The thing is, we can then makes the default delimiters handled by the config, which is where the templating will be done, it was done this way in the previous pull request, I did it the way you say in the first place but I think it's better/less error prone to let the config handle that, no?

Not sure I follow about it being better/less error prone? Since the delimiter annotations are set directly in the corresponding Agent config options (i.e. nothing is changing them in between parsing the annotations and writing the Agent config), seems like they can be set as soon as they are known.

If the delimiter settings end up empty in the Agent config because an annotation sets them to "", that's actually ok too since they aren't required Agent config parameters.

(I don't think it matters too much either way, so I'll leave it up to you and not hold it up over this.)

markush81 · 2024-08-21T14:51:16Z

Just stumbled over this and it is exactly what i need as well. Doing the escaping kinda gets easily a hell if you want to have parts replaced by helm template and parts by vault.

Any ETA for this PR?

Diliz · 2024-08-28T08:12:11Z

Just stumbled over this and it is exactly what i need as well. Doing the escaping kinda gets easily a hell if you want to have parts replaced by helm template and parts by vault.

Any ETA for this PR?

Waiting for @tvoran and @benashz comments and approval, I'm still following this case as I need it implemented as well 👍

agent-inject/agent/annotations.go

tvoran · 2024-09-02T07:24:21Z

agent-inject/agent/annotations.go

+		secret.LeftDelimiter = a.annotationsSecretValue(AnnotationAgentInjectTemplateLeftDelim, secret.RawName, "")
+		secret.RightDelimiter = a.annotationsSecretValue(AnnotationAgentInjectTemplateRightDelim, secret.RawName, "")


Not sure I follow about it being better/less error prone? Since the delimiter annotations are set directly in the corresponding Agent config options (i.e. nothing is changing them in between parsing the annotations and writing the Agent config), seems like they can be set as soon as they are known.

If the delimiter settings end up empty in the Agent config because an annotation sets them to "", that's actually ok too since they aren't required Agent config parameters.

(I don't think it matters too much either way, so I'll leave it up to you and not hold it up over this.)

agent-inject/agent/annotations.go

Diliz · 2024-10-28T07:13:57Z

Made the requested changes, it should be good now :)

Rebased as well

tvoran

Just a couple more minor things.

tvoran · 2024-11-01T05:10:42Z

agent-inject/agent/annotations.go

+	// AnnotationAgentInjectToken is the annotation key for injecting the
+	// auto-auth token into the secrets volume (e.g. /vault/secrets/token)


Suggested change

// AnnotationAgentInjectToken is the annotation key for injecting the

// auto-auth token into the secrets volume (e.g. /vault/secrets/token)

tvoran · 2024-11-01T05:16:05Z

agent-inject/agent/config_test.go

@@ -134,6 +139,10 @@ func TestNewConfig(t *testing.T) {
 			if template.Contents != "template foo" {
 				t.Errorf("expected template contents to be %s, got %s", "template foo", template.Contents)
 			}
+
+			if template.LeftDelim != DefaultLeftDelim || template.RightDelim != DefaultRightDelim {
+				t.Errorf("expected default delimiters to be %s (left) and %s (right), got %s (left) and %s (right)", template.LeftDelim, template.RightDelim, DefaultLeftDelim, DefaultRightDelim)


Looks like the "got" and "expected" values are flipped:

Suggested change

t.Errorf("expected default delimiters to be %s (left) and %s (right), got %s (left) and %s (right)", template.LeftDelim, template.RightDelim, DefaultLeftDelim, DefaultRightDelim)

t.Errorf("expected default delimiters to be %s (left) and %s (right), got %s (left) and %s (right)", DefaultLeftDelim, DefaultRightDelim, template.LeftDelim, template.RightDelim)

tvoran · 2024-11-01T05:16:44Z

agent-inject/agent/config_test.go

@@ -170,6 +179,10 @@ func TestNewConfig(t *testing.T) {
 			if template.Destination != "/vault/secrets/just-template-file" {
 				t.Errorf("expected template destination to be %s, got %s", "/vault/secrets/just-template-file", template.Destination)
 			}
+		} else if strings.Contains(template.Destination, "baz") {
+			if template.LeftDelim != "[[" || template.RightDelim != "]]" {
+				t.Errorf("expected default delimiters to be %s (left) and %s (right), got %s (left) and %s (right)", template.LeftDelim, template.RightDelim, "[[", "]]")


Suggested change

t.Errorf("expected default delimiters to be %s (left) and %s (right), got %s (left) and %s (right)", template.LeftDelim, template.RightDelim, "[[", "]]")

t.Errorf("expected default delimiters to be %s (left) and %s (right), got %s (left) and %s (right)", "[[", "]]", template.LeftDelim, template.RightDelim)

Diliz requested a review from a team as a code owner July 8, 2024 12:28

Diliz commented Jul 8, 2024

View reviewed changes

agent-inject/agent/annotations.go Outdated Show resolved Hide resolved

tvoran reviewed Jul 30, 2024

View reviewed changes

Diliz force-pushed the delimiter-annotation branch from 7beb30b to 2528e4d Compare August 5, 2024 08:40

tvoran reviewed Sep 2, 2024

View reviewed changes

caitlinelfring and others added 3 commits October 28, 2024 08:10

Add annotations for customize template delimiters

de5b72a

fix: changed delimiter annotations names

08efcca

fix: moved default delims values in config.go

0b1833d

Diliz force-pushed the delimiter-annotation branch from 2e1441b to 0b1833d Compare October 28, 2024 07:10

tvoran added this to the 1.5.0 milestone Oct 31, 2024

tvoran reviewed Nov 1, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Delimiter annotation #664

Delimiter annotation #664

Diliz commented Jul 8, 2024 •

edited

Loading

hashicorp-cla-app bot commented Jul 8, 2024 •

edited

Loading

Diliz commented Jul 8, 2024

Diliz commented Jul 17, 2024

benashz commented Jul 18, 2024

Diliz commented Jul 22, 2024

tvoran left a comment

tvoran Jul 30, 2024

Diliz Aug 5, 2024

tvoran Sep 2, 2024

markush81 commented Aug 21, 2024

Diliz commented Aug 28, 2024

tvoran Sep 2, 2024

Diliz commented Oct 28, 2024 •

edited

Loading

tvoran left a comment

tvoran Nov 1, 2024

tvoran Nov 1, 2024

tvoran Nov 1, 2024

		secret.LeftDelimiter = a.annotationsSecretValue(AnnotationAgentInjectTemplateLeftDelim, secret.RawName, "")
		secret.RightDelimiter = a.annotationsSecretValue(AnnotationAgentInjectTemplateRightDelim, secret.RawName, "")

		// AnnotationAgentInjectToken is the annotation key for injecting the
		// auto-auth token into the secrets volume (e.g. /vault/secrets/token)

	t.Errorf("expected default delimiters to be %s (left) and %s (right), got %s (left) and %s (right)", template.LeftDelim, template.RightDelim, DefaultLeftDelim, DefaultRightDelim)
	t.Errorf("expected default delimiters to be %s (left) and %s (right), got %s (left) and %s (right)", DefaultLeftDelim, DefaultRightDelim, template.LeftDelim, template.RightDelim)

Delimiter annotation #664

Are you sure you want to change the base?

Delimiter annotation #664

Conversation

Diliz commented Jul 8, 2024 • edited Loading

hashicorp-cla-app bot commented Jul 8, 2024 • edited Loading

Diliz commented Jul 8, 2024

Diliz commented Jul 17, 2024

benashz commented Jul 18, 2024

Diliz commented Jul 22, 2024

tvoran left a comment

Choose a reason for hiding this comment

tvoran Jul 30, 2024

Choose a reason for hiding this comment

Diliz Aug 5, 2024

Choose a reason for hiding this comment

tvoran Sep 2, 2024

Choose a reason for hiding this comment

markush81 commented Aug 21, 2024

Diliz commented Aug 28, 2024

tvoran Sep 2, 2024

Choose a reason for hiding this comment

Diliz commented Oct 28, 2024 • edited Loading

tvoran left a comment

Choose a reason for hiding this comment

tvoran Nov 1, 2024

Choose a reason for hiding this comment

tvoran Nov 1, 2024

Choose a reason for hiding this comment

tvoran Nov 1, 2024

Choose a reason for hiding this comment

Diliz commented Jul 8, 2024 •

edited

Loading

hashicorp-cla-app bot commented Jul 8, 2024 •

edited

Loading

Diliz commented Oct 28, 2024 •

edited

Loading