Merge pull request #314 from aramase/add-label

feat: add managed label to secret created by driver

Author: k8s-ci-robot

controllers/secretproviderclasspodstatus_controller.go

@@ -45,6 +45,8 @@ import (
 const (
 	certType       = "CERTIFICATE"
 	privateKeyType = "RSA PRIVATE KEY"
+
+	secretManagedLabel = "secrets-store.csi.k8s.io/managed"
 )
 
 // SecretProviderClassPodStatusReconciler reconciles a SecretProviderClassPodStatus object
@@ -173,8 +175,17 @@ func (r *SecretProviderClassPodStatusReconciler) Reconcile(req ctrl.Request) (ct
 				}
 			}
 
+			labelsMap := make(map[string]string)
+			if secretObj.Labels != nil {
+				labelsMap = secretObj.Labels
+			}
+			// Set secrets-store.csi.k8s.io/managed=true label on the secret that's created and managed
+			// by the secrets-store-csi-driver. This label will be used to perform a filtered list watch
+			// only on secrets created and managed by the driver
+			labelsMap[secretManagedLabel] = "true"
+
 			createFn := func() (bool, error) {
-				if err := r.createK8sSecret(ctx, secretObj.SecretName, req.Namespace, datamap, secretObj.Labels, secretType); err != nil {
+				if err := r.createK8sSecret(ctx, secretObj.SecretName, req.Namespace, datamap, labelsMap, secretType); err != nil {
 					logger.Errorf("failed createK8sSecret, err: %v for secret: %s", err, secretObj.SecretName)
 					return false, nil
 				}

test/bats/azure.bats

@@ -130,6 +130,9 @@ setup() {
   result=$(kubectl get secret foosecret -o jsonpath="{.metadata.labels.environment}")
   [[ "${result//$'\r'}" == "${LABEL_VALUE}" ]]
 
+  result=$(kubectl get secret foosecret -o jsonpath="{.metadata.labels.secrets-store\.csi\.k8s\.io/managed}")
+  [[ "${result//$'\r'}" == "true" ]]
+
   result=$(kubectl get secret foosecret -o json | jq '.metadata.ownerReferences | length')
   [[ "$result" -eq 4 ]]
 }

test/bats/vault.bats

@@ -190,6 +190,9 @@ EOF
   result=$(kubectl get secret foosecret -o jsonpath="{.metadata.labels.environment}")
   [[ "${result//$'\r'}" == "${LABEL_VALUE}" ]]
 
+  result=$(kubectl get secret foosecret  -o jsonpath="{.metadata.labels.secrets-store\.csi\.k8s\.io/managed}")
+  [[ "${result//$'\r'}" == "true" ]]
+
   result=$(kubectl get secret foosecret -o json | jq '.metadata.ownerReferences | length')
   [[ "$result" -eq 4 ]]
 }