controller does not reconcile `Passwords` and `Secrets`

What steps did you take:

I created a Password with some labels. Then I wanted to add another label and was hoping that this change gets pushed down to the Secret. Because this did not happen, I deleted the Secret in the hopes that the secretgen-controller would reconcile and recreate the Secret, now with the updated set of labels from the Password:

Steps taken:

install the secret-gen controller:

k apply -f https://github.com/vmware-tanzu/carvel-secretgen-controller/releases/download/v0.9.1/release.yml

create a password

cat <<'EOF' | k apply -f -
kind: Password
apiVersion: secretgen.k14s.io/v1alpha1
metadata:
name: the-passoword
labels:
  initalLabel: something
spec:
length: 10
secretTemplate:
  type: Secret
  stringData:
    password: $(value)
EOF

inspect the labels on the Password and the Secret:

k get password,secret -o yaml | yq -r '.items[] | "\(.kind): \(.metadata.name) => \(.metadata.labels)"'

Password: the-passoword => {"initalLabel":"something"}
Secret: the-passoword => {"initalLabel":"something"}

change labels on the Password:

k label password/the-passoword anotherLabel=somethingElse

password.secretgen.k14s.io/the-passoword labeled

inspect the labels again:

k get password,secret -o yaml | yq -r '.items[] | "\(.kind): \(.metadata.name) => \(.metadata.labels)"'

Password: the-passoword => {"anotherLabel":"somethingElse","initalLabel":"something"}
Secret: the-passoword => {"initalLabel":"something"}

delete the secret:
```
k delete secret the-passoword
```

see, that the secret is gone:

k get password,secret -o yaml | yq -r '.items[] | "\(.kind): \(.metadata.name) => \(.metadata.labels)"'

Password: the-passoword => {"anotherLabel":"somethingElse","initalLabel":"something"}
# Note, we don't see no `Secret` anymore.

see, that there are no reconcile errors or something:

k get password/the-passoword -o yaml | yq -y .status

conditions:
- status: 'True'
type: ReconcileSucceeded
friendlyDescription: Reconcile succeeded
observedGeneration: 1

What happened:

"Nothing". First the Password did not update the labels on the Secret it created. And then, after the Secret was deleted, the controller made not attempts to recreate the Secret again.

What did you expect:

I expected

the controller to update the Secret's metadata when I update the Password's metadata
the controller to recreate the Secret or give me an error and tell me it cannot recreate the secret (Because it does not know the original password, which cloud be a valid failure case IMHO)

Anything else you would like to add:

I could see that there are reasons to not reconcile the Secret, because the controller has no knowledge of the original password, and for some cases it might be better to not reconcile than to reconcile with a changed password. However, if that's the case I think we should at least call that out in the docs or, ideally, have the controller tell users about that in its status subresource. I think it is "surprising" that the controller seems to be doing nothing at all once the secret is created.

This bug report outlines two different issues. Technically, I guess, they need to address different things (watching updates/deletion of secrets vs. watching updated of passwords). I am happy to split the issue. However, from a user's point of view, I think they are "the same" in the sense that the controller does not seem to reconcile at all.

There was a short discussion about this in #carvel.

Environment:

secretgen-controller version

k get deployment -n secretgen-controller secretgen-controller -o yaml | yq -r '.metadata.annotations["kbld.k14s.io/images"]'

- origins:
- local:
    path: /Users/dk/workspace/carvel-secretgen-controller
- git:
    dirty: false
    remoteURL: git@github.com:vmware-tanzu/carvel-secretgen-controller
    sha: 3b76cf0602b6c377fca8589c5fa30b9f04fc51a0
    tags:
    - v0.9.1
url: ghcr.io/vmware-tanzu/carvel-secretgen-controller@sha256:1f842b9c3e0ee164b450c10486d7b08eee0eacb754af42549aa64906221f7966

Kubernetes version (use kubectl version)

k version
WARNING: version difference between client (1.21) and server (1.24) exceeds the supported minor version skew of +/-1
Client Version: version.Info{Major:"1", Minor:"21", GitVersion:"v1.21.1", GitCommit:"5e58841cce77d4bc13713ad2b91fa0d961e69192", GitTreeState:"clean", BuildDate:"2021-05-12T14:18:45Z", GoVersion:"go1.16.4", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"24", GitVersion:"v1.24.0", GitCommit:"4ce5a8954017644c5420bae81d72b09b735c21f0", GitTreeState:"clean", BuildDate:"2022-05-19T15:39:43Z", GoVersion:"go1.18.1", Compiler:"gc", Platform:"linux/amd64"}

Vote on this request

This is an invitation to the community to vote on issues, to help us prioritize our backlog. Use the "smiley face" up to the right of this comment to vote.

👍 "I would like to see this addressed as soon as possible" 👎 "There are other more important things to focus on right now"

We are also happy to receive and review Pull Requests if you want to help working on this issue.

carvel-dev / secretgen-controller

controller does not reconcile `Passwords` and `Secrets` #91