GCPCloudSQL Role Password unable to update

[gogovan-vincentngai]

What happened?

GCPCloudSQL Role Password unable to update

How can we reproduce it?

• GCP Create CloudSQL Instance
• Crate DB inside the instance
• Create User Role with below config

  apiVersion: postgresql.sql.crossplane.io/v1alpha1
  kind: Role
  metadata:
  annotations:
  crossplane.io/external-name: vincent-test
  name: vincent-test
  namespace: infra-tools
  spec:
  forProvider:
  passwordSecretRef:
    name: vincent-test
    namespace: infra-tools
    key: password
  connectionLimit: -1
  privileges:
    login: true
  providerConfigRef:
  name: provider-config

• secret # aaaabbbbbb123123

  apiVersion: v1
  data:
  password: YWFhYWJiYmJiYjEyMzEyMw==  
  kind: Secret
  metadata:
  labels:
  argocd.argoproj.io/instance: crossplane-cloudsql
  name: vincent-test
  namespace: infra-tools
  type: connection.crossplane.io/v1alpha1

• Test user success login with the password
• Update the secret to otherthings
• Wait it sync , event message will show UpdatedExternalResource something updated
• Retest user with new password

What environment did it happen in?

Crossplane version: 1.10.1 provider-sql: 0.6.0 Kubernetes version: 1.22 Kubernetes distribution: GKE

[pascal-sochacki]

Hey, I just looked at the bug and found you need to define a writeConnectionSecretToRef in your Role

example:

apiVersion: postgresql.sql.crossplane.io/v1alpha1
kind: Role
metadata:
  annotations:
    crossplane.io/external-name: vincent-test
  name: vincent-test
spec:

  writeConnectionSecretToRef: <<<
    name: db-pass-2  <<<
    namespace: default   <<<

  forProvider:
    passwordSecretRef:
      name: db-pass
      namespace: default
      key: password
    connectionLimit: -1
    privileges:
      login: true

The Reason for this is, in the current implementation, the difference is detected if the password in the created secret (from the writeConnectionSecretToRef) is not the same as in the passwordSecretRef. (see the code at https://github.com/crossplane-contrib/provider-sql/blob/c6c358b9f05e1e7f2e77906c20eb5d714e29143e/pkg/controller/postgresql/role/utils.go#L47). I hope I could help.

[Duologic]

Sounds like this was resolved.