ory / hydra-maester

Kuberenetes CRD Controller for Ory Hydra. :warning: Maintained by the community, not an official Ory project!
Apache License 2.0
33 stars 38 forks source link

fix: add ready condition to OAuth2ClientStatus #122

Closed andremarianiello closed 1 year ago

andremarianiello commented 1 year ago

Adds Ready condition to OAuth2ClientStatus. This allows k8s clients with support for status conditions to determine if the client has been synchronized with hydra and the corresponding secret for an OAuth2Client is ready to be read.

Related Issue

This change fixes an issue I was having when trying to use hydra-maester with OAuth2Clients in terraform. Since this is a custom resource I was using the kubernetes_manifest resource, and I was also using terraform to extract the client credentials from the k8s secret. However, this was not working because terraform attempts to read the secret immediately after it finishes creating the OAuth2Client, and when the secret doesn't exist yet (which happens like 75%) of the time, the terraform apply fails. The kubernetes_manifest has built in support for "conditions" which are a k8s concept that help controllers and clients communicate. I can tell terraform to wait for the Ready condition to be True and this will stop terraform from trying to read the secret too early. Controllers like cert-manager use a similar technique.

Checklist

Further comments

I haven't worked on a kubebuilder k8s controller before, so if I did anything wrong in that regard, please let me know!

CLAassistant commented 1 year ago

CLA assistant check
All committers have signed the CLA.

andremarianiello commented 1 year ago

I'm not sure why the docker scan is failing, as the error message looks like

  1 error occurred:
    * discovered vulnerabilities at or above the severity threshold

so I'm not sure what's wrong.

Demonsthere commented 1 year ago

Hello there! There is a bug in the scanner version we have, that it does not show the actual report on the CVEs. I will try to fix the CI as soon as I can to unblock this

andremarianiello commented 1 year ago

Thanks for helping with this @Demonsthere ! I rebased onto the commit to added to master this morning and that gave me enough info to know what versions to bump. CI seems happy now.