feat: hot load secret#576
Draft
tchinmai7 wants to merge 1 commit into
Draft
Conversation
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #576 +/- ##
==========================================
- Coverage 73.63% 72.41% -1.22%
==========================================
Files 19 19
Lines 2958 3052 +94
==========================================
+ Hits 2178 2210 +32
- Misses 525 566 +41
- Partials 255 276 +21 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the Linode Cloud Controller Manager to source the Linode API token from a Kubernetes Secret at runtime (with caching), enabling token rotation without restarting the CCM. It also updates deployment manifests/Helm chart to configure the Secret reference via new CLI flags instead of injecting LINODE_API_TOKEN as an environment variable.
Changes:
- Add CLI flags and options for token Secret name/key/namespace, and switch token loading to a Kubernetes Secret provider with caching.
- Update the Linode API client to support a dynamic token provider (per-request Authorization header).
- Update Helm chart and static manifest to pass the new flags and remove
LINODE_API_TOKENenv var usage; add/adjust unit tests for the new behavior.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| main.go | Adds CLI flags for token Secret name/key/namespace configuration. |
| cloud/linode/options/options.go | Extends options struct with token Secret reference fields. |
| cloud/linode/cloud.go | Implements Secret-backed token provider with caching and wires it into Linode client creation. |
| cloud/linode/client/client.go | Adds a token-injecting transport and TokenProvider support to refresh tokens without restarting. |
| cloud/linode/cloud_test.go | Adds tests for token caching/TTL parsing and updates existing newCloud tests to use fake Secret. |
| deploy/chart/values.yaml | Documents optional Secret namespace in Helm values. |
| deploy/chart/templates/daemonset.yaml | Passes new token Secret flags and removes LINODE_API_TOKEN env var injection. |
| deploy/ccm-linode-template.yaml | Updates static manifest to pass new token Secret flags and removes LINODE_API_TOKEN env var injection. |
Comment on lines
+203
to
206
| apiToken, err := tokenProvider.GetToken(context.Background()) | ||
| if err != nil { | ||
| return nil, err | ||
| } |
Comment on lines
+105
to
+108
| token := string(rawToken) | ||
| if token == "" { | ||
| return "", fmt.Errorf("secret %s key %q is empty", t.String(), t.key) | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
General:
Pull Request Guidelines: