Add reconciliation logic for NooBaa with external PostgreSQL for secret creation #1669
Conversation
WalkthroughAdded a Secret watch to the NooBaa controller to map Secret events to NooBaa reconciliations, a utility to obtain a NooBaa external Postgres Secret reference, a mapping function to find NooBaa resources referencing a Secret, and updated the global RPC handler to enqueue a reconcile for the NooBaa system on each RPC message. Changes
Sequence Diagram(s)sequenceDiagram
participant K8sAPI as K8s API Server
participant SecretWatch as Secret Watch
participant Controller as NooBaa Controller
participant System as system.MapSecretToNooBaa
participant NooBaa as NooBaa CRs
participant RPC as Global RPC handler
participant Queue as notificationSource (rate-limited)
K8sAPI->>SecretWatch: Secret event (create/update/delete)
SecretWatch->>Controller: Enqueue mapping request (NamespacedName)
Controller->>System: MapSecretToNooBaa(secret)
System->>NooBaa: List NooBaa resources in namespace
System->>Controller: Return matching reconcile requests
Controller->>NooBaa: Enqueue reconciliation for affected NooBaa resources
Note right of RPC: Separate flow for incoming RPC messages
RPC->>Queue: Push reconcile.Request(NooBaa system NamespacedName)
Queue->>Controller: Trigger reconciliation (rate-limited)
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. ✨ Finishing Touches
🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
Status, Documentation and Community
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
pkg/system/system.go (2)
1297-1298: Fix inconsistent comment.The comment mentions "backingstores" but the function is clearly designed to map secrets to NooBaa resources, not backing stores.
-// MapSecretToBackingStores returns a list of backingstores that uses the secret in their secretReference -// used by backingstore_controller to watch secrets changes +// MapSecretToNooBaa returns a list of NooBaa resources that reference the secret as their external Postgres secret +// used by noobaa_controller to watch secret changes
1306-1306: Fix grammatical error in log message.- log.Infof("Could not found NooBaa in namespace %q, while trying to find NooBaa that uses %s secret", secret.Namespace, secret.Name) + log.Infof("Could not find NooBaa resources in namespace %q, while trying to find NooBaa that uses %s secret", secret.Namespace, secret.Name)
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
pkg/controller/noobaa/noobaa_controller.go(1 hunks)pkg/system/system.go(1 hunks)pkg/util/util.go(1 hunks)
🧰 Additional context used
🧠 Learnings (1)
📓 Common learnings
Learnt from: Neon-White
PR: noobaa/noobaa-operator#1587
File: pkg/system/reconciler.go:287-291
Timestamp: 2025-07-14T10:59:21.959Z
Learning: NooBaa operator design constraint: Multiple NooBaa instances are not supported in the same namespace, only across different namespaces. This means hard-coded resource names like ConfigMaps are acceptable within a namespace scope.
🔇 Additional comments (2)
pkg/controller/noobaa/noobaa_controller.go (1)
138-147: LGTM! Well-integrated Secret watch implementation.The Secret watch implementation follows the established pattern used by other resource watches in this controller:
- Uses
EnqueueRequestsFromMapFunchandler pattern consistent with the StorageClass watch- Properly extracts the secret's namespaced name and delegates to
system.MapSecretToNooBaa- Applies logging predicate consistently with other watches
- Includes proper error handling
This enables the NooBaa controller to react to changes in external PostgreSQL secrets, supporting the PR objective of reconciliation logic for external secret creation.
pkg/system/system.go (1)
1312-1324: LGTM! Core logic is well implemented.The function correctly:
- Iterates through NooBaa resources in the namespace
- Uses the utility function to get external Postgres secret references
- Handles nil checks appropriately
- Matches secret names accurately
- Builds proper reconcile requests
This will enable the controller to properly trigger reconciliation when external Postgres secrets are created or updated.
Signed-off-by: Anisur Rahman <[email protected]>
anisurrahman75
force-pushed
the
secret-reconcile
branch
from
33ffa86 to
2a09666
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
pkg/system/system.go (1)
1297-1299: Fix misleading doc comment (mentions BackingStores and wrong controller).This exported function maps Secrets to NooBaa reconciles, not BackingStores. Update the comment so godoc and readers don’t get misled.
-// MapSecretToBackingStores returns a list of backingstores that uses the secret in their secretReference -// used by backingstore_controller to watch secrets changes -// +// MapSecretToNooBaa maps a Secret event to NooBaa reconciliations. +// It returns requests for NooBaa CRs whose Spec.ExternalPgSecret matches the Secret. +// Used by the NooBaa controller's Secret watch.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (3)
pkg/controller/noobaa/noobaa_controller.go(1 hunks)pkg/system/system.go(1 hunks)pkg/util/util.go(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (2)
- pkg/util/util.go
- pkg/controller/noobaa/noobaa_controller.go
🧰 Additional context used
🧬 Code graph analysis (1)
pkg/system/system.go (2)
pkg/util/util.go (3)
Logger(902-904)KubeList(645-666)GetNooBaaExternalPgSecret(1866-1875)pkg/apis/noobaa/v1alpha1/noobaa_types.go (1)
NooBaaList(59-70)
|
@dannyzaken, Brother, can you review this PR? |
Explaining the PR
When creating a NooBaa instance that references an external PostgreSQL secret, the secret may not exist at the time of creation. This change ensures that once the external secret is created, the NooBaa system receives a reconciliation request to process it accordingly.
Summary by CodeRabbit