loco-operator/internal/reconciler/credential.go

/*
Copyright 2026 LocoStack.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package reconciler

import (
	"context"
	"fmt"

	"github.com/LocoStack/loco-operator/api/v1alpha1"
	corev1 "k8s.io/api/core/v1"
	apierrors "k8s.io/apimachinery/pkg/api/errors"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/runtime"
	"k8s.io/apimachinery/pkg/types"
	"sigs.k8s.io/controller-runtime/pkg/client"
	logf "sigs.k8s.io/controller-runtime/pkg/log"
)

// reconcileCredentials checks that all referenced Secrets exist and contain the
// required keys. Returns true when all credentials are resolved.
func ReconcileCredentials(ctx context.Context, c client.Client, scheme *runtime.Scheme, authSpec *v1alpha1.AuthSpec, obj client.Object) (*metav1.Condition, error) {
	log := logf.FromContext(ctx)

	if authSpec == nil {
		return &metav1.Condition{
			Type:               "CredentialsResolved",
			Status:             metav1.ConditionTrue,
			Reason:             "NoCredentialsRequired",
			Message:            "No auth configured",
			ObservedGeneration: obj.GetGeneration(),
		}, nil
	}

	for _, ref := range AuthSecretRefs(authSpec) {
		if reason, msg, err := checkSecretKey(ctx, c, obj.GetNamespace(), ref.Name, ref.Key); err != nil {
			log.Error(err, "Failed to check API key secret", "namespace", obj.GetNamespace(), "name", obj.GetName(), "secretName", ref.Name, "secretKey", ref.Key)
			return nil, err
		} else {
			if reason != "" {
				return &metav1.Condition{
					Type:    "CredentialsResolved",
					Status:  metav1.ConditionTrue,
					Reason:  reason,
					Message: msg,
				}, nil
			}
		}
	}

	return &metav1.Condition{
		Type:    "CredentialsResolved",
		Status:  metav1.ConditionTrue,
		Reason:  "CredentialsFound",
		Message: "All referenced secrets exist and contain the required keys",
	}, nil
}

// checkSecretKey verifies that a Secret exists and contains the given key.
func checkSecretKey(ctx context.Context, c client.Client, namespace, secretName, key string) (string, string, error) {
	secret := &corev1.Secret{}
	if err := c.Get(ctx, types.NamespacedName{Name: secretName, Namespace: namespace}, secret); err != nil {
		if apierrors.IsNotFound(err) {
			return "SecretNotFound", fmt.Sprintf("Secret %q not found", secretName), nil
		}
		return "", "", err
	}
	if _, ok := secret.Data[key]; !ok {
		return "SecretKeyMissing", fmt.Sprintf("Secret %q does not contain key %q", secretName, key), nil
	}
	return "", "", nil
}

// AuthSecretRefs lists, in a deterministic order, the Secret keys that authSpec sources
// its credentials from.
func AuthSecretRefs(authSpec *v1alpha1.AuthSpec) []corev1.SecretKeySelector {
	if authSpec == nil {
		return nil
	}
	refs := make([]corev1.SecretKeySelector, 0, 2+len(authSpec.Headers))
	if authSpec.APIKey != nil {
		refs = append(refs, authSpec.APIKey.SecretRef)
	}
	if authSpec.BearerToken != nil {
		refs = append(refs, *authSpec.BearerToken)
	}
	for _, hdr := range authSpec.Headers {
		if hdr.ValueFrom.SecretKeyRef != nil {
			refs = append(refs, *hdr.ValueFrom.SecretKeyRef)
		}
	}
	return refs
}