Add reconciliation logic for NooBaa with external PostgreSQL for secret creation #1669
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
WalkthroughAdds a Secret watch to the NooBaa controller that maps Secret events to NooBaa reconcile requests, a utility to obtain/normalize a NooBaa external Postgres Secret reference, a mapping function to find NooBaa resources referencing a Secret, and RPC handling that enqueues a NooBaa system reconcile on each message. Changes
Sequence Diagram(s)sequenceDiagram
participant K8sAPI as K8s API Server
participant Controller as NooBaa Controller
participant System as system.MapSecretToNooBaa
participant NooBaa as NooBaa CRs
participant RPC as Global RPC handler
participant Queue as notificationSource (rate-limited)
K8sAPI->>Controller: Secret event (create/update/delete)
Controller->>System: MapSecretToNooBaa(NamespacedName)
System->>NooBaa: List NooBaa in namespace
NooBaa-->>System: Return NooBaa list
System->>Controller: Return matching reconcile.Requests
Controller->>Controller: Enqueue reconciliations for matched NooBaa resources
Note right of RPC: Separate RPC-triggered enqueue
RPC->>Queue: Push reconcile.Request(NooBaa system NamespacedName)
Queue->>Controller: Trigger reconciliation (rate-limited)
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Tip 👮 Agentic pre-merge checks are now available in preview!Pro plan users can now enable pre-merge checks in their settings to enforce checklists before merging PRs.
Please see the documentation for more information. Example: reviews:
pre_merge_checks:
custom_checks:
- name: "Undocumented Breaking Changes"
mode: "warning"
instructions: |
Pass/fail criteria: All breaking changes to public APIs, CLI flags, environment variables, configuration keys, database schemas, or HTTP/GraphQL endpoints must be documented in the "Breaking Change" section of the PR description and in CHANGELOG.md. Exclude purely internal or private changes (e.g., code not exported from package entry points or explicitly marked as internal).Please share your feedback with us on this Discord post. 📜 Recent review detailsConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro 📒 Files selected for processing (4)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (3)
Pre-merge checks (2 passed, 1 warning)❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches
🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
pkg/system/system.go (2)
1297-1298: Fix inconsistent comment.The comment mentions "backingstores" but the function is clearly designed to map secrets to NooBaa resources, not backing stores.
-// MapSecretToBackingStores returns a list of backingstores that uses the secret in their secretReference -// used by backingstore_controller to watch secrets changes +// MapSecretToNooBaa returns a list of NooBaa resources that reference the secret as their external Postgres secret +// used by noobaa_controller to watch secret changes
1306-1306: Fix grammatical error in log message.- log.Infof("Could not found NooBaa in namespace %q, while trying to find NooBaa that uses %s secret", secret.Namespace, secret.Name) + log.Infof("Could not find NooBaa resources in namespace %q, while trying to find NooBaa that uses %s secret", secret.Namespace, secret.Name)
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
pkg/controller/noobaa/noobaa_controller.go(1 hunks)pkg/system/system.go(1 hunks)pkg/util/util.go(1 hunks)
🧰 Additional context used
🧠 Learnings (1)
📓 Common learnings
Learnt from: Neon-White
PR: noobaa/noobaa-operator#1587
File: pkg/system/reconciler.go:287-291
Timestamp: 2025-07-14T10:59:21.959Z
Learning: NooBaa operator design constraint: Multiple NooBaa instances are not supported in the same namespace, only across different namespaces. This means hard-coded resource names like ConfigMaps are acceptable within a namespace scope.
🔇 Additional comments (2)
pkg/controller/noobaa/noobaa_controller.go (1)
138-147: LGTM! Well-integrated Secret watch implementation.The Secret watch implementation follows the established pattern used by other resource watches in this controller:
- Uses
EnqueueRequestsFromMapFunchandler pattern consistent with the StorageClass watch- Properly extracts the secret's namespaced name and delegates to
system.MapSecretToNooBaa- Applies logging predicate consistently with other watches
- Includes proper error handling
This enables the NooBaa controller to react to changes in external PostgreSQL secrets, supporting the PR objective of reconciliation logic for external secret creation.
pkg/system/system.go (1)
1312-1324: LGTM! Core logic is well implemented.The function correctly:
- Iterates through NooBaa resources in the namespace
- Uses the utility function to get external Postgres secret references
- Handles nil checks appropriately
- Matches secret names accurately
- Builds proper reconcile requests
This will enable the controller to properly trigger reconciliation when external Postgres secrets are created or updated.
anisurrahman75
force-pushed
the
secret-reconcile
branch
from
33ffa86 to
2a09666
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
pkg/system/system.go (1)
1297-1299: Fix misleading doc comment (mentions BackingStores and wrong controller).This exported function maps Secrets to NooBaa reconciles, not BackingStores. Update the comment so godoc and readers don’t get misled.
-// MapSecretToBackingStores returns a list of backingstores that uses the secret in their secretReference -// used by backingstore_controller to watch secrets changes -// +// MapSecretToNooBaa maps a Secret event to NooBaa reconciliations. +// It returns requests for NooBaa CRs whose Spec.ExternalPgSecret matches the Secret. +// Used by the NooBaa controller's Secret watch.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (3)
pkg/controller/noobaa/noobaa_controller.go(1 hunks)pkg/system/system.go(1 hunks)pkg/util/util.go(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (2)
- pkg/util/util.go
- pkg/controller/noobaa/noobaa_controller.go
🧰 Additional context used
🧬 Code graph analysis (1)
pkg/system/system.go (2)
pkg/util/util.go (3)
Logger(902-904)KubeList(645-666)GetNooBaaExternalPgSecret(1866-1875)pkg/apis/noobaa/v1alpha1/noobaa_types.go (1)
NooBaaList(59-70)
|
@dannyzaken, Brother, can you review this PR? |
Signed-off-by: Anisur Rahman <[email protected]>
anisurrahman75
force-pushed
the
secret-reconcile
branch
from
2dbc98b to
a522323
Compare
|
Hi @anisurrahman75, thanks for your PR! Can you please open an issue that explains the problem this PR is resolving? Please put a reference to the issue in the Pr description. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Explaining the PR
When creating a NooBaa instance that references an external PostgreSQL secret, the secret may not exist at the time of creation. This change ensures that once the external secret is created, the NooBaa system receives a reconciliation request to process it accordingly.
Summary by CodeRabbit
New Features
Chores