README
¶
pkg/controller/credentialsloader
Stage-1 event adapter that turns Secret updates into internal Credentials. Subscribes to SecretResourceChangedEvent, calls config.ParseSecretData + config.LoadCredentials (which rejects missing or empty dataplane_username / dataplane_password), and publishes CredentialsUpdatedEvent or CredentialsInvalidEvent. Stronger structural validation (config.ValidateCredentials) is applied separately at controller startup in pkg/controller/config.go.
Like its sibling configloader, it's built on the pkg/controller/resourceloader.BaseLoader scaffold — the event-loop plumbing is shared, only the parse step differs.
Minimal Usage
import (
"gitlab.com/haproxy-haptic/haptic/pkg/controller/credentialsloader"
"gitlab.com/haproxy-haptic/haptic/pkg/events"
)
loader := credentialsloader.NewCredentialsLoaderComponent(bus, logger)
go loader.Start(ctx)
Subscription happens in the constructor, so buffered SecretResourceChangedEvents from the single-resource watcher's initial sync are delivered when bus.Start() is called.
Required Secret Keys
Two non-empty keys are required (both used to authenticate against every HAProxy Dataplane API instance the controller talks to — production deployment and local validation alike):
apiVersion: v1
kind: Secret
metadata:
name: haproxy-credentials
type: Opaque
stringData:
dataplane_username: admin
dataplane_password: <random>
config.LoadCredentials rejects either key being missing or decoded-to-zero-bytes. On failure the loader publishes CredentialsInvalidEvent; the previously-accepted credentials stay active.
Event Contract
In — SecretResourceChangedEvent{Resource} from a SingleWatcher that points at the Secret referenced by spec.credentialsSecretRef. The resourceVersion is read from the unstructured resource by the loader itself; there's no separate version field on the event.
Out — CredentialsUpdatedEvent{Credentials, SecretVersion} on success, CredentialsInvalidEvent{SecretVersion, Error} on failure.
See Also
pkg/core/config—ParseSecretData/LoadCredentials(the functions this adapter wraps), andValidateCredentialsfor the startup-time structural checkpkg/controller/resourceloader— shared event-loop basepkg/controller/configloader— sibling loader built on the same patterndocs/controller/docs/operations/security.md— operator-facing credential rotation + secret-management guidance
License
Apache-2.0 — see root LICENSE.
Documentation
¶
Index ¶
Constants ¶
const ( // ComponentName is the unique identifier for this component. ComponentName = "credentialsloader" // EventBufferSize is the size of the event subscription buffer. // Low-volume component (~1 event per secret change). EventBufferSize = busevents.StandardSubscriberBuffer )
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type CredentialsLoaderComponent ¶
type CredentialsLoaderComponent struct {
*resourceloader.BaseLoader
}
CredentialsLoaderComponent subscribes to SecretResourceChangedEvent and parses Secret data.
This component is responsible for: - Extracting credentials from Secret resources - Parsing Secret data into config.Credentials structures - Publishing CredentialsUpdatedEvent for successfully loaded credentials - Publishing CredentialsInvalidEvent for invalid credentials
Architecture: This is a pure event-driven component with no knowledge of watchers or Kubernetes. It simply reacts to SecretResourceChangedEvent and produces CredentialsUpdatedEvent or CredentialsInvalidEvent.
func NewCredentialsLoaderComponent ¶
func NewCredentialsLoaderComponent(eventBus *busevents.EventBus, logger *slog.Logger) *CredentialsLoaderComponent
NewCredentialsLoaderComponent creates a new CredentialsLoader component.
Parameters:
- eventBus: The EventBus to subscribe to and publish on
- logger: Structured logger for diagnostics
Returns:
- *CredentialsLoaderComponent ready to start
func (*CredentialsLoaderComponent) ProcessEvent ¶
func (c *CredentialsLoaderComponent) ProcessEvent(event busevents.Event)
ProcessEvent handles a single event from the EventBus.
Source Files