Mark Component image repository secret as internal to prevent editing…

… it from UI
konflux-ci · Sep 7, 2023 · 50e6be6 · 50e6be6
1 parent 75d3928
commit 50e6be6
Show file tree

Hide file tree

Showing 4 changed files with 11 additions and 4 deletions.
diff --git a/controllers/component_image_controller.go b/controllers/component_image_controller.go
@@ -389,8 +389,9 @@ func (r *ComponentReconciler) ensureComponentPullSecretRemoteSecret(ctx context.
 				Name:      remoteSecretName,
 				Namespace: component.Namespace,
 				Labels: map[string]string{
-					ApplicationNameLabelName: component.Spec.Application,
-					ComponentNameLabelName:   component.Name,
+					ApplicationNameLabelName:      component.Spec.Application,
+					ComponentNameLabelName:        component.Name,
+					InternalRemoteSecretLabelName: "true",
 				},
 				OwnerReferences: []metav1.OwnerReference{
 					{

diff --git a/controllers/component_image_controller_test.go b/controllers/component_image_controller_test.go
@@ -162,6 +162,7 @@ var _ = Describe("Component image controller", func() {
 			remoteSecret := waitRemoteSecretExist(remoteSecretKey)
 			Expect(remoteSecret.Labels[ApplicationNameLabelName]).To(Equal(component.Spec.Application))
 			Expect(remoteSecret.Labels[ComponentNameLabelName]).To(Equal(component.Spec.ComponentName))
+			Expect(remoteSecret.Labels[InternalRemoteSecretLabelName]).To(Equal("true"))
 			Expect(remoteSecret.OwnerReferences).To(HaveLen(1))
 			Expect(remoteSecret.OwnerReferences[0].Name).To(Equal(component.Name))
 			Expect(remoteSecret.OwnerReferences[0].Kind).To(Equal("Component"))
@@ -682,6 +683,7 @@ var _ = Describe("Component image controller", func() {
 			remoteSecret := waitRemoteSecretExist(remoteSecretKey)
 			Expect(remoteSecret.Labels[ApplicationNameLabelName]).To(Equal(component.Spec.Application))
 			Expect(remoteSecret.Labels[ComponentNameLabelName]).To(Equal(component.Spec.ComponentName))
+			Expect(remoteSecret.Labels[InternalRemoteSecretLabelName]).To(Equal("true"))
 			Expect(remoteSecret.OwnerReferences).To(HaveLen(1))
 			Expect(remoteSecret.OwnerReferences[0].Name).To(Equal(component.Name))
 			Expect(remoteSecret.OwnerReferences[0].Kind).To(Equal("Component"))

diff --git a/controllers/imagerepository_controller.go b/controllers/imagerepository_controller.go
@@ -43,6 +43,8 @@ import (
 )
 
 const (
+	InternalRemoteSecretLabelName = "appstudio.redhat.com/internal"
+
 	ImageRepositoryFinalizer = "appstudio.openshift.io/image-repository"
 )
 
@@ -503,8 +505,9 @@ func (r *ImageRepositoryReconciler) EnsureRemotePullSecret(ctx context.Context,
 				Name:      remoteSecretName,
 				Namespace: imageRepository.Namespace,
 				Labels: map[string]string{
-					ApplicationNameLabelName: imageRepository.Labels[ApplicationNameLabelName],
-					ComponentNameLabelName:   imageRepository.Labels[ComponentNameLabelName],
+					ApplicationNameLabelName:      imageRepository.Labels[ApplicationNameLabelName],
+					ComponentNameLabelName:        imageRepository.Labels[ComponentNameLabelName],
+					InternalRemoteSecretLabelName: "true",
 				},
 			},
 			Spec: remotesecretv1beta1.RemoteSecretSpec{

diff --git a/controllers/imagerepository_controller_test.go b/controllers/imagerepository_controller_test.go
@@ -340,6 +340,7 @@ var _ = Describe("Image repository controller", func() {
 			remoteSecret := waitRemoteSecretExist(remoteSecretKey)
 			Expect(remoteSecret.Labels[ApplicationNameLabelName]).To(Equal(defaultComponentApplication))
 			Expect(remoteSecret.Labels[ComponentNameLabelName]).To(Equal(defaultComponentName))
+			Expect(remoteSecret.Labels[InternalRemoteSecretLabelName]).To(Equal("true"))
 			Expect(remoteSecret.OwnerReferences).To(HaveLen(1))
 			Expect(remoteSecret.OwnerReferences[0].Name).To(Equal(imageRepository.Name))
 			Expect(remoteSecret.OwnerReferences[0].Kind).To(Equal("ImageRepository"))