fix(reconciler): store Akamai edgerc as Secret

controllers/reconcile.go

@@ -375,35 +375,48 @@ func (r *FrontendReconciliation) populateCacheBustContainer(j *batchv1.Job) erro
 	// Make the akamai file from the secret
 	edgercFile := makeAkamaiEdgercFileFromSecret(secret)
 
-	configMap := &v1.ConfigMap{}
-	configMap.SetName("akamai-edgerc")
-	configMap.SetNamespace(r.Frontend.Namespace)
+	edgercSecret := &v1.Secret{}
+	edgercSecret.SetName("akamai-edgerc")
+	edgercSecret.SetNamespace(r.Frontend.Namespace)
 
 	nn := types.NamespacedName{
 		Name:      "akamai-edgerc",
 		Namespace: r.Frontend.Namespace,
 	}
 	labels := r.FrontendEnvironment.GetLabels()
 	labler := utils.GetCustomLabeler(labels, nn, r.FrontendEnvironment)
-	labler(configMap)
+	labler(edgercSecret)
 
-	configMap.SetOwnerReferences([]metav1.OwnerReference{r.Frontend.MakeOwnerReference()})
+	edgercSecret.SetOwnerReferences([]metav1.OwnerReference{r.Frontend.MakeOwnerReference()})
 
-	// Add the akamai edgerc file to the configmap
-	configMap.Data = map[string]string{
+	// Add the akamai edgerc file to the secret
+	edgercSecret.StringData = map[string]string{
 		"edgerc": edgercFile,
 	}
 
-	// Create the configmap with the Client if it doesn't already exist or update the existing one
-	if err := r.Client.Create(r.Ctx, configMap); err != nil {
+	// Clean up the legacy ConfigMap that previously held edgerc credentials in plaintext.
+	// The ConfigMap is owned by the Frontend CR and would eventually be garbage-collected
+	// on CR deletion, but we remove it proactively to avoid leaving plaintext credentials
+	// in the namespace longer than necessary.
+	legacyCM := &v1.ConfigMap{}
+	if err := r.Client.Get(r.Ctx, nn, legacyCM); err == nil {
+		if err := r.Client.Delete(r.Ctx, legacyCM); err != nil && !k8serr.IsNotFound(err) {
+			return err
+		}
+	}
+
+	// Create the secret with the Client if it doesn't already exist or update the existing one
+	if err := r.Client.Create(r.Ctx, edgercSecret); err != nil {
 		if !k8serr.IsAlreadyExists(err) {
 			return err
 		}
-		existing := &v1.ConfigMap{}
+		existing := &v1.Secret{}
 		if err := r.Client.Get(r.Ctx, nn, existing); err != nil {
 			return err
 		}
-		existing.Data = configMap.Data
+		existing.StringData = edgercSecret.StringData
+		existing.SetLabels(edgercSecret.GetLabels())
+		existing.SetOwnerReferences(edgercSecret.GetOwnerReferences())
 		if err := r.Client.Update(r.Ctx, existing); err != nil {
 			return err
 		}
@@ -412,10 +425,8 @@ func (r *FrontendReconciliation) populateCacheBustContainer(j *batchv1.Job) erro
 	akamaiVolume := v1.Volume{
 		Name: "akamai-edgerc",
 		VolumeSource: v1.VolumeSource{
-			ConfigMap: &v1.ConfigMapVolumeSource{
-				LocalObjectReference: v1.LocalObjectReference{
-					Name: "akamai-edgerc",
-				},
+			Secret: &v1.SecretVolumeSource{ //nolint:gosec
+				SecretName: "akamai-edgerc",
 			},
 		},
 	}
@@ -432,7 +443,7 @@ func (r *FrontendReconciliation) populateCacheBustContainer(j *batchv1.Job) erro
 	cacheBustContainer := v1.Container{
 		Name:  "akamai-cache-bust",
 		Image: r.FrontendEnvironment.Spec.AkamaiCacheBustImage,
-		// Mount the akamai edgerc file from the configmap
+		// Mount the akamai edgerc file from the secret
 		VolumeMounts: []v1.VolumeMount{
 			{
 				Name:      "akamai-edgerc",
@@ -467,7 +478,7 @@ func (r *FrontendReconciliation) populateCacheBustContainer(j *batchv1.Job) erro
 
 	j.Spec.Template.ObjectMeta.SetAnnotations(annotations)
 
-	// Add the akamai edgerc configmap to the deployment
+	// Add the akamai edgerc secret to the deployment
 
 	return nil
 }

tests/e2e/cachebust-multiple-urls/02-assert.yaml

@@ -80,8 +80,8 @@ spec:
     spec:
       volumes:
         - name: akamai-edgerc
-          configMap:
-            name: akamai-edgerc
+          secret:
+            secretName: akamai-edgerc
             defaultMode: 420
       containers:
         - name: akamai-cache-bust
@@ -185,8 +185,8 @@ spec:
     spec:
       volumes:
         - name: akamai-edgerc
-          configMap:
-            name: akamai-edgerc
+          secret:
+            secretName: akamai-edgerc
             defaultMode: 420
       containers:
         - name: akamai-cache-bust

tests/e2e/cachebust/02-assert.yaml

@@ -80,8 +80,8 @@ spec:
     spec:
       volumes:
         - name: akamai-edgerc
-          configMap:
-            name: akamai-edgerc
+          secret:
+            secretName: akamai-edgerc
             defaultMode: 420
       containers:
         - name: akamai-cache-bust
@@ -185,8 +185,8 @@ spec:
     spec:
       volumes:
         - name: akamai-edgerc
-          configMap:
-            name: akamai-edgerc
+          secret:
+            secretName: akamai-edgerc
             defaultMode: 420
       containers:
         - name: akamai-cache-bust

tests/e2e/cachebust/04-assert.yaml

@@ -80,8 +80,8 @@ spec:
     spec:
       volumes:
         - name: akamai-edgerc
-          configMap:
-            name: akamai-edgerc
+          secret:
+            secretName: akamai-edgerc
             defaultMode: 420
       containers:
         - name: akamai-cache-bust
@@ -185,8 +185,8 @@ spec:
     spec:
       volumes:
         - name: akamai-edgerc
-          configMap:
-            name: akamai-edgerc
+          secret:
+            secretName: akamai-edgerc
             defaultMode: 420
       containers:
         - name: akamai-cache-bust
@@ -270,19 +270,9 @@ spec:
               subPath: fed-modules.json
 ---
 apiVersion: v1
-kind: ConfigMap
+kind: Secret
 metadata:
   name: akamai-edgerc
   namespace: test-cachebust
 data:
-  edgerc: |
-    [default]
-    host = new_host
-    access_token = new_access_token
-    client_token = new_client_token
-    client_secret = new_client_secret
-    [ccu]
-    host = new_host
-    access_token = new_access_token
-    client_token = new_client_token
-    client_secret = new_client_secret
+  edgerc: W2RlZmF1bHRdCmhvc3QgPSBuZXdfaG9zdAphY2Nlc3NfdG9rZW4gPSBuZXdfYWNjZXNzX3Rva2VuCmNsaWVudF90b2tlbiA9IG5ld19jbGllbnRfdG9rZW4KY2xpZW50X3NlY3JldCA9IG5ld19jbGllbnRfc2VjcmV0CltjY3VdCmhvc3QgPSBuZXdfaG9zdAphY2Nlc3NfdG9rZW4gPSBuZXdfYWNjZXNzX3Rva2VuCmNsaWVudF90b2tlbiA9IG5ld19jbGllbnRfdG9rZW4KY2xpZW50X3NlY3JldCA9IG5ld19jbGllbnRfc2VjcmV0Cg==