Supervisor controllers apply custom labels to JWKS secrets

Signed-off-by: Ryan Richard <richardry@vmware.com>

internal/controller/supervisorconfig/jwks.go

@@ -56,15 +56,17 @@ func generateECKey(r io.Reader) (interface{}, error) {
 // jwkController holds the fields necessary for the JWKS controller to communicate with OPC's and
 // secrets, both via a cache and via the API.
 type jwksController struct {
-	pinnipedClient pinnipedclientset.Interface
-	kubeClient     kubernetes.Interface
-	opcInformer    configinformers.OIDCProviderConfigInformer
-	secretInformer corev1informers.SecretInformer
+	jwksSecretLabels map[string]string
+	pinnipedClient   pinnipedclientset.Interface
+	kubeClient       kubernetes.Interface
+	opcInformer      configinformers.OIDCProviderConfigInformer
+	secretInformer   corev1informers.SecretInformer
 }
 
 // NewJWKSController returns a controllerlib.Controller that ensures an OPC has a corresponding
 // Secret that contains a valid active JWK and JWKS.
 func NewJWKSController(
+	jwksSecretLabels map[string]string,
 	kubeClient kubernetes.Interface,
 	pinnipedClient pinnipedclientset.Interface,
 	secretInformer corev1informers.SecretInformer,
@@ -75,10 +77,11 @@ func NewJWKSController(
 		controllerlib.Config{
 			Name: "JWKSController",
 			Syncer: &jwksController{
-				kubeClient:     kubeClient,
-				pinnipedClient: pinnipedClient,
-				secretInformer: secretInformer,
-				opcInformer:    opcInformer,
+				jwksSecretLabels: jwksSecretLabels,
+				kubeClient:       kubeClient,
+				pinnipedClient:   pinnipedClient,
+				secretInformer:   secretInformer,
+				opcInformer:      opcInformer,
 			},
 		},
 		// We want to be notified when a OPC's secret gets updated or deleted. When this happens, we
@@ -234,6 +237,7 @@ func (c *jwksController) generateSecret(opc *configv1alpha1.OIDCProviderConfig)
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      opc.Name + "-jwks",
 			Namespace: opc.Namespace,
+			Labels:    c.jwksSecretLabels,
 			OwnerReferences: []metav1.OwnerReference{
 				*metav1.NewControllerRef(opc, schema.GroupVersionKind{
 					Group:   configv1alpha1.SchemeGroupVersion.Group,
@@ -241,7 +245,6 @@ func (c *jwksController) generateSecret(opc *configv1alpha1.OIDCProviderConfig)
 					Kind:    opcKind,
 				}),
 			},
-			// TODO: custom labels.
 		},
 		Data: map[string][]byte{
 			activeJWKKey: jwkData,

internal/controller/supervisorconfig/jwks_test.go

@@ -151,6 +151,7 @@ func TestJWKSControllerFilterSecret(t *testing.T) {
 			).Config().V1alpha1().OIDCProviderConfigs()
 			withInformer := testutil.NewObservableWithInformerOption()
 			_ = NewJWKSController(
+				nil, // labels, not needed
 				nil, // kubeClient, not needed
 				nil, // pinnipedClient, not needed
 				secretInformer,
@@ -204,6 +205,7 @@ func TestJWKSControllerFilterOPC(t *testing.T) {
 			).Config().V1alpha1().OIDCProviderConfigs()
 			withInformer := testutil.NewObservableWithInformerOption()
 			_ = NewJWKSController(
+				nil, // labels, not needed
 				nil, // kubeClient, not needed
 				nil, // pinnipedClient, not needed
 				secretInformer,
@@ -264,6 +266,10 @@ func TestJWKSControllerSync(t *testing.T) {
 			ObjectMeta: metav1.ObjectMeta{
 				Name:      goodOPCWithStatus.Status.JWKSSecret.Name,
 				Namespace: namespace,
+				Labels: map[string]string{
+					"myLabelKey1": "myLabelValue1",
+					"myLabelKey2": "myLabelValue2",
+				},
 				OwnerReferences: []metav1.OwnerReference{
 					{
 						APIVersion:         opcGVR.GroupVersion().String(),
@@ -648,6 +654,10 @@ func TestJWKSControllerSync(t *testing.T) {
 			)
 
 			c := NewJWKSController(
+				map[string]string{
+					"myLabelKey1": "myLabelValue1",
+					"myLabelKey2": "myLabelValue2",
+				},
 				kubeAPIClient,
 				pinnipedAPIClient,
 				kubeInformers.Core().V1().Secrets(),