Skip to content

kms: clean up and improve autokey config identity and deletion resolution - #9658

Merged
gemmahou merged 1 commit into
GoogleCloudPlatform:masterfrom
iamkonohamaru:kms-autokey-cleanups
Jul 13, 2026
Merged

kms: clean up and improve autokey config identity and deletion resolution#9658
gemmahou merged 1 commit into
GoogleCloudPlatform:masterfrom
iamkonohamaru:kms-autokey-cleanups

Conversation

@iamkonohamaru

Copy link
Copy Markdown
Contributor

This PR cleans up and improves the identity resolution and deletion logic for the KMSAutokeyConfig resource to handle edge cases where referenced projects or folders have already been deleted.

Key Changes
Identity Resolution (apis/kms/v1beta1/autokeyconfig_identity.go):

Updated NewAutokeyConfigIdentity to parse Status.ExternalRef first if it is present.
Validates the Spec references (folderRef or projectRef) against the parsed identity without executing Kubernetes reference resolution. This prevents Delete reconciles from blocking when the parent project/folder has already been deleted.
Added comprehensive unit tests in apis/kms/v1beta1/autokeyconfig_identity_test.go covering all combinations of externalRef and Spec inputs.
Controller Cleanups (pkg/controller/direct/kms/autokeyconfig/autokeyconfig_controller.go):

Reference Resolution: Moved the resolution of keyProjectRef from AdapterForObject down to the Update method. This prevents resolution failures from blocking other operations like Delete.
Deletion Logic:
Updated Delete to return success immediately (return true, nil) if the resource is already UNINITIALIZED on GCP, skipping the rest of the code.
Handled NOT_FOUND errors during the update call in Delete (e.g., if the parent project/folder was already deleted in GCP), treating them as successful deletions.
Adapter Struct: Removed the unused desiredKeyProject field and stored the reader client.Reader to perform reference resolution inside Update.
Redundant Checks: Removed the unnecessary if a.actual == nil check in updateAutokeyConfig.
Schema Compatibility Cleanups:

Deleted the stale exception file tests/apichecks/testdata/exceptions/multi_version_crd_diff/KMSAutokeyConfig.diff. The schemas for v1alpha1 and v1beta1 are now fully identical, and the TestMultiVersionCRDNoDiff schema test passes.

@iamkonohamaru

Copy link
Copy Markdown
Contributor Author

/assign @gemmahou

Comment thread apis/kms/v1beta1/autokeyconfig_identity.go Outdated
Comment thread apis/kms/v1beta1/autokeyconfig_identity_test.go Outdated
@iamkonohamaru iamkonohamaru reopened this Jul 13, 2026
@gemmahou
gemmahou added this pull request to the merge queue Jul 13, 2026
@google-oss-prow google-oss-prow Bot added the lgtm label Jul 13, 2026
@google-oss-prow

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: gemmahou
Once this PR has been reviewed and has the lgtm label, please assign justinsb for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Merged via the queue into GoogleCloudPlatform:master with commit de03df6 Jul 13, 2026
203 of 392 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants