Describe the feature
Currently for TenantResource and GlobalTenantResource we can only reconcile on a given time period or if changes to tenants and namespaces the resources relate to happen.
However we want to be able to provide an option to configure admission like triggers for a reconcile, this would look something like this:
---
apiVersion: capsule.clastix.io/v1beta2
kind: GlobalTenantResource
metadata:
name: tenant-sops-providers
spec:
resyncPeriod: 24h
# New Specification
triggers:
- operations: ["CREATE", "UPDATE"]
apiGroups: [""]
apiVersions: ["v1"]
resources: ["secrets"]
- operations: ["UPDATE"]
apiGroups: [""]
apiVersions: ["v1"]
resources: ["serviceaccounts"]
resources:
- context:
resources:
- index: secrets
apiVersion: v1
kind: Secret
namespace: "{{.namespace}}"
selector:
matchLabels:
pullsecret.company.com: "true"
- index: sa
apiVersion: v1
kind: ServiceAccount
namespace: "{{.namespace}}"
generators:
- template: |
---
apiVersion: v1
kind: ConfigMap
metadata:
name: show-context
data:
context.yaml: |
{{- toYAML $ | nindent 4 }}
The above use-case puts this feature into context. We may want a very high resyncPeriod to avoid constant loops, however we still want to be able to react to events, which may influence the outcome of rendering.
What needs to happen from a technical perspective:
- Collect triggers and post to status (make custom index for fast lookup by GVK)
- Add target for dynamic admission (failurePolicy ignore) which targets all collected triggers
- The webhook itself checks last reconcile condition (must also be added)
- Best-Effort attemts to issue a manual update to related TR or GTR
Describe the feature
Currently for
TenantResourceandGlobalTenantResourcewe can only reconcile on a given time period or if changes to tenants and namespaces the resources relate to happen.However we want to be able to provide an option to configure admission like triggers for a reconcile, this would look something like this:
The above use-case puts this feature into context. We may want a very high
resyncPeriodto avoid constant loops, however we still want to be able to react to events, which may influence the outcome of rendering.What needs to happen from a technical perspective: