fixup! Migrate Bucket controller to runtime/secrets

Signed-off-by: cappyzawa <[email protected]>

Author: cappyzawa

internal/controller/bucket_controller.go

@@ -155,6 +155,15 @@ type BucketProvider interface {
 	Close(context.Context)
 }
 
+// bucketCredentials contains all credentials and configuration needed for bucket providers.
+type bucketCredentials struct {
+	secret       *corev1.Secret
+	proxyURL     *url.URL
+	tlsConfig    *tls.Config
+	stsSecret    *corev1.Secret
+	stsTLSConfig *tls.Config
+}
+
 // bucketReconcileFunc is the function type for all the v1.Bucket
 // (sub)reconcile functions. The type implementations are grouped and
 // executed serially to perform the complete reconcile of the object.
@@ -421,14 +430,14 @@ func (r *BucketReconciler) reconcileStorage(ctx context.Context, sp *patch.Seria
 // the provider. If this fails, it records v1.FetchFailedCondition=True on
 // the object and returns early.
 func (r *BucketReconciler) reconcileSource(ctx context.Context, sp *patch.SerialPatcher, obj *sourcev1.Bucket, index *index.Digester, dir string) (sreconcile.Result, error) {
-	secret, proxyURL, tlsConfig, stsSecret, stsTLSConfig, err := r.setupCredentials(ctx, obj)
+	creds, err := r.setupCredentials(ctx, obj)
 	if err != nil {
 		e := serror.NewGeneric(err, sourcev1.AuthenticationFailedReason)
 		conditions.MarkTrue(obj, sourcev1.FetchFailedCondition, e.Reason, "%s", e)
 		return sreconcile.ResultEmpty, e
 	}
 
-	provider, err := r.createBucketProvider(ctx, obj, secret, proxyURL, tlsConfig, stsSecret, stsTLSConfig)
+	provider, err := r.createBucketProvider(ctx, obj, creds)
 	if err != nil {
 		var stallingErr *serror.Stalling
 		var genericErr *serror.Generic
@@ -751,8 +760,8 @@ func fetchIndexFiles(ctx context.Context, provider BucketProvider, obj *sourcev1
 }
 
 // setupCredentials retrieves and validates secrets for authentication, TLS configuration, and proxy settings.
-// It returns the primary secret, proxy URL, TLS config, STS secret, and STS TLS config.
-func (r *BucketReconciler) setupCredentials(ctx context.Context, obj *sourcev1.Bucket) (*corev1.Secret, *url.URL, *tls.Config, *corev1.Secret, *tls.Config, error) {
+// It returns all credentials needed for bucket providers.
+func (r *BucketReconciler) setupCredentials(ctx context.Context, obj *sourcev1.Bucket) (*bucketCredentials, error) {
 	var secret *corev1.Secret
 	if obj.Spec.SecretRef != nil {
 		secretName := types.NamespacedName{
@@ -761,7 +770,7 @@ func (r *BucketReconciler) setupCredentials(ctx context.Context, obj *sourcev1.B
 		}
 		secret = &corev1.Secret{}
 		if err := r.Get(ctx, secretName, secret); err != nil {
-			return nil, nil, nil, nil, nil, fmt.Errorf("failed to get secret: %w", err)
+			return nil, fmt.Errorf("failed to get secret: %w", err)
 		}
 	}
 
@@ -773,7 +782,7 @@ func (r *BucketReconciler) setupCredentials(ctx context.Context, obj *sourcev1.B
 		}
 		stsSecret = &corev1.Secret{}
 		if err := r.Get(ctx, secretName, stsSecret); err != nil {
-			return nil, nil, nil, nil, nil, fmt.Errorf("failed to get STS secret:%w", err)
+			return nil, fmt.Errorf("failed to get STS secret:%w", err)
 		}
 	}
 
@@ -791,7 +800,7 @@ func (r *BucketReconciler) setupCredentials(ctx context.Context, obj *sourcev1.B
 		}
 		proxyURL, err = secrets.ProxyURLFromSecretRef(ctx, r.Client, secretRef)
 		if err != nil {
-			return nil, nil, nil, nil, nil, fmt.Errorf("failed to get proxy URL: %w", err)
+			return nil, fmt.Errorf("failed to get proxy URL: %w", err)
 		}
 	}
 
@@ -802,7 +811,7 @@ func (r *BucketReconciler) setupCredentials(ctx context.Context, obj *sourcev1.B
 		}
 		tlsConfig, err = secrets.TLSConfigFromSecretRef(ctx, r.Client, secretRef, obj.Spec.Endpoint, obj.Spec.Insecure)
 		if err != nil {
-			return nil, nil, nil, nil, nil, fmt.Errorf("failed to get TLS config: %w", err)
+			return nil, fmt.Errorf("failed to get TLS config: %w", err)
 		}
 	}
 
@@ -813,45 +822,51 @@ func (r *BucketReconciler) setupCredentials(ctx context.Context, obj *sourcev1.B
 		}
 		stsTLSConfig, err = secrets.TLSConfigFromSecretRef(ctx, r.Client, secretRef, obj.Spec.STS.Endpoint, obj.Spec.Insecure)
 		if err != nil {
-			return nil, nil, nil, nil, nil, fmt.Errorf("failed to get STS TLS config: %w", err)
+			return nil, fmt.Errorf("failed to get STS TLS config: %w", err)
 		}
 	}
 
-	return secret, proxyURL, tlsConfig, stsSecret, stsTLSConfig, nil
+	return &bucketCredentials{
+		secret:       secret,
+		proxyURL:     proxyURL,
+		tlsConfig:    tlsConfig,
+		stsSecret:    stsSecret,
+		stsTLSConfig: stsTLSConfig,
+	}, nil
 }
 
 // createBucketProvider creates a provider-specific bucket client using the given credentials and configuration.
 // It handles different bucket providers (AWS, GCP, Azure, generic) and returns the appropriate client.
-func (r *BucketReconciler) createBucketProvider(ctx context.Context, obj *sourcev1.Bucket, secret *corev1.Secret, proxyURL *url.URL, tlsConfig *tls.Config, stsSecret *corev1.Secret, stsTLSConfig *tls.Config) (BucketProvider, error) {
+func (r *BucketReconciler) createBucketProvider(ctx context.Context, obj *sourcev1.Bucket, creds *bucketCredentials) (BucketProvider, error) {
 	switch obj.Spec.Provider {
 	case sourcev1.BucketProviderGoogle:
-		if err := gcp.ValidateSecret(secret); err != nil {
+		if err := gcp.ValidateSecret(creds.secret); err != nil {
 			return nil, err
 		}
 		var opts []gcp.Option
-		if secret != nil {
-			opts = append(opts, gcp.WithSecret(secret))
+		if creds.secret != nil {
+			opts = append(opts, gcp.WithSecret(creds.secret))
 		}
-		if proxyURL != nil {
-			opts = append(opts, gcp.WithProxyURL(proxyURL))
+		if creds.proxyURL != nil {
+			opts = append(opts, gcp.WithProxyURL(creds.proxyURL))
 		}
 		return gcp.NewClient(ctx, opts...)
 
 	case sourcev1.BucketProviderAzure:
-		if err := azure.ValidateSecret(secret); err != nil {
+		if err := azure.ValidateSecret(creds.secret); err != nil {
 			return nil, err
 		}
 		var opts []azure.Option
-		if secret != nil {
-			opts = append(opts, azure.WithSecret(secret))
+		if creds.secret != nil {
+			opts = append(opts, azure.WithSecret(creds.secret))
 		}
-		if proxyURL != nil {
-			opts = append(opts, azure.WithProxyURL(proxyURL))
+		if creds.proxyURL != nil {
+			opts = append(opts, azure.WithProxyURL(creds.proxyURL))
 		}
 		return azure.NewClient(obj, opts...)
 
 	default:
-		if err := minio.ValidateSecret(secret); err != nil {
+		if err := minio.ValidateSecret(creds.secret); err != nil {
 			return nil, err
 		}
 		if sts := obj.Spec.STS; sts != nil {
@@ -861,25 +876,25 @@ func (r *BucketReconciler) createBucketProvider(ctx context.Context, obj *source
 			if _, err := url.Parse(sts.Endpoint); err != nil {
 				return nil, serror.NewStalling(fmt.Errorf("failed to parse STS endpoint '%s': %w", sts.Endpoint, err), sourcev1.URLInvalidReason)
 			}
-			if err := minio.ValidateSTSSecret(sts.Provider, stsSecret); err != nil {
+			if err := minio.ValidateSTSSecret(sts.Provider, creds.stsSecret); err != nil {
 				return nil, serror.NewGeneric(err, sourcev1.AuthenticationFailedReason)
 			}
 		}
 		var opts []minio.Option
-		if secret != nil {
-			opts = append(opts, minio.WithSecret(secret))
+		if creds.secret != nil {
+			opts = append(opts, minio.WithSecret(creds.secret))
 		}
-		if tlsConfig != nil {
-			opts = append(opts, minio.WithTLSConfig(tlsConfig))
+		if creds.tlsConfig != nil {
+			opts = append(opts, minio.WithTLSConfig(creds.tlsConfig))
 		}
-		if proxyURL != nil {
-			opts = append(opts, minio.WithProxyURL(proxyURL))
+		if creds.proxyURL != nil {
+			opts = append(opts, minio.WithProxyURL(creds.proxyURL))
 		}
-		if stsSecret != nil {
-			opts = append(opts, minio.WithSTSSecret(stsSecret))
+		if creds.stsSecret != nil {
+			opts = append(opts, minio.WithSTSSecret(creds.stsSecret))
 		}
-		if stsTLSConfig != nil {
-			opts = append(opts, minio.WithSTSTLSConfig(stsTLSConfig))
+		if creds.stsTLSConfig != nil {
+			opts = append(opts, minio.WithSTSTLSConfig(creds.stsTLSConfig))
 		}
 		return minio.NewClient(obj, opts...)
 	}