certrotation: issue more specific update events

vrutkovs · vrutkovs · commit 45778d8299d0 · 2025-08-07T16:41:18.000+02:00
When secret/configmap is being update an event is being emitted. This event should include a more
specific reason why this resource was updated: content change, new annotation etc.

This ensures duplicate events are not being issued by the controller
diff --git a/pkg/operator/certrotation/cabundle.go b/pkg/operator/certrotation/cabundle.go
@@ -67,8 +67,12 @@ func (c CABundleConfigMap) EnsureConfigMapCABundle(ctx context.Context, signingC
 	}
 
 	// run Update if metadata needs changing unless running in RefreshOnlyWhenExpired mode
+	updateDetail := ""
 	if !c.RefreshOnlyWhenExpired {
 		updateRequired = ensureOwnerRefAndTLSAnnotationsForConfigMap(caBundleConfigMap, c.Owner, c.AdditionalAnnotations)
+		if updateRequired {
+			updateDetail = fmt.Sprintf("annotations set to %#v", c.AdditionalAnnotations)
+		}
 	}
 
 	updatedCerts, err := manageCABundleConfigMap(caBundleConfigMap, signingCertKeyPair.Config.Certs[0])
@@ -85,6 +89,7 @@ func (c CABundleConfigMap) EnsureConfigMapCABundle(ctx context.Context, signingC
 			reason = fmt.Sprintf("signer update %s", signingCertKeyPairLocation)
 		}
 		c.EventRecorder.Eventf("CABundleUpdateRequired", "%q in %q requires a new cert: %s", c.Name, c.Namespace, reason)
+		updateDetail = fmt.Sprintf("content change: %s", reason)
 		LabelAsManagedConfigMap(caBundleConfigMap, CertificateTypeCABundle)
 
 		updateRequired = true
@@ -96,19 +101,19 @@ func (c CABundleConfigMap) EnsureConfigMapCABundle(ctx context.Context, signingC
 		if err != nil {
 			return nil, err
 		}
-		klog.V(2).Infof("Created ca-bundle.crt configmap %s/%s with:\n%s", certs.CertificateBundleToString(updatedCerts), caBundleConfigMap.Namespace, caBundleConfigMap.Name)
+		klog.V(2).Infof("Created ca-bundle.crt configmap %s/%s with:\n%s", caBundleConfigMap.Namespace, caBundleConfigMap.Name, certs.CertificateBundleToString(updatedCerts))
 		caBundleConfigMap = actualCABundleConfigMap
 	} else if updateRequired {
 		actualCABundleConfigMap, err := c.Client.ConfigMaps(c.Namespace).Update(ctx, caBundleConfigMap, metav1.UpdateOptions{})
 		if apierrors.IsConflict(err) {
 			// ignore error if its attempting to update outdated version of the configmap
 			return nil, nil
 		}
-		resourcehelper.ReportUpdateEvent(c.EventRecorder, actualCABundleConfigMap, err)
+		resourcehelper.ReportUpdateEvent(c.EventRecorder, actualCABundleConfigMap, err, updateDetail)
 		if err != nil {
 			return nil, err
 		}
-		klog.V(2).Infof("Updated ca-bundle.crt configmap %s/%s with:\n%s", certs.CertificateBundleToString(updatedCerts), caBundleConfigMap.Namespace, caBundleConfigMap.Name)
+		klog.V(2).Infof("Updated ca-bundle.crt configmap %s/%s due to %s with:\n%s", caBundleConfigMap.Namespace, caBundleConfigMap.Name, updateDetail, certs.CertificateBundleToString(updatedCerts))
 		caBundleConfigMap = actualCABundleConfigMap
 	}
 
diff --git a/pkg/operator/certrotation/signer.go b/pkg/operator/certrotation/signer.go
@@ -79,9 +79,16 @@ func (c RotatedSigningCASecret) EnsureSigningCertKeyPair(ctx context.Context) (*
 	}
 
 	// run Update if metadata needs changing unless we're in RefreshOnlyWhenExpired mode
+	updateDetail := ""
 	if !c.RefreshOnlyWhenExpired {
 		needsMetadataUpdate := ensureOwnerRefAndTLSAnnotationsForSecret(signingCertKeyPairSecret, c.Owner, c.AdditionalAnnotations)
+		if needsMetadataUpdate {
+			updateDetail = fmt.Sprintf("annotations update: %v", c.AdditionalAnnotations)
+		}
 		needsTypeChange := ensureSecretTLSTypeSet(signingCertKeyPairSecret)
+		if needsTypeChange {
+			updateDetail = "secret type update"
+		}
 		updateRequired = needsMetadataUpdate || needsTypeChange
 	}
 
@@ -92,6 +99,7 @@ func (c RotatedSigningCASecret) EnsureSigningCertKeyPair(ctx context.Context) (*
 			reason = "secret doesn't exist"
 		}
 		c.EventRecorder.Eventf("SignerUpdateRequired", "%q in %q requires a new signing cert/key pair: %v", c.Name, c.Namespace, reason)
+		updateDetail = fmt.Sprintf("signer update: %s", reason)
 		if err = setSigningCertKeyPairSecretAndTLSAnnotations(signingCertKeyPairSecret, c.Validity, c.Refresh, c.AdditionalAnnotations); err != nil {
 			return nil, false, err
 		}
@@ -116,11 +124,11 @@ func (c RotatedSigningCASecret) EnsureSigningCertKeyPair(ctx context.Context) (*
 			// ignore error if its attempting to update outdated version of the secret
 			return nil, false, nil
 		}
-		resourcehelper.ReportUpdateEvent(c.EventRecorder, actualSigningCertKeyPairSecret, err)
+		resourcehelper.ReportUpdateEvent(c.EventRecorder, actualSigningCertKeyPairSecret, err, updateDetail)
 		if err != nil {
 			return nil, false, err
 		}
-		klog.V(2).Infof("Updated secret %s/%s", actualSigningCertKeyPairSecret.Namespace, actualSigningCertKeyPairSecret.Name)
+		klog.V(2).Infof("Updated secret %s/%s, reason: %s", actualSigningCertKeyPairSecret.Namespace, actualSigningCertKeyPairSecret.Name, updateDetail)
 		signingCertKeyPairSecret = actualSigningCertKeyPairSecret
 	}
 
diff --git a/pkg/operator/certrotation/target.go b/pkg/operator/certrotation/target.go
@@ -113,14 +113,22 @@ func (c RotatedSelfSignedCertKeySecret) EnsureTargetCertKeyPair(ctx context.Cont
 	}
 
 	// run Update if metadata needs changing unless we're in RefreshOnlyWhenExpired mode
+	updateDetail := ""
 	if !c.RefreshOnlyWhenExpired {
 		needsMetadataUpdate := ensureOwnerRefAndTLSAnnotationsForSecret(targetCertKeyPairSecret, c.Owner, c.AdditionalAnnotations)
+		if needsMetadataUpdate {
+			updateDetail = fmt.Sprintf("annotations update: %v", c.AdditionalAnnotations)
+		}
 		needsTypeChange := ensureSecretTLSTypeSet(targetCertKeyPairSecret)
+		if needsTypeChange {
+			updateDetail = "secret type update"
+		}
 		updateRequired = needsMetadataUpdate || needsTypeChange
 	}
 
 	if reason := c.CertCreator.NeedNewTargetCertKeyPair(targetCertKeyPairSecret, signingCertKeyPair, caBundleCerts, c.Refresh, c.RefreshOnlyWhenExpired, creationRequired); len(reason) > 0 {
 		c.EventRecorder.Eventf("TargetUpdateRequired", "%q in %q requires a new target cert/key pair: %v", c.Name, c.Namespace, reason)
+		updateDetail = fmt.Sprintf("content change: %s", reason)
 		if err = setTargetCertKeyPairSecretAndTLSAnnotations(targetCertKeyPairSecret, c.Validity, c.Refresh, signingCertKeyPair, c.CertCreator, c.AdditionalAnnotations); err != nil {
 			return nil, err
 		}
@@ -143,11 +151,11 @@ func (c RotatedSelfSignedCertKeySecret) EnsureTargetCertKeyPair(ctx context.Cont
 			// ignore error if its attempting to update outdated version of the secret
 			return nil, nil
 		}
-		resourcehelper.ReportUpdateEvent(c.EventRecorder, actualTargetCertKeyPairSecret, err)
+		resourcehelper.ReportUpdateEvent(c.EventRecorder, actualTargetCertKeyPairSecret, err, updateDetail)
 		if err != nil {
 			return nil, err
 		}
-		klog.V(2).Infof("Updated secret %s/%s", actualTargetCertKeyPairSecret.Namespace, actualTargetCertKeyPairSecret.Name)
+		klog.V(2).Infof("Updated secret %s/%s, reason: %s", actualTargetCertKeyPairSecret.Namespace, actualTargetCertKeyPairSecret.Name, updateDetail)
 		targetCertKeyPairSecret = actualTargetCertKeyPairSecret
 	}
 

Original file line number	Diff line number	Diff line change
`@@ -67,8 +67,12 @@ func (c CABundleConfigMap) EnsureConfigMapCABundle(ctx context.Context, signingC`
`67`	`67`	`}`
`68`	`68`
`69`	`69`	`// run Update if metadata needs changing unless running in RefreshOnlyWhenExpired mode`
	`70`	`+ updateDetail := ""`
`70`	`71`	`if !c.RefreshOnlyWhenExpired {`
`71`	`72`	`updateRequired = ensureOwnerRefAndTLSAnnotationsForConfigMap(caBundleConfigMap, c.Owner, c.AdditionalAnnotations)`
	`73`	`+ if updateRequired {`
	`74`	`+ updateDetail = fmt.Sprintf("annotations set to %#v", c.AdditionalAnnotations)`
	`75`	`+ }`
`72`	`76`	`}`
`73`	`77`
`74`	`78`	`updatedCerts, err := manageCABundleConfigMap(caBundleConfigMap, signingCertKeyPair.Config.Certs[0])`
`@@ -85,6 +89,7 @@ func (c CABundleConfigMap) EnsureConfigMapCABundle(ctx context.Context, signingC`
`85`	`89`	`reason = fmt.Sprintf("signer update %s", signingCertKeyPairLocation)`
`86`	`90`	`}`
`87`	`91`	`c.EventRecorder.Eventf("CABundleUpdateRequired", "%q in %q requires a new cert: %s", c.Name, c.Namespace, reason)`
	`92`	`+ updateDetail = fmt.Sprintf("content change: %s", reason)`
`88`	`93`	`LabelAsManagedConfigMap(caBundleConfigMap, CertificateTypeCABundle)`
`89`	`94`
`90`	`95`	`updateRequired = true`
`@@ -96,19 +101,19 @@ func (c CABundleConfigMap) EnsureConfigMapCABundle(ctx context.Context, signingC`
`96`	`101`	`if err != nil {`
`97`	`102`	`return nil, err`
`98`	`103`	`}`
`99`		`- klog.V(2).Infof("Created ca-bundle.crt configmap %s/%s with:\n%s", certs.CertificateBundleToString(updatedCerts), caBundleConfigMap.Namespace, caBundleConfigMap.Name)`
	`104`	`+ klog.V(2).Infof("Created ca-bundle.crt configmap %s/%s with:\n%s", caBundleConfigMap.Namespace, caBundleConfigMap.Name, certs.CertificateBundleToString(updatedCerts))`
`100`	`105`	`caBundleConfigMap = actualCABundleConfigMap`
`101`	`106`	`} else if updateRequired {`
`102`	`107`	`actualCABundleConfigMap, err := c.Client.ConfigMaps(c.Namespace).Update(ctx, caBundleConfigMap, metav1.UpdateOptions{})`
`103`	`108`	`if apierrors.IsConflict(err) {`
`104`	`109`	`// ignore error if its attempting to update outdated version of the configmap`
`105`	`110`	`return nil, nil`
`106`	`111`	`}`
`107`		`- resourcehelper.ReportUpdateEvent(c.EventRecorder, actualCABundleConfigMap, err)`
	`112`	`+ resourcehelper.ReportUpdateEvent(c.EventRecorder, actualCABundleConfigMap, err, updateDetail)`
`108`	`113`	`if err != nil {`
`109`	`114`	`return nil, err`
`110`	`115`	`}`
`111`		`- klog.V(2).Infof("Updated ca-bundle.crt configmap %s/%s with:\n%s", certs.CertificateBundleToString(updatedCerts), caBundleConfigMap.Namespace, caBundleConfigMap.Name)`
	`116`	`+ klog.V(2).Infof("Updated ca-bundle.crt configmap %s/%s due to %s with:\n%s", caBundleConfigMap.Namespace, caBundleConfigMap.Name, updateDetail, certs.CertificateBundleToString(updatedCerts))`
`112`	`117`	`caBundleConfigMap = actualCABundleConfigMap`
`113`	`118`	`}`
`114`	`119`
Original file line number	Diff line number	Diff line change
`@@ -79,9 +79,16 @@ func (c RotatedSigningCASecret) EnsureSigningCertKeyPair(ctx context.Context) (*`
`79`	`79`	`}`
`80`	`80`
`81`	`81`	`// run Update if metadata needs changing unless we're in RefreshOnlyWhenExpired mode`
	`82`	`+ updateDetail := ""`
`82`	`83`	`if !c.RefreshOnlyWhenExpired {`
`83`	`84`	`needsMetadataUpdate := ensureOwnerRefAndTLSAnnotationsForSecret(signingCertKeyPairSecret, c.Owner, c.AdditionalAnnotations)`
	`85`	`+ if needsMetadataUpdate {`
	`86`	`+ updateDetail = fmt.Sprintf("annotations update: %v", c.AdditionalAnnotations)`
	`87`	`+ }`
`84`	`88`	`needsTypeChange := ensureSecretTLSTypeSet(signingCertKeyPairSecret)`
	`89`	`+ if needsTypeChange {`
	`90`	`+ updateDetail = "secret type update"`
	`91`	`+ }`
`85`	`92`	`updateRequired = needsMetadataUpdate \|\| needsTypeChange`
`86`	`93`	`}`
`87`	`94`
`@@ -92,6 +99,7 @@ func (c RotatedSigningCASecret) EnsureSigningCertKeyPair(ctx context.Context) (*`
`92`	`99`	`reason = "secret doesn't exist"`
`93`	`100`	`}`
`94`	`101`	`c.EventRecorder.Eventf("SignerUpdateRequired", "%q in %q requires a new signing cert/key pair: %v", c.Name, c.Namespace, reason)`
	`102`	`+ updateDetail = fmt.Sprintf("signer update: %s", reason)`
`95`	`103`	`if err = setSigningCertKeyPairSecretAndTLSAnnotations(signingCertKeyPairSecret, c.Validity, c.Refresh, c.AdditionalAnnotations); err != nil {`
`96`	`104`	`return nil, false, err`
`97`	`105`	`}`
`@@ -116,11 +124,11 @@ func (c RotatedSigningCASecret) EnsureSigningCertKeyPair(ctx context.Context) (*`
`116`	`124`	`// ignore error if its attempting to update outdated version of the secret`
`117`	`125`	`return nil, false, nil`
`118`	`126`	`}`
`119`		`- resourcehelper.ReportUpdateEvent(c.EventRecorder, actualSigningCertKeyPairSecret, err)`
	`127`	`+ resourcehelper.ReportUpdateEvent(c.EventRecorder, actualSigningCertKeyPairSecret, err, updateDetail)`
`120`	`128`	`if err != nil {`
`121`	`129`	`return nil, false, err`
`122`	`130`	`}`
`123`		`- klog.V(2).Infof("Updated secret %s/%s", actualSigningCertKeyPairSecret.Namespace, actualSigningCertKeyPairSecret.Name)`
	`131`	`+ klog.V(2).Infof("Updated secret %s/%s, reason: %s", actualSigningCertKeyPairSecret.Namespace, actualSigningCertKeyPairSecret.Name, updateDetail)`
`124`	`132`	`signingCertKeyPairSecret = actualSigningCertKeyPairSecret`
`125`	`133`	`}`
`126`	`134`
Original file line number	Diff line number	Diff line change
`@@ -113,14 +113,22 @@ func (c RotatedSelfSignedCertKeySecret) EnsureTargetCertKeyPair(ctx context.Cont`
`113`	`113`	`}`
`114`	`114`
`115`	`115`	`// run Update if metadata needs changing unless we're in RefreshOnlyWhenExpired mode`
	`116`	`+ updateDetail := ""`
`116`	`117`	`if !c.RefreshOnlyWhenExpired {`
`117`	`118`	`needsMetadataUpdate := ensureOwnerRefAndTLSAnnotationsForSecret(targetCertKeyPairSecret, c.Owner, c.AdditionalAnnotations)`
	`119`	`+ if needsMetadataUpdate {`
	`120`	`+ updateDetail = fmt.Sprintf("annotations update: %v", c.AdditionalAnnotations)`
	`121`	`+ }`
`118`	`122`	`needsTypeChange := ensureSecretTLSTypeSet(targetCertKeyPairSecret)`
	`123`	`+ if needsTypeChange {`
	`124`	`+ updateDetail = "secret type update"`
	`125`	`+ }`
`119`	`126`	`updateRequired = needsMetadataUpdate \|\| needsTypeChange`
`120`	`127`	`}`
`121`	`128`
`122`	`129`	`if reason := c.CertCreator.NeedNewTargetCertKeyPair(targetCertKeyPairSecret, signingCertKeyPair, caBundleCerts, c.Refresh, c.RefreshOnlyWhenExpired, creationRequired); len(reason) > 0 {`
`123`	`130`	`c.EventRecorder.Eventf("TargetUpdateRequired", "%q in %q requires a new target cert/key pair: %v", c.Name, c.Namespace, reason)`
	`131`	`+ updateDetail = fmt.Sprintf("content change: %s", reason)`
`124`	`132`	`if err = setTargetCertKeyPairSecretAndTLSAnnotations(targetCertKeyPairSecret, c.Validity, c.Refresh, signingCertKeyPair, c.CertCreator, c.AdditionalAnnotations); err != nil {`
`125`	`133`	`return nil, err`
`126`	`134`	`}`
`@@ -143,11 +151,11 @@ func (c RotatedSelfSignedCertKeySecret) EnsureTargetCertKeyPair(ctx context.Cont`
`143`	`151`	`// ignore error if its attempting to update outdated version of the secret`
`144`	`152`	`return nil, nil`
`145`	`153`	`}`
`146`		`- resourcehelper.ReportUpdateEvent(c.EventRecorder, actualTargetCertKeyPairSecret, err)`
	`154`	`+ resourcehelper.ReportUpdateEvent(c.EventRecorder, actualTargetCertKeyPairSecret, err, updateDetail)`
`147`	`155`	`if err != nil {`
`148`	`156`	`return nil, err`
`149`	`157`	`}`
`150`		`- klog.V(2).Infof("Updated secret %s/%s", actualTargetCertKeyPairSecret.Namespace, actualTargetCertKeyPairSecret.Name)`
	`158`	`+ klog.V(2).Infof("Updated secret %s/%s, reason: %s", actualTargetCertKeyPairSecret.Namespace, actualTargetCertKeyPairSecret.Name, updateDetail)`
`151`	`159`	`targetCertKeyPairSecret = actualTargetCertKeyPairSecret`
`152`	`160`	`}`
`153`	`161`