fix(api): Ensure a cred-type is set when creating a secret via the API (#5639)

Author: thomastaylor312

pkg/server/create_cluster_secret_v1alpha1.go

@@ -10,6 +10,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	svcv1alpha1 "github.com/akuity/kargo/api/service/v1alpha1"
+	kargoapi "github.com/akuity/kargo/api/v1alpha1"
 )
 
 type clusterSecret struct {
@@ -40,6 +41,7 @@ func (s *server) CreateClusterSecret(
 	}
 
 	secret := s.clusterSecretToK8sSecret(clsSecret)
+	ensureCredentialTypeLabel(secret)
 	if err := s.client.Create(ctx, secret); err != nil {
 		return nil, fmt.Errorf("create secret: %w", err)
 	}
@@ -80,3 +82,12 @@ func (s *server) clusterSecretToK8sSecret(clsSecret clusterSecret) *corev1.Secre
 
 	return secret
 }
+
+func ensureCredentialTypeLabel(secret *corev1.Secret) {
+	if secret.Labels == nil {
+		secret.Labels = map[string]string{}
+	}
+	if secret.Labels[kargoapi.LabelKeyCredentialType] == "" {
+		secret.Labels[kargoapi.LabelKeyCredentialType] = kargoapi.LabelValueCredentialTypeGeneric
+	}
+}

pkg/server/create_cluster_secret_v1alpha1_test.go

@@ -8,13 +8,15 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/client-go/rest"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 
 	svcv1alpha1 "github.com/akuity/kargo/api/service/v1alpha1"
+	kargoapi "github.com/akuity/kargo/api/v1alpha1"
 	"github.com/akuity/kargo/pkg/server/config"
 	"github.com/akuity/kargo/pkg/server/kubernetes"
 )
@@ -77,6 +79,7 @@ func TestCreateClusterSecret(t *testing.T) {
 	secret := resp.Msg.GetSecret()
 	assert.Equal(t, "kargo-cluster-secrts", secret.Namespace)
 	assert.Equal(t, "secret-1", secret.Name)
+	assert.Equal(t, kargoapi.LabelValueCredentialTypeGeneric, secret.Labels[kargoapi.LabelKeyCredentialType])
 	assert.Equal(t, redacted, secret.StringData["foo"])
 	assert.Equal(t, redacted, secret.StringData["baz"])
 
@@ -94,6 +97,11 @@ func TestCreateClusterSecret(t *testing.T) {
 	data := k8sSecret.Data
 	assert.Equal(t, "bar", string(data["foo"]))
 	assert.Equal(t, "bax", string(data["baz"]))
+	assert.Equal(
+		t,
+		kargoapi.LabelValueCredentialTypeGeneric,
+		k8sSecret.Labels[kargoapi.LabelKeyCredentialType],
+	)
 }
 
 func TestValidateSecrets(t *testing.T) {
@@ -118,3 +126,43 @@ func TestValidateSecrets(t *testing.T) {
 	})
 	require.NoError(t, err)
 }
+
+func TestEnsureCredentialTypeLabel(t *testing.T) {
+	t.Run("sets label when labels nil", func(t *testing.T) {
+		secret := &corev1.Secret{}
+		ensureCredentialTypeLabel(secret)
+		require.Equal(
+			t,
+			kargoapi.LabelValueCredentialTypeGeneric,
+			secret.Labels[kargoapi.LabelKeyCredentialType],
+		)
+	})
+
+	t.Run("sets label when label value empty", func(t *testing.T) {
+		secret := &corev1.Secret{
+			ObjectMeta: metav1.ObjectMeta{
+				Labels: map[string]string{
+					kargoapi.LabelKeyCredentialType: "",
+				},
+			},
+		}
+		ensureCredentialTypeLabel(secret)
+		require.Equal(
+			t,
+			kargoapi.LabelValueCredentialTypeGeneric,
+			secret.Labels[kargoapi.LabelKeyCredentialType],
+		)
+	})
+
+	t.Run("does not overwrite non-empty label", func(t *testing.T) {
+		secret := &corev1.Secret{
+			ObjectMeta: metav1.ObjectMeta{
+				Labels: map[string]string{
+					kargoapi.LabelKeyCredentialType: "repository",
+				},
+			},
+		}
+		ensureCredentialTypeLabel(secret)
+		require.Equal(t, "repository", secret.Labels[kargoapi.LabelKeyCredentialType])
+	})
+}