fix(apps): reconcile shared account secret rotations (#10743)

Author: leon-ape

apis/apps/v1/types.go

@@ -400,6 +400,7 @@ type ComponentService struct {
 	DisableAutoProvision *bool `json:"disableAutoProvision,omitempty"`
 }
 
+// +kubebuilder:validation:XValidation:rule="!has(self.secretRefRevision) || size(self.secretRefRevision) == 0 || has(self.secretRef)",message="secretRef must be specified when secretRefRevision is non-empty"
 type ComponentSystemAccount struct {
 	// The name of the system account.
 	//
@@ -423,10 +424,22 @@ type ComponentSystemAccount struct {
 	//
 	// For user-specified passwords, the maximum length is limited to 64 bytes.
 	//
+	// Updates to the referenced Secret do not automatically trigger reconciliation.
+	// To apply updated credentials, update the referenced Secret first and then change
+	// SecretRefRevision to a new value.
+	//
 	// This field is immutable once set.
 	//
 	// +optional
 	SecretRef *ProvisionSecretRef `json:"secretRef,omitempty"`
+
+	// Specifies an opaque revision of the referenced Secret.
+	//
+	// After updating the referenced Secret, change this field to a new value to apply
+	// the updated credentials. The value is treated as an opaque token.
+	//
+	// +optional
+	SecretRefRevision string `json:"secretRefRevision,omitempty"`
 }
 
 // PasswordConfig helps provide to customize complexity of password generation pattern.

config/crd/bases/apps.kubeblocks.io_clusters.yaml

@@ -4358,6 +4358,10 @@ spec:
 
                               For user-specified passwords, the maximum length is limited to 64 bytes.
 
+                              Updates to the referenced Secret do not automatically trigger reconciliation.
+                              To apply updated credentials, update the referenced Secret first and then change
+                              SecretRefRevision to a new value.
+
                               This field is immutable once set.
                             properties:
                               name:
@@ -4377,9 +4381,21 @@ spec:
                             required:
                             - name
                             type: object
+                          secretRefRevision:
+                            description: |-
+                              Specifies an opaque revision of the referenced Secret.
+
+                              After updating the referenced Secret, change this field to a new value to apply
+                              the updated credentials. The value is treated as an opaque token.
+                            type: string
                         required:
                         - name
                         type: object
+                        x-kubernetes-validations:
+                        - message: secretRef must be specified when secretRefRevision
+                            is non-empty
+                          rule: '!has(self.secretRefRevision) || size(self.secretRefRevision)
+                            == 0 || has(self.secretRef)'
                       type: array
                     tls:
                       description: |-
@@ -15562,6 +15578,10 @@ spec:
 
                                   For user-specified passwords, the maximum length is limited to 64 bytes.
 
+                                  Updates to the referenced Secret do not automatically trigger reconciliation.
+                                  To apply updated credentials, update the referenced Secret first and then change
+                                  SecretRefRevision to a new value.
+
                                   This field is immutable once set.
                                 properties:
                                   name:
@@ -15581,9 +15601,21 @@ spec:
                                 required:
                                 - name
                                 type: object
+                              secretRefRevision:
+                                description: |-
+                                  Specifies an opaque revision of the referenced Secret.
+
+                                  After updating the referenced Secret, change this field to a new value to apply
+                                  the updated credentials. The value is treated as an opaque token.
+                                type: string
                             required:
                             - name
                             type: object
+                            x-kubernetes-validations:
+                            - message: secretRef must be specified when secretRefRevision
+                                is non-empty
+                              rule: '!has(self.secretRefRevision) || size(self.secretRefRevision)
+                                == 0 || has(self.secretRef)'
                           type: array
                         tls:
                           description: |-

config/crd/bases/apps.kubeblocks.io_components.yaml

@@ -4989,6 +4989,10 @@ spec:
 
                         For user-specified passwords, the maximum length is limited to 64 bytes.
 
+                        Updates to the referenced Secret do not automatically trigger reconciliation.
+                        To apply updated credentials, update the referenced Secret first and then change
+                        SecretRefRevision to a new value.
+
                         This field is immutable once set.
                       properties:
                         name:
@@ -5008,9 +5012,21 @@ spec:
                       required:
                       - name
                       type: object
+                    secretRefRevision:
+                      description: |-
+                        Specifies an opaque revision of the referenced Secret.
+
+                        After updating the referenced Secret, change this field to a new value to apply
+                        the updated credentials. The value is treated as an opaque token.
+                      type: string
                   required:
                   - name
                   type: object
+                  x-kubernetes-validations:
+                  - message: secretRef must be specified when secretRefRevision is
+                      non-empty
+                    rule: '!has(self.secretRefRevision) || size(self.secretRefRevision)
+                      == 0 || has(self.secretRef)'
                 type: array
               terminationPolicy:
                 default: Delete